Tor is probably the most famous privacy network on the internet.
It is also one of the most misunderstood.
For some people, Tor means the Dark Web. For others, it is synonymous with complete anonymity. Neither interpretation is technically accurate.
Tor is a distributed network designed to make it significantly harder to connect a user's network activity with their real IP address and physical location.
Its central technology is called onion routing.
Understanding how it works is essential if you want to understand the modern Dark Web, online anonymity and the limitations of privacy technologies.
What Is Tor?
Tor stands for The Onion Router.
It is an open-source network that routes internet traffic through multiple relays instead of allowing the user's device to communicate directly with the destination.
A conventional connection may look like:
User → Website
A simplified Tor connection looks more like:
User → Guard Relay → Middle Relay → Exit Relay → Website
Each relay has a limited view of the communication.
That separation is one of the fundamental principles behind Tor.
Netbe has a dedicated technical explanation of how the Tor network works, including onion routing and its main risks.
What Is Onion Routing?
The name "onion routing" comes from the idea of multiple layers.
Imagine a message protected by several envelopes.
The first recipient removes one layer and discovers where to send the message next.
The second recipient does the same.
The final recipient receives the message after the previous layers have been removed.
Tor uses a comparable concept with cryptographic layers.
Before traffic enters a Tor circuit, the Tor client establishes encryption for the different relay positions.
Each relay can then process only the information necessary to perform its part of the job.
This creates a chain in which no ordinary relay should have a complete picture of both the user and the final destination.
The Three Main Tor Relays
A typical Tor circuit contains three main relay positions.
1. Guard Relay
The first relay is usually called the guard relay or entry guard.
It receives traffic directly from the user.
Consequently, the guard can see the user's IP address.
However, it should not know the final destination of the connection.
This is an important part of the Tor trust model.
2. Middle Relay
The middle relay sits between the entry and exit points.
It primarily knows which relay sent the traffic to it and which relay should receive it next.
It should not know the original user's IP address or the final website.
3. Exit Relay
The exit relay is the point where traffic leaves the Tor network when the user connects to a conventional internet website.
The destination normally sees the exit relay's IP address, not the user's original address.
This is one of the reasons Tor can provide network-level anonymity.
However, there is an important limitation.
The exit relay does not automatically encrypt the connection all the way to the destination.
That responsibility belongs to the application protocol, such as HTTPS.
Tor Does Not Replace HTTPS
This distinction is frequently misunderstood.
Tor provides protection within its routing architecture, but it does not magically turn every website connection into an end-to-end encrypted session.
Consider two examples.
Tor + HTTP
User → Tor → Exit Relay → HTTP Website
The traffic between the exit relay and the website is not protected by HTTPS.
Tor + HTTPS
User → Tor → Exit Relay → HTTPS Website
HTTPS provides encryption between the browser and the website.
This is why Tor and HTTPS should be considered complementary technologies.
Tor helps obscure the network origin.
HTTPS protects the application-level connection.
How Does a Tor Circuit Work?
Tor does not normally establish one permanent route for everything a user does.
Instead, the client creates circuits consisting of several relays.
The client performs cryptographic handshakes with the relays and establishes the keys necessary for communication.
The resulting structure means that each relay has only part of the information needed to understand the complete route.
A simplified example:
Alice → Guard → Middle → Exit → Website
The guard knows Alice.
The exit knows the website.
The middle knows the relays immediately before and after it.
No ordinary relay is supposed to have the entire picture.
This separation is fundamental to the anonymity model.
Why Is This Better Than a Direct Connection?
Consider a normal internet connection.
A website can normally receive the user's public IP address.
That address may provide information about the user's network or approximate geographical location.
With Tor, the website normally receives the IP address of the exit relay.
The website therefore cannot simply look at the connection and see the user's original public IP address.
This doesn't mean the user becomes impossible to identify.
It means one important source of identifying information has been separated from the destination.
That distinction matters.
Tor and the Dark Web Are Not the Same Thing
Another common misconception is that Tor equals Dark Web.
It doesn't.
Tor can be used to access ordinary websites.
It can also be used to access services that exist entirely inside the Tor network.
Those services are commonly known as onion services and use .onion addresses.
Netbe's article on Tor Browser and its capabilities in the Darknet explains this relationship in more detail.
In other words:
Tor = network technology.
Dark Web = hidden services and content operating through specialized networks.
The two concepts overlap, but they are not identical.
How Do .onion Services Work?
A conventional website normally has a publicly reachable server and a public IP address.
An onion service is designed differently.
Its server does not need to expose a conventional public IP address to users.
Both sides of the communication can remain within the Tor network.
A simplified model is:
User → Tor Network → Onion Service
rather than:
User → Tor Network → Public Internet → Server
This architecture can protect the location of the server as well as the identity of the user.
Netbe also has a detailed technical article explaining how Onion Services work, including the mechanisms used to establish communication without directly exposing the server's IP address.
Why Is Tor Slower?
There is an obvious trade-off.
A normal connection tries to take an efficient path between the user and destination.
Tor deliberately introduces additional relays.
Every additional hop adds latency.
Encryption and cryptographic processing add further overhead.
As a result, Tor is generally slower than a direct connection or a conventional VPN.
This isn't necessarily a defect.
It is partly the price of the architecture.
Tor prioritizes privacy and anonymity characteristics over raw speed.
Can Tor Make You Completely Anonymous?
No.
This is the most important point in understanding Tor.
The technology can protect against certain forms of network-level identification, but it cannot protect users from their own mistakes.
Imagine someone using Tor but then logging into their personal Google account.
The network may hide their IP address from Google, but the user has voluntarily identified themselves through the account.
The same applies to:
- using a personal email account,
- publishing your real name,
- reusing a recognizable username,
- revealing personal information,
- downloading unsafe documents,
- installing unusual browser extensions,
- changing privacy settings unnecessarily.
The network can protect the connection.
It cannot erase information you deliberately provide.
Browser Fingerprinting
IP addresses are not the only way websites can distinguish users.
Another technique is browser fingerprinting.
A website can potentially examine characteristics of the browser and device environment, such as:
- screen properties,
- language,
- browser configuration,
- graphics capabilities,
- installed fonts,
- operating-system characteristics.
Tor Browser attempts to reduce this problem by making users' browser environments more uniform.
This is why aggressive customization can actually be harmful to anonymity.
If your browser becomes unusually unique, you may become easier to distinguish.
For users interested specifically in anonymity, Netbe's analysis of whether Tor is really anonymous is a useful follow-up: Tor and the limits of anonymity.
Traffic Correlation Attacks
Tor also has limitations against very powerful adversaries.
One of the most important theoretical threats is traffic correlation.
Imagine an organization capable of observing traffic entering the Tor network and traffic leaving it.
Even without decrypting the contents, an observer could potentially compare:
- timing,
- packet volumes,
- traffic patterns,
- connection duration,
- bursts of activity.
If enough information is available, the attacker may be able to correlate the incoming and outgoing traffic.
This is one reason Tor should never be described as an absolute anonymity guarantee.
Its effectiveness depends partly on the capabilities of the adversary.
What About the Tor Exit Node?
The exit node deserves special attention.
When traffic leaves Tor toward the normal internet, the exit relay becomes the apparent source of the connection.
The destination sees the exit relay's IP address.
However, the operator of the exit relay can potentially observe traffic that is not protected by an additional encryption layer such as HTTPS.
This is why users should not treat Tor as a substitute for secure application protocols.
A useful rule is:
Tor protects the route. HTTPS protects the web session.
Using both provides a much stronger security model than relying on either one alone.
Tor vs VPN
Tor and VPN services are often placed into the same category, but their trust models are different.
A VPN usually creates an encrypted connection between the user and a VPN provider.
That provider therefore becomes an important point of trust.
Tor distributes the route across multiple independent relays.
A simplified comparison:
| Feature | Tor | VPN |
|---|---|---|
| Architecture | Multiple relays | Usually one provider |
| Destination sees | Exit relay IP | VPN server IP |
| Typical speed | Lower | Higher |
| Access to .onion services | Yes | Not inherently |
| Trust model | Distributed | Provider-centric |
| Primary goal | Anonymity/privacy | Privacy/security |
Neither solution is universally superior.
The right technology depends on the threat model.
Netbe also explores the relationship between these technologies in VPN and Tor: how they compare and how privacy can be improved.
Does Tor Protect Against Malware?
No.
This is another important distinction.
Tor can change how network traffic is routed.
It does not make malicious software harmless.
A Tor user can still encounter:
- phishing,
- malware,
- fake websites,
- malicious downloads,
- credential theft,
- social engineering,
- scams.
Privacy and security are related, but they are not identical.
A person can have a highly private connection and still be successfully attacked.
For this reason, operational security remains extremely important.
Netbe's guide to safe Tor usage and the most important security rules covers issues such as browser configuration, extensions, downloads and identity separation.
Why Does Tor Still Matter in 2026?
Despite its limitations, Tor remains one of the most important privacy technologies available to ordinary internet users.
Its value goes beyond the Dark Web.
Tor can support:
- anonymous publishing,
- journalism,
- whistleblower platforms,
- censorship resistance,
- privacy research,
- cybersecurity investigations,
- access to onion services.
At the same time, the same infrastructure can be abused by criminals.
This dual-use characteristic is not unique to Tor.
Encryption, cryptocurrencies, VPNs and cloud infrastructure can all be used for legitimate or criminal purposes.
The technology itself does not determine the intent.
The Real Meaning of "Anonymous"
Perhaps the biggest conceptual mistake is treating anonymity as a binary state.
You are not simply either:
anonymous
or
not anonymous.
Real-world anonymity is better understood as a spectrum influenced by:
- network architecture,
- browser configuration,
- user behavior,
- metadata,
- application security,
- adversary capabilities,
- operational security.
Tor can improve one part of that equation substantially.
It cannot solve every part.
Final Thoughts
Tor is not a magic invisibility cloak.
It is a carefully engineered anonymity network that separates the user's network identity from the destination through layered encryption and multiple relays.
The architecture is powerful, but it has limitations.
Tor does not mean perfect anonymity.
Tor does not mean automatic security.
Tor does not mean illegal activity.
And Tor does not equal the Dark Web.
Understanding these distinctions is essential before going deeper into the subject.
The next question is even more important for ordinary internet users:
Is the Dark Web actually illegal?
In the next article, we'll examine the legal side of anonymous networks, what people can legitimately do with privacy technologies, and where activities can cross the line into criminal behavior.
Top comments (0)