Most people meet Tor as a browser you download, and that is a fair place to start, but the browser is only the front door. Behind it sits a network built around one stubborn idea: the machine you are talking to should never be the machine that knows who you are. Ordinary browsing fails that test constantly. Your connection goes straight to a server, and that server, along with your internet provider, can tie your address to every page you open. It breaks that link on purpose, and it does so with a design that is easier to picture than it sounds.
What Tor is, in one paragraph
Tor is short for The Onion Router, and it is a free network of relays run by volunteers around the world. When you use it, your traffic does not travel in a straight line. It is wrapped in several layers of encryption and passed through three separate relays, each of which can remove only its own layer. The first relay knows who you are but not where you are going. The last relay knows the destination but not who asked. Nobody in the chain holds both halves of the secret, and that split is the whole trick.
How onion routing works
The name is a picture of the method. Your client wraps the data in three layers, like the skins of an onion, one for each relay it will pass through. As the packet moves along the chain, every relay peels off the single layer addressed to it, reads only where to send the packet next, and forwards it on. The middle relay is there so the first and last never meet, which means a relay would have to control both ends of your path at once to work out what you are doing.
How a circuit gets built, and why it is built that way
The three-layer picture above describes what a finished path looks like. How the path comes into existence is a separate and rather clever question, because the client has to end up sharing a secret with each of three relays without any of them learning what the others know.
Building the path one hop at a time
The client does not announce its route. It builds the path outwards, extending it by one relay at a time, and each extension is negotiated through the part of the path that already exists.
- Connect to the first relay and agree on a key. The client and the first relay establish a shared secret between themselves. At this point the path is one hop long and the first relay knows only that this client is talking to it.
- Ask the first relay to extend to a second. The instruction travels inside the encryption already established with the first relay. The second relay is contacted on the client's behalf, and a key is agreed between the client and the second relay — a key the first relay carries but cannot read, because it was negotiated through it rather than with it.
- Repeat once more to reach the third. The same manoeuvre, now travelling through two layers. The client ends up holding three separate keys, one per relay, and no relay holds any key but its own.
The consequence is worth stating explicitly, because it is what makes the design work: the first relay knows who you are and does not know where you are going; the last relay knows where you are going and does not know who you are; and the relay in the middle knows neither, existing precisely so that the first and last never touch each other. Compromising one relay yields one of those facts, and one of those facts is not enough to identify anybody.
Why the first relay is chosen rarely and kept
The three relays are not treated the same. The middle and last positions are picked afresh and rotate constantly. The first position — the guard — is chosen sparingly and kept for a long time, which looks backwards until you think about the arithmetic. If a client picked a new entry relay for every circuit, then over enough circuits it would eventually pick a hostile one, and given enough time that becomes a near-certainty rather than a risk. Sticking with one guard converts the question from "will you eventually be unlucky" into "were you unlucky once, at the start". Most users will never draw a hostile guard; the small number who do would have drawn one anyway under the rotating scheme, only later and repeatedly. It is a deliberate trade of many small exposures for one fixed one.
Circuits are not permanent
A circuit is reused for a while and then retired for new connections, so a long browsing session does not travel one fixed path all day. Tor Browser goes further and separates traffic by which site you are visiting, so two sites open at once are generally not sharing a path out of the network. That is why one site can be slow while another is fine, and it is the reason the browser offers to build a new circuit for a site rather than restarting everything.
None of this applies in quite the same form when you connect to an onion service, which uses a different construction with no exit relay at all — the torhaven guide to onion addresses takes that apart step by step.
What Tor hides and what it does not
This is where most disappointment comes from, so it is worth being blunt. Tor hides the fact of your connection and your network location from the sites you visit and from anyone watching your line. It does nothing about what you choose to reveal once you are connected. If you sign into an account with your real name, that name is out, no matter how many relays it travelled through.
| Concern | Does Tor help? |
|---|---|
| Your provider seeing which sites you open | Yes. They see you use Tor, not where you go. |
| A site logging your home address | Yes. It sees an exit relay instead. |
| Logging in with a real account | No. You handed over the identity yourself. |
| A file you download and open outside Tor | No. It can reach the network on its own. |
| Being tricked into a look-alike address | No. That is a job for verification, not routing. |
torhaven safety note
Treat Tor as protection for the pipe, not for your judgement. It keeps the connection private, but the account you log into, the document you open and the address you trust are all still on you. Most people who lose their anonymity here do it with a habit, not with a broken relay.
Why the exit relay matters for what a site sees
The exit relay is the last hop before your traffic reaches its destination, and it is the IP address a site logs, not yours. This is also why an exit relay operator can, in principle, see unencrypted traffic leaving their node — another reason to prefer HTTPS destinations, since it protects the path but not automatically the content once it leaves the network, exactly as the table above lays out.
Correlation attacks: the theoretical limit
An adversary who can watch traffic entering and leaving the Tor network at the same time, at scale, can in principle correlate timing patterns to link a user to a destination, even without breaking any encryption. This is a known, documented limitation, not a secret weakness — it requires an adversary with very broad visibility, well beyond a single relay operator or a curious website. For most people's threat model this is not the practical risk; account logins and downloaded files are.
Why any of this matters
The value of splitting knowledge across relays is that it survives a single point going bad. On the ordinary web, one logging server or one curious provider is enough to reconstruct your day. On Tor, one relay is never enough, because it only ever holds one end of one hop. That does not make you invisible, and it was never meant to. It makes surveillance expensive instead of automatic, and that shift is the reason journalists, researchers and ordinary cautious people use it.
torhaven warning
Do not read privacy as invincibility. It cannot save you from opening a booby-trapped file, from a browser add-on that phones home, or from typing your real details into a form. Every one of those leaks around the network rather than through it, so the network never gets a chance to protect you.
Tor is not the same as the dark web
People use the two names as if they were one, and they are not. Tor is a network and a browser. The dark web is a small set of sites that live only inside networks like Tor and are reached through onion addresses. You can spend all day on it reading ordinary news sites and never touch an onion service. The network is the road, the onion sites are a few specific destinations on it, and confusing the two makes both harder to reason about.
Reaching an onion site
Onion services have addresses that end in .onion and work only inside Tor. Because there is no certificate authority behind them, the address itself is the identity, which is exactly why a fake one is dangerous. Here is the shape of a real address, shown so you can see how long it is:
torhaven verification check
vortex7e5d5qekpkmnjy2bkt7afzwrzhtyup5bozej7dy34syimnxsyd.onionTeaching example only. A v3 address is 56 characters before .onion, so read the whole string, not the first few. Cross-check the canonical list on torindex and confirm the signature on torverify before you rely on it.
Once you understand that the address is the proof, the habit that follows writes itself: read it from a source you can verify, compare every character, and paste it in by hand. Our torhaven guide on how to access Tor safely walks through the browser side of that.
What "reaching" an onion site actually involves
Unlike a clearnet lookup, connecting to an onion address does not touch the regular internet's domain name system at all — the address itself, derived from the service's public key, is enough for the network to route to it through a rendezvous point neither side has to expose their location for. This is part of why an onion address cannot be "registered" or bought the way a .com domain can; it is generated, not assigned.
Who actually runs the Tor network
Tor is not a single company's product — the network runs on thousands of independently operated relays donated by volunteers, universities, nonprofits and privacy-focused organizations around the world, coordinated by the nonprofit Tor Project which develops the software but does not own or control the relays themselves. This distributed structure is precisely what makes it resistant to any single point of failure or takeover: no one operator sees enough of a connection's path to unmask it, and no single entity can shut the whole network down by seizing one piece of infrastructure.
Why relay diversity matters more than relay count
A network with thousands of relays clustered under a handful of hosting providers or in a handful of countries would still be fragile in ways that matter for anonymity, because a well-positioned adversary controlling enough relays in the right places could correlate traffic despite the raw numbers looking healthy. The Tor Project actively tracks and publishes relay diversity metrics for exactly this reason — geographic spread and operator diversity are treated as seriously as total relay count.
Running a relay yourself
Anyone with a stable connection can run a Tor relay, and the network's health depends on enough people choosing to. Running a relay is different from running an exit node specifically — a middle relay carries traffic without ever seeing its final destination, which is a lower-commitment way to contribute if the exit-node legal exposure that comes with being the visible last hop is not something you want to take on.
How your client knows which relays exist
There is a question hiding underneath everything above. If the relays are run by thousands of unrelated volunteers, how does a freshly installed client know which machines are relays at all — and what stops somebody from simply announcing a list of their own?
The answer is a document called the consensus. A small number of long-established, independently operated servers, the directory authorities, each keep track of the relays they can see and periodically publish their own view. Those views are then reconciled into a single document that only counts as valid when enough of the authorities have signed it. Your client ships knowing who the authorities are, fetches the resulting document, checks the signatures, and uses it as its picture of the network.
The property this buys is the important part. No single authority can insert a relay, remove one, or misrepresent the network, because a document carrying one signature is not a consensus and clients will not accept it. Subverting the picture your client sees means subverting several independently run organisations at once, which is a much larger undertaking than compromising any one machine.
What the consensus records about each relay
It is not simply a list of addresses. Relays carry flags describing what they have been observed to be good for: whether a relay is stable enough and long-lived enough to be trusted in the guard position, whether it permits connections out to the wider internet and is therefore an exit, whether it is fast, whether it has been marked as misbehaving and should be avoided. Separate measurement systems estimate how much capacity each relay actually has, so that traffic can be spread in proportion to what relays can carry rather than spread evenly across machines of wildly different sizes.
Your client uses all of that when it picks a path. The selection is weighted rather than uniform, it respects the flags, and it applies constraints that keep a single path from being unnecessarily concentrated. This is quietly one of the more important parts of the design, because a naive random choice across an unweighted list would be both slower and easier to influence by anyone willing to run a large number of small relays.
Why this is refreshed constantly
Relays appear, disappear, change capacity and lose their flags all the time, so the document is regenerated on a short cycle and clients keep fetching new ones. A client working from an old consensus makes worse routing choices and can fail in ways that look like censorship. It is also the reason a badly wrong system clock causes trouble: the signatures and validity windows on these documents are time-bound, and a machine that disagrees about what time it is will reject documents that are perfectly good.
Common misconceptions about Tor worth clearing up
"Tor is illegal to use"
In the large majority of countries, using Tor itself is legal; what you do over it can still be illegal or legal depending on the activity, exactly as with any other tool. A small number of jurisdictions restrict or block it at the network level, which is a separate question from its legality in general.
"Tor makes you completely anonymous no matter what you do"
Tor anonymizes your connection's path, not your behavior. Logging into a personal account, typing identifying information into a form, or downloading a file that phones home outside the Tor process can all undermine the anonymity its routing provides. The network solves one specific problem well; it is not a blanket guarantee.
"Only criminals use Tor"
Journalists, whistleblowers, abuse survivors, researchers under authoritarian censorship, ordinary people who simply value privacy, and organizations including news outlets and human rights groups all rely on it daily. Its userbase reflects everyone who has a reason to want a connection's path hidden, which is a far broader group than any one use case suggests.
Common torhaven questions
Is using Tor legal?
In most countries the network itself is legal and is used every day by ordinary people, researchers and reporters. What you do on it is judged the same way it would be anywhere else. Using the road is not the same as where you drive.
Does Tor make me completely anonymous?
No. It hides your network location and unlinks your connection from your destination, which is a lot, but it cannot undo details you reveal yourself or protect files you run outside the browser.
Is Tor just a VPN?
No. A VPN routes you through one company you have to trust with everything. It splits trust across three independent relays, so no single one holds both ends of your path.
Why is Tor sometimes slow?
Your traffic takes three hops through volunteer relays around the world instead of a direct line, and that distance costs time. The delay is the price of the design, not a fault.
Why does Tor keep using the same first relay instead of changing it?
Deliberately, and it is one of the better decisions in the design. A client that picked a fresh entry relay for every circuit would eventually pick a hostile one, and over enough circuits that becomes near-certain rather than unlikely. Keeping one guard for a long time turns the question from "will you eventually be unlucky" into "were you unlucky once, at the start". Most users never draw a bad guard; the few who do would have drawn one anyway under a rotating scheme, only later and repeatedly.
What stops someone from telling my Tor client a fake list of relays?
The network's relay list is published as a signed consensus document that only counts as valid when enough independently operated directory authorities have signed it, and your client ships knowing which authorities to expect. One authority cannot insert a relay, remove one, or misrepresent the network on its own, because a document with a single signature is not a consensus and clients reject it.
Do all my browser tabs share one Tor circuit?
No. Circuits are reused for a while and then retired for new connections, and Tor Browser additionally separates traffic by which site you are visiting, so two sites open at once are generally not sharing a path out of the network. That is why one site can be slow while another is fine, and why the browser offers to build a new circuit for a single site rather than restarting everything.
Why torhaven starts its handbook here
Every torhaven reader eventually needs the same three things in the same order: an understanding of what Tor actually hides, a way to reach it safely, and a way to trust the address once they get there. This torhaven guide is deliberately the first of the three, because the two that follow it — the torhaven guide to accessing Tor safely, and the torhaven guide to onion addresses — both assume you already know what a relay is and why three of them matter. Skipping ahead to either without this torhaven page first tends to produce the exact cargo-cult habit torhaven's guide library is built to avoid: steps followed correctly without understanding why they work.
What this torhaven guide deliberately leaves for later
Notice what is missing here: nothing above walks you through installing Tor Browser, and nothing shows you a real onion address to verify. That is intentional. torhaven splits those jobs into their own guides rather than folding everything into one long page, for the same reason torhaven splits torindex and torverify into their own sites — a page trying to do three jobs does all three worse. Once the network model above makes sense, the natural next torhaven guide is how to access Tor safely, followed by what an onion address really is.
A torhaven guide is read, not skimmed
If you have reached this point by reading rather than jumping straight to the FAQ, that is exactly how a torhaven guide is meant to be used — the four-step method described on the torhaven homepage asks you to follow a page in order, including the parts that feel obvious. The diagram, the table and the callouts above are not decoration; each one is there because a reader who only reads the paragraphs tends to miss the one detail — the exit relay, the correlation-attack limit — that a torhaven editor flagged as the part people get wrong.
How torhaven keeps this torhaven guide from going stale
A torhaven guide about Tor is riskier to leave untouched than most, because the network's threat landscape shifts faster than a static page can track on its own. torhaven's answer is not to promise daily updates torhaven cannot keep, but to route anything time-sensitive — a relay-diversity concern, a newly documented correlation technique — to a primary source rather than hosting a torhaven-authored claim that would need constant babysitting. When the Tor Project's own guidance changes, that is one of the review triggers described in torhaven's editorial policy, and this torhaven page gets pulled back for a pass rather than being left to quietly drift out of date.