How Tor Actually Works (And When You Should Use It)

Tor is onion routing — a technique developed by the US Naval Research Laboratory in the mid-1990s to protect US intelligence communications online. The irony that it's now used to protect people from surveillance, including US government surveillance, is noted by everyone who studies it.

The Layered Encryption Model

When you use Tor, your traffic is encrypted in three layers and routed through three relays chosen randomly from a network of thousands of volunteer-operated nodes. The first relay (guard node) knows your IP but not your destination. The last relay (exit node) knows your destination but not your IP. The middle relay knows neither. No single node has the full picture.

Each layer of encryption is stripped as the traffic passes through each relay — like peeling an onion (hence the name). The guard strips the outermost layer to find the address of the middle relay. The middle relay strips the next layer to find the exit node. The exit strips the final layer to find the actual destination and makes the connection on your behalf.

What Tor Protects Against

Tor provides strong protection against traffic analysis — an observer watching your connection sees only encrypted traffic going to the first relay. They can't tell which website you're visiting. Your ISP, your government, anyone monitoring your local network — all they see is 'this person is using Tor.'

For journalists communicating with sources, activists in authoritarian countries, whistleblowers, and anyone who needs genuine anonymity rather than just privacy, Tor is the serious tool. It's not perfect. It's not fast. But it's the strongest widely available anonymity system that doesn't require trusting any single third party.

The Real Limitations

Tor is slow. A three-hop chain through volunteer relays on three different continents introduces real latency. Streaming video is painful. Tor is also fingerprint-resistant but not fingerprint-immune — if you log into your Google account over Tor, Google knows it's you. If your browser sends information that uniquely identifies your device, Tor doesn't help.

Actually, scratch that — the most important point about Tor is operational security. The protocol is sound. The failures that have led to people being identified were almost always behavioural: logging into personal accounts, using unique usernames, or running unpatched software. Tor protects your network-layer identity. It doesn't protect you from yourself.

When a VPN Is Better

For most people, most of the time, a VPN is the right tool. Faster, easier, compatible with streaming, and sufficient for the threat model of an average user. Tor is for high-stakes situations where trusting a VPN provider is not acceptable — where you need a system that doesn't require any single party to behave honestly.