Tor

How Onion Routing Works

Tor (The Onion Router) anonymizes traffic through layered EncryptionThe process of converting plaintext data into ciphertext using a cryptographic algorithm and key, making it unreadable without the corresponding decryption key. The foundation of secure communication on the internet.. When a Tor client establishes a circuit, it selects three relay nodes from the Tor network directory: a Guard (entry) node, a Middle node, and an Exit node. The client encrypts the data three times — once for each node — in nested layers.

Each relay decrypts only its own layer, learning only the previous and next hops, never the full source-destination pair. The Guard node knows the client's real IP but not the destination. The Exit node knows the destination but not the client's IP. No single node has complete knowledge of both endpoints simultaneously.

Tor's Limitations

Tor is not a complete anonymity solution. Traffic analysis at both the entry and exit can correlate timing patterns to de-anonymize users. Exit node operators can observe unencrypted traffic to non-HTTPSHTTP Secure. The encrypted version of HTTP that uses TLS to protect data in transit between a browser and a web server. Identified by the padlock icon in browsers and the https:// URL scheme. destinations. Tor is significantly slower than direct connections due to multi-hop latency. Browser fingerprinting can de-anonymize users even over Tor if JavaScript is enabled or the browser is configured in uncommon ways.

Onion Services

Tor hosts .onion services — servers accessible through the Tor network without revealing their IP address. Both client and server remain anonymous. Onion services are used by journalists, activists, privacy-conscious operators, and whistleblower platforms.

Tor uses SOCKS ProxyA general-purpose proxy protocol (SOCKS4/SOCKS5) that relays any TCP (and optionally UDP) traffic through a proxy server. Unlike HTTP proxies, SOCKS operates at a lower level and is protocol-agnostic. SOCKS5 as its local client interface. Any application supporting SOCKS5 can route traffic through Tor without modification. Use DNS Leak Test to verify DNS queries are not bypassing Tor and revealing your activity to your ISP.