Tor Browser, how three relays keep who you are and what you visit apart

A VPN (see the dedicated article) shifts trust onto a single provider, which technically sees all the traffic passing through it. Tor Browser rests on a different idea: spreading that trust across several independent relays, none of which ever holds the full picture on its own.

Onion routing, the core principle

Tor, short for "The Onion Router," routes every connection through three different relays instead of just one. Before being sent, the connection is encrypted in several successive layers, one per relay planned along the route, a bit like the stacked layers of an onion. Each relay only peels off a single layer of encryption, just enough to know where to pass the connection on next, without ever seeing the actual content or the full route.

Why no single relay ever has the full picture

The entry relay knows the real IP address of the person connecting, but doesn't know which site they're trying to reach at the end of the line. The middle relay knows neither: it simply passes the connection along between the entry relay and the exit relay. The exit relay sees the final site being visited, but has no idea at all who initiated the connection in the first place. This deliberate separation, originally developed by the US Naval Research Laboratory before being made public, and now maintained by the Tor Project, a nonprofit organization, guarantees that no single actor along this route, nor even every relay taken separately, can link an identity to a destination without compromising several different relays at once.

.onion addresses, anonymity for the server too

Tor also allows hosting services reachable only through a .onion address, invisible to a regular browser and absent from traditional search engines. This mechanism protects anonymity both ways: not just for the person visiting a site, but also for the organization hosting it, a real use case for news outlets in countries with active censorship, or for secure journalist tip-reporting platforms.

What Tor doesn't encrypt: traffic after the exit node

One often-misunderstood point is worth clarifying: Tor anonymizes the connection's route, it doesn't automatically encrypt the content exchanged with the final site. If that site doesn't itself use HTTPS (see the article on phishing for what that encryption guarantees), the exit relay sees the content pass through in plain text, exactly as any untrustworthy network intermediary would. Malicious exit relays, deliberately set up to observe or alter this unencrypted traffic, have been identified and removed from the network in the past. The rule stays simple: Tor protects "who's talking to whom," not automatically the content of what's being said, which always depends on the visited site's own encryption.

The Harvard case, a lesson in what Tor really protects

An incident from 2013 nicely illustrates another, different limit of Tor. A Harvard student had sent a fake bomb threat over Tor to get out of taking a final exam. Technically, the Tor network was never compromised in this case: the university only had to check its own Wi-Fi network's connection logs, and noticed that a single device had used Tor around the time the message was sent. Being the only person using Tor on a monitored, restricted network was, on its own, enough to narrow the list of suspects down to a handful of people, with no encryption ever needing to be broken. The lesson goes beyond this one case: the anonymity Tor provides over the network route doesn't protect against an inference made from the context it's used in.

The speed trade-off, the price of anonymity

Routing every connection through three separate relays, potentially located on different continents, adds a real delay compared to a direct connection. Tor Browser is, as a result, noticeably slower than a regular browser or a VPN, a trade-off accepted in exchange for a level of separation no single VPN can offer.

Things to keep in mind

• Using Tor remains legal in the vast majority of countries, even though some very restrictive regimes actively block or monitor its use
• Logging into an identifiable personal account (email, social media) through Tor cancels out much of the anonymity sought, since the service being visited then directly knows the person's identity despite the anonymized route
• As the Harvard case reminds us, the context of use (being an isolated case on a restricted, monitored network) can give away an identity with no technical flaw involved at all

Who it's for

Tor Browser is for anyone who needs a strong separation between their network identity and the sites they visit: journalists, sensitive sources, or simply anyone concerned about not letting a single entity centralize their entire browsing history. It isn't a tool built for speed or general everyday use, but for situations where that separation genuinely matters more than convenience.