There is a quiet trap at the very first step, before you have visited a single site. People search for it, click the top result, and install whatever it hands them. Sometimes that top result is a paid advert pointing at a repackaged installer with something extra inside. The browser is free and the real one is easy to find, so the only skill you need at the start is refusing to be rushed past the download. Everything after that is straightforward.
Where to start, and where not to
Start at the official Tor Project website and nowhere else. Not a mirror a forum recommended, not an app store listing you are unsure about, not a link in a message. The official build is signed by the people who make it, which means you can check that the file you received is the file they published. That check is the difference between installing a browser and installing a browser plus whatever a stranger added.
Installing Tor Browser, step by step
- Download from the official project site. Type the address yourself rather than following a search advert, and pick the build for your operating system.
- Verify the signature if you can. The project publishes a signature for each release so you can confirm the installer was not altered on the way to you.
- Install and open the browser. Run the file and let it connect. On a censored network you may need a bridge, which the browser can request for you.
- Set your security level. Open the shield menu and choose Standard, Safer or Safest based on how exposed you are.
- Reach a site by address. Read an onion address from a source you can verify, paste it in by hand, and confirm the whole string before you act on the page.
Choosing a security level
Tor Browser ships with three levels, reached through the shield icon. Each one trades convenience for a smaller attack surface, and the right choice depends on how much you have to lose if a page misbehaves.
| Level | What changes | Suits |
|---|---|---|
| Standard | Everything on. Sites behave normally. | Low-stakes reading on sites you trust. |
| Safer | JavaScript off on plain HTTP, some media blocked. | A sensible default for most people. |
| Safest | JavaScript off everywhere, most extras disabled. | Anyone whose safety depends on staying unseen. |
torhaven safety note
If you are unsure, choose Safer and move up rather than down. Most of the browser exploits that have actually been used in the wild rely on scripting, and turning it off closes that door at the cost of a few sites looking plain. A plain page you can trust beats a rich page you cannot.
Opening your first onion address
Once the browser is running, an onion address works like any other web address, with one difference that changes everything: there is no certificate authority to vouch for it, so the address itself is the proof of identity. Read it from a signed source, paste it in, and check the whole string. Here is the shape of a real one:
torhaven verification check
omega7uedcjqlwt3hwf4emqbkwynvizci3ukiipbdoqeqmyvhpr4i5ad.onionTeaching example only. Compare all 56 characters against the signed copy before you trust the page it opens. Cross-check the canonical list on torindex and confirm the signature on torverify before you rely on it.
Habits that keep the install worth having
The browser protects you only as far as your habits let it. Keep it updated, because a version left to age is the single most common way people are caught out. Resist installing add-ons, since each one is a new way to be fingerprinted or tracked, and the browser is already tuned to blend in. Leave the window at its default size, and do not maximise it out of habit, because the exact dimensions of your screen are one more detail a site can measure.
Why updates matter more on Tor Browser than elsewhere
Tor Browser ships security fixes for both the browser itself and the network client bundled with it, and an outdated copy can carry a known, publicly documented vulnerability that a general-purpose browser patched months earlier. The update prompt inside the browser is not routine software nagging; treat it as the same priority as the address-verification habit covered elsewhere on this site.
Why blending in with other Tor users is a real protection
Every Tor Browser installation is deliberately configured to look identical to every other one — same window size, same fonts, same extensions (none). This uniformity is intentional: the more you customize your setup, the more your traffic can be distinguished from the crowd of other users, which narrows the anonymity set the network is built to provide. Resisting the urge to personalize the browser is itself a security decision, not a missed feature.
Common mistakes
Three errors turn a careful install into a leaky one. The first is downloading from wherever the search engine points, advert included, instead of the official site. The second is logging into a personal account inside it, which hands over the identity the network was working to protect. The third is trusting the first onion address you are shown, when the address is precisely the thing a fake will get almost right.
torhaven warning
Never open a document you downloaded over it while you are outside the browser. Files like PDFs and office documents can reach the network on their own when opened, and that connection goes straight out, around it, revealing the address the browser had hidden.
Tor across different devices
Tor Browser exists for more than one platform, and the practical trade-offs differ enough between them to matter for how you actually set things up.
Desktop: the most controllable option
A desktop or laptop running Tor Browser gives the most control over what else is running on the machine, which matters because other software sharing the device can leak information the browser itself never touches. A dedicated, minimal install used only for Tor sessions closes off more of that surface than a general-purpose daily-driver machine.
Tails: Tor with the operating system itself hardened
Tails boots from a USB drive into an operating system built specifically to route everything through Tor and to leave no trace on the host machine by default. It solves problems the desktop browser alone does not — like other installed applications leaking data outside it — at the cost of needing a dedicated USB drive and a reboot to use it.
Mobile: workable, with real trade-offs
Tor Browser for Android is a legitimate, official option, but phones are inherently harder to fully compartmentalize — background apps, cloud backups and notification services all run alongside it in ways that are harder to fully isolate than on a dedicated desktop install. Treat mobile use as suitable for casual, lower-stakes browsing rather than as equivalent to a hardened desktop or Tails setup.
Confirming your Tor Browser install itself is genuine
Why verify the installer at all
A tampered Tor Browser installer defeats every precaution downstream of it — if the browser itself is compromised, no amount of careful browsing afterward fixes that. This is why the download source matters as much as anything covered later in this torhaven guide.
What the official download provides
The official Tor Project download page provides the installer alongside a cryptographic signature you can check against their published signing key, the same principle as verifying an onion address, applied to the software itself before you ever open it — a principle this torhaven guide returns to at every step.
Running the check, command by command
The verification itself is four short steps and takes a couple of minutes the first time. It is the same shape as any other signature check: get the signing key, satisfy yourself the key is the right one, then verify the file against it.
- Download the installer and its signature together. Every build on the official download page is published alongside a small companion file ending in
.asc. That file is the detached signature, and without it there is nothing to check, so take both while you are there. - Obtain the signing key. GnuPG can fetch it for you directly —
gpg --auto-key-locate nodefault,wkd --locate-keys [email protected]is the usual invocation, and there are alternative routes listed on the project's own verification page if that path is blocked where you are. - Check the fingerprint against the project's published value. Run
gpg --fingerprint [email protected]and compare the forty characters it prints against the fingerprint the Tor Project publishes on its verification documentation. torhaven deliberately does not reprint that value here: a fingerprint copied from a third-party page is only as good as the third-party page, and the whole point of the step is to take it from the source itself. - Verify the download.
gpg --verify tor-browser-....tar.xz.asc tor-browser-....tar.xz— signature file first, then the file it covers, with the real filenames substituted. A pass prints Good signature naming the Tor Browser developers' signing key.
torhaven verification check
Expect a warning underneath the good-signature line saying the key is not certified with a trusted signature. That is normal and is not a failure — it means GnuPG has no independent evidence tying the key to the name beside it, which is exactly what step three above is for. A genuine failure says BAD signature, or reports that no public key was available to check against. The torhaven PGP guide explains the difference in full.
If you cannot run the check
Not everyone has a terminal available, and a verification you cannot perform is not a reason to give up on the install. What is worth doing instead, in rough order of value: type the project's address into the browser yourself rather than arriving through a search result or an advertisement, since a look-alike download page is the realistic threat here rather than a tampered file on the real one; prefer the official site over a software mirror or an app store listing you have not checked; and treat any build offered through a forum link, a file-sharing service, or a "faster" third-party mirror as unverified regardless of how helpful the person offering it seems. None of that is as good as a signature check. All of it is considerably better than nothing.
Why every Tor Browser looks identical, and why you should not fix that
Tor Browser will feel slightly wrong to use, and the ways in which it feels wrong are almost all deliberate. It is worth understanding the reasoning, because otherwise the natural response to each small annoyance is to change it back, and changing it back is the mistake.
The problem being solved is fingerprinting. A website does not need a cookie to recognise a returning visitor; it can measure characteristics of the browser and machine and combine them into a signature. Screen and window dimensions, installed fonts, time zone, language settings, the exact way graphics are drawn, the list of extensions — each is individually unremarkable, and together they are frequently unique. Against that, hiding your network location accomplishes nothing, because you were identified by the browser rather than by the address.
The countermeasure is uniformity. If every Tor Browser reports the same font list, the same time zone, the same language, and rounds its window to the same set of sizes, then measuring those things sorts users into a few large groups instead of identifying individuals. This is why the browser adds grey bars around the page rather than filling an unusual window size, why it ships with a fixed extension set, and why it does not offer to remember your preferences the way an ordinary browser would.
What this means for how you use it
Do not install extensions, including privacy extensions. An unusual extension makes you more identifiable, and the ones people reach for — ad blockers, script managers, VPN helpers — are either redundant with what is already there or actively counterproductive. Do not maximise the window out of habit. Do not change the language, the fonts or the zoom level unless you have a reason that outweighs standing out. And change the security posture with the built-in security level control rather than by adjusting individual script permissions site by site, because the levels are settings many other users share and per-site exceptions are settings almost nobody shares.
The uncomfortable summary is that personalising this browser is a security decision with a cost, not a matter of taste. Every adjustment that makes it feel more like your own browser makes it more like yours specifically, which is the opposite of the goal.
What still leaks around the browser
Tor Browser protects what passes through it. A surprising amount of what goes wrong passes around it instead, through software that has no idea the browser exists. These are the routes worth knowing, because none of them are exotic and all of them are avoidable.
Documents that connect to the internet when you open them
A downloaded document opened outside the browser is handled by a separate application with its own network access. Some file formats can be built to fetch remote content when opened, and that fetch goes out over your ordinary connection, revealing the address the browser spent three relays hiding. This is a documented risk the Tor Project itself warns about. The safe handling is to open anything of that kind on a machine that is offline, or on an amnesic system, and never to double-click it out of the downloads list while connected.
Other applications resolving names in the clear
Only the traffic from Tor Browser goes through Tor. A chat client, a mail client, a torrent client or a package manager running at the same time uses your ordinary connection and its ordinary name resolution. Torrent software is a special case worth naming because it commonly announces the machine's own address inside the protocol itself, which no amount of proxying at another layer fixes.
Logging into an account that already knows you
No routing property survives this. Signing into an account tied to your name, or one you have previously used on your ordinary connection, tells the service exactly who is visiting. The same applies more subtly to reusing a distinctive username, an email address, or a writing style across contexts that were meant to stay apart.
A clock that is significantly wrong
Time matters more here than people expect. Circuit and directory operations depend on the machine's clock being roughly right, so a badly wrong clock produces failures that look like censorship or network trouble. It is also a characteristic a site can measure. Keeping system time correct is a small thing that prevents a confusing category of problem.
The operating system talking on its own behalf
Underneath the browser, the system may be checking for updates, syncing files, or reporting diagnostics on its own schedule. That traffic is unrelated to anything you are doing in the browser and is visible to whoever can see your connection. It does not undo Tor's protection of what is inside the browser, but it does mean the observable fact "this machine is active right now" exists independently of it.
The pattern across all five is the same. Tor protects a pipe; it does not protect a computer. Anything that steps outside that pipe — another program, another account, another file — steps outside the protection, and it does so silently, which is what makes this category worth learning before you need it rather than after.
What to do when the connection will not start
Most installs work on the first try, so it is worth knowing what the handful of common failure modes actually look like before assuming something is broken.
The circuit never finishes building
A progress bar that stalls partway through, or a "trouble connecting" message, is usually a network blocking outbound access to the entry points a fresh install tries by default, not a fault in the software itself. Restarting the app rarely fixes this on its own, because the underlying block sits outside the app, not inside it.
Bridges: the built-in fallback for a blocked connection
The settings panel includes a way to connect through an unlisted entry point rather than the public list a censor can simply block wholesale. Selecting a built-in option first is the right move for most people; requesting a fresh one from within the app itself is the fallback if the built-in choices are also blocked where you are. Neither step requires anything more advanced than clicking through the same settings menu used to choose a security level earlier in this torhaven guide.
A clock that is wrong breaks more than it should
A system clock set far enough off from real time can break the cryptographic handshakes the whole connection depends on, producing errors that look unrelated to the actual cause. This is an easy thing to overlook and an easy one to fix: correct the system clock first, before working through any of the more involved troubleshooting steps above it.
When none of the above resolves it
If a fresh install, a built-in bridge, and a correct clock still do not produce a working connection, the most likely remaining cause is a network-level block aggressive enough to also interfere with bridge traffic, which is a harder problem than this torhaven guide can fully solve in a paragraph. At that point, the project's own support channels, reached through the official site, are a more reliable next step than generic troubleshooting advice found elsewhere.
Common torhaven questions
Do I need a VPN as well as Tor?
For most people, no. Tor is designed to stand on its own, and adding a VPN can help or hurt depending on your situation. If you are unsure, using it as shipped is the safer default than a setup you do not fully understand.
Is it safe to maximise the window?
Better not to. The browser sets a default size on purpose so users look alike. Maximising reveals your exact screen dimensions, which is one more detail that helps a site tell you apart from everyone else.
What is a bridge?
A bridge is an unlisted entry point into Tor, used when a network blocks the public relays. Tor Browser can request one during setup, which lets you connect from places where plain Tor is filtered.
Can I use my normal browser for onion sites?
No. Onion addresses resolve only inside Tor, and an ordinary browser has none of the protections that make using them safe. Use Tor Browser for anything that ends in .onion.
Should I install a privacy extension to make Tor Browser safer?
No. Extensions are one of the properties a site can measure, so an unusual set makes you easier to single out rather than harder. The ones people reach for are also mostly redundant with what the browser already does. Change the security level with the built-in control instead; that is a setting many other users share.
Is it safe to open a document I downloaded over Tor?
Not while you are online. A document opened outside the browser is handled by another application with its own network access, and some file formats can be built to fetch remote content on open — a request that goes out over your ordinary connection. Open anything of that kind on a machine that is offline, or on an amnesic system.
What if I cannot verify the Tor Browser download signature?
Do the next best things rather than skipping the install. Type the project's address yourself instead of arriving through a search result or an advertisement, since a look-alike download page is the realistic threat. Prefer the official site to any mirror or repackaged build, and treat anything offered through a forum link or a file-sharing service as unverified however helpful the offer seems.
Does a wrong system clock really break Tor?
It can, and the failure looks like something else entirely. Circuit and directory operations depend on the machine's time being roughly correct, so a badly wrong clock produces connection errors that read like censorship or network trouble. Checking the clock is worth doing early when a connection will not establish, because it is quick and it eliminates a whole confusing category of problem.
How this torhaven guide fits the install-to-first-onion path
This torhaven guide is the second stop in the torhaven library's opening sequence, sitting right after what Tor actually is and right before what an onion address really is. torhaven put it in that order deliberately: the install steps above make far more sense once you already know why three relays matter, and the address-verification habit that comes next only clicks once the browser itself is running and trusted.
What torhaven assumes you brought with you
This torhaven guide does not re-explain onion routing or re-argue why the official download matters more than convenience — the previous torhaven guide already made that case. What it does instead is turn that understanding into a concrete, five-step routine you can actually run, because a torhaven guide that only explains and never instructs would leave you no better equipped than before you arrived.
Where this torhaven guide sends you next
Once the browser is installed, verified and set to a sensible security level, the natural next torhaven guide is what an onion address really is, followed by what is PGP. Both build directly on the habits this torhaven page just walked you through.