01. A network built around separation of knowledge
Tor is a system for routing internet traffic through a sequence of volunteer-operated relays. Its design aims to prevent any single relay in a typical circuit from knowing both the user's network address and the final destination. This separation can reduce some forms of tracking and observation, but it is not a universal anonymity guarantee.
02. How a circuit works
A Tor circuit usually uses three relays: a guard (entry), a middle relay, and an exit relay. The client negotiates layered encryption so each relay knows only the information needed for its part of the route. The guard sees the connecting client address, but not the final destination. The middle relay connects the two ends without learning the full path. The exit relay connects to the destination on the public internet.
03. What each relay can observe
The guard can observe that a device is connecting to Tor, along with timing and volume patterns. The middle relay sees traffic moving between Tor relays. The exit relay sees the destination connection; if the destination does not use end-to-end encryption such as HTTPS, content may be exposed at that point. This is why transport encryption remains important.
04. Traffic correlation and realistic limits
A sufficiently capable observer who can monitor both ends of a communication may attempt traffic-correlation analysis. Tor is designed to make surveillance harder, not mathematically impossible. Endpoint compromise, account logins, identifying disclosures, and unsafe downloads can also undermine privacy regardless of network routing.
05. Practical safety principles
Keep Tor Browser updated, avoid installing untrusted extensions, use HTTPS where available, and treat downloaded documents as potentially identifying. Read the Tor Browser guide and build a personal threat model before choosing protections.
06. Circuit construction, guards, and path selection
Tor clients obtain network information from signed directory documents and use it to select relays according to the client’s path-selection rules. A circuit is not a random chain assembled independently for every packet: circuits are built and reused for a period, which helps limit the exposure created by frequent path changes. Guard selection is deliberately persistent. Reusing a small set of entry guards reduces the chance that a user eventually encounters a malicious or unusually well-positioned entry relay simply through repeated sampling.
Relay roles are not interchangeable in the threat model. A guard can associate a connection with the client’s network address; an exit can observe the destination connection and any application data that is not protected end to end. A middle relay generally sees only the adjacent relays. These are protocol-level visibility limits, not guarantees that an observer cannot infer more through timing, external logs, or traffic analysis.
07. What Tor does not conceal
Tor does not automatically anonymize a person who signs into an identifying account, reuses a unique username, reveals personal details, or opens a downloaded file in an application that makes network requests outside Tor. It also does not prevent malware on the endpoint from recording activity. Separate the network question (“who can observe the route?”) from the identity question (“what information identifies me?”).
08. Practical verification checklist
- Use the official Tor Browser distribution and verify updates where practical.
- Keep the browser’s security level and configuration aligned with the sensitivity of the activity.
- Prefer HTTPS; Tor routing does not replace application-layer encryption.
- Do not infer that a site is trustworthy merely because it is reachable through Tor.
Primary reading: Tor Project: About Tor and Tor specifications. Last substantive review: 11 November 2026.