Is Tor Safe? A Comprehensive Review

What "Safe" Actually Means When You Use Tor

When people ask whether Tor is safe, they are usually conflating three distinct concepts: anonymity, security, and privacy. Tor primarily delivers anonymity by hiding your IP address and location from the websites you visit and from anyone monitoring your traffic[1][2]. It also provides privacy by preventing your ISP from seeing which sites you browse, though your ISP will still know you are using Tor[3]. What Tor does not inherently provide is security against malicious content, phishing, or mistakes you make while using it.

What Tor Protects

Tor routes your traffic through three random relays—an entry node, a middle node, and an exit node—so that no single relay knows both where you are and where you are going[1][2]. This design means:

• Your real IP address stays hidden from the destination website.

• Your ISP cannot see which specific sites you visit, only that you are connected to the Tor network[3].

• Websites and trackers cannot easily link your browsing habits to your physical location.

For example, if you use Tor Browser to read a news site, that site sees the IP address of the exit node, not yours. Your ISP sees encrypted Tor traffic but cannot tell which article you are reading.

What Tor Does Not Protect

Tor cannot stop you from revealing your identity through your own actions. If you log into your personal Google account over Tor, Google now knows it is you, regardless of the exit node's IP address. Tor also does not protect against:

• Malware and phishing: If you download a malicious file or enter credentials on a fake login page, Tor cannot prevent the compromise.

• Account-level tracking: Logging into any service that knows your real identity links that session to you.

• Human error: Reusing passwords, enabling JavaScript on untrusted sites, or sharing personal details in forums all bypass Tor's protections.

Law enforcement has demonstrated that technical exploits can identify Tor users. In the 2015 Playpen investigation, the FBI deployed malware that retrieved IP addresses and other identifying information from users' computers, regardless of Tor[4]. Tor's anonymity depends on both the network's design and your behaviour; neither alone is sufficient.

How Tor Protects Your Traffic — and Where It Stops

Tor routes your connection through three relays in sequence: an entry node (also called a guard node), a middle node, and an exit node[1]. Each relay knows only its immediate predecessor and successor in the circuit, so no single relay can see both your IP address and your final destination[2]. The Tor Project hard-codes this three-hop path; making it longer does not improve security[6].

Here is what each relay sees:

• Entry node: Your real IP address and the middle node's address. It cannot see where you are going.

• Middle node: The entry node's address and the exit node's address. It sees neither your IP nor your destination.

• Exit node: The middle node's address and the website or service you are visiting. It cannot see your IP address.

This design means your ISP can tell you are using Tor—it sees the encrypted connection to the entry node—but it cannot tell which sites you visit[3]. The destination website sees the exit node's IP address, not yours.

Layered Encryption and Its Limits

Tor wraps your traffic in three layers of encryption, one for each relay. As your data passes through each relay, one layer is removed, like peeling an onion. By the time your traffic leaves the exit node, the Tor-specific encryption is gone. If the website uses HTTPS, your traffic remains encrypted between the exit node and the destination. If the site uses plain HTTP, the exit node—and anyone monitoring it—can read your traffic in clear text.

Tor Browser enables HTTPS-Only mode by default, which forces an encrypted connection whenever possible. It also includes NoScript, which blocks JavaScript by default in the 'Safer' and 'Safest' security levels[7]. JavaScript can expose your real IP address or fingerprint your browser, so disabling it on untrusted sites reduces risk.

A Mental Model

Think of it this way:

• Your ISP knows you are using Tor but not what you are doing.

• The exit node knows what you are doing but not who you are.

• Websites see the exit node's IP, not yours.

This separation works only if you do not log into personal accounts or share identifying details. A malicious exit node can inspect unencrypted traffic, and correlation attacks—comparing entry and exit traffic patterns—can sometimes link a user to a destination if an adversary controls both points. Tor's design makes this difficult, but over two million users worldwide provide the crowd in which you blend[3].

For more on how Tor enables access to hidden services, see our guide to Dark Web Onion: Understanding Its Role.

The Real Risks of Using Tor

Tor's design protects against many threats, but it cannot eliminate all risks. The main documented dangers come from malicious exit nodes, correlation attacks by well-resourced adversaries, malware delivered through downloads, and deanonymization through your own behaviour. Understanding these risks helps you decide when Tor is appropriate and what additional precautions you need.

Malicious Exit Nodes Sniffing Unencrypted Traffic

The exit node is the final relay in your Tor circuit, and it sends your traffic to its destination[1]. If you visit a site over plain HTTP, the exit node can read everything: login credentials, messages, and any data you submit. Anyone operating or monitoring that exit node sees your traffic in clear text.

Documented research has shown that adversaries run exit nodes specifically to harvest data. In multiple studies, researchers found exit nodes capturing passwords, intercepting emails, and injecting malicious code into HTTP responses. Tor Browser's HTTPS-Only mode mitigates this by forcing encrypted connections whenever possible, but not all sites support HTTPS. If you must use an HTTP site, assume the exit node operator can see your activity.

Correlation Attacks by Powerful Adversaries

Tor prevents any single relay from knowing both your IP address and your destination[2]. However, an adversary who can monitor both your internet connection and the destination server—or who controls both the entry and exit nodes—can compare traffic patterns to link you to your activity. This is called a correlation attack, and it requires significant resources: access to ISP-level infrastructure, control over multiple Tor relays, or cooperation from network providers.

In 2014, Carnegie Mellon University researchers, funded by the US Department of Defense, demonstrated a technique that could 'de-anonymise hundreds of thousands Tor clients and thousands of hidden services'[8]. The FBI later used a court order to obtain data from that project. Correlation attacks are not trivial, but they are within reach of nation-state actors and large law enforcement agencies.

Malware and Browser Exploits

Tor cannot protect you from malicious files you download or vulnerabilities in the browser itself. In the 2015 Playpen investigation, the FBI deployed malware—officially termed a Network Investigative Technique (NIT)—that exploited a Firefox vulnerability in Tor Browser[4]. The malware retrieved users' real IP addresses, hostnames, active usernames, and MAC addresses, regardless of Tor's routing.

Tor Browser's 'Safest' security level disables JavaScript by default, which blocks many common exploit vectors[7]. However, disabling JavaScript breaks functionality on many sites, and users often lower the security level for convenience. Every time you enable JavaScript on an untrusted site, you accept the risk of malicious code running in your browser.

Deanonymization Through User Behaviour

Most Tor users are identified not by breaking the network, but by their own actions. Common mistakes include:

• Logging into personal accounts: If you sign into Facebook, Google, or any service tied to your real identity, that session is linked to you, regardless of your IP address.

• Enabling plugins: Flash, Java, and other plugins can bypass Tor and reveal your real IP. Tor Browser disables these by default; do not re-enable them.

• Maximizing the browser window: Tor Browser starts with a non-maximized window to reduce fingerprinting. Resizing it to full-screen makes your screen resolution visible, which can help identify you.

• Reusing usernames or email addresses: Using the same handle on both Tor and clearnet sites creates a link between your anonymous and real identities.

• Downloading and opening files outside Tor Browser: A PDF or Word document can contain tracking code that contacts a server with your real IP when opened in a standard application.

If you need to access personal accounts, do so in a separate browser session outside Tor. Treat your Tor session as a completely separate identity: different accounts, different usernames, and no overlap with your real-world activity.

Is Tor Legal? What the Law Actually Says

Using Tor is legal in most countries, including the United States, the United Kingdom, and across the European Union[3][5]. The Tor Project is a registered nonprofit organization headquartered in the United States, and there is no federal statute that prohibits anonymizing software[5]. US government agencies themselves rely on Tor—the CIA hosts a website within the Tor network for secure communications[3]. The US State Department and USAID have funded Tor development as a tool for circumventing censorship and protecting journalists and activists[5].

What remains illegal is using Tor to commit crimes. Downloading copyrighted material, purchasing illegal goods, hacking, or distributing prohibited content are all criminal acts, regardless of whether you use Tor, a VPN, or a standard browser. Tor provides anonymity, not immunity. If law enforcement identifies you through correlation attacks, malware, or your own mistakes, you face the same legal consequences as if you had used no anonymity tool at all.

Countries with Documented Restrictions

Several countries actively restrict or ban Tor. These include:

• China: The Great Firewall blocks direct connections to the Tor network. Users need bridges—unlisted entry nodes—to connect.

• Russia: Legislation requires ISPs to block Tor and VPNs that do not comply with government data retention rules.

• Iran: Tor is blocked at the network level, though bridges sometimes work.

• Belarus: The government has ordered ISPs to block Tor traffic.

These restrictions reflect documented legal status as of the most recent reporting, not a prediction of future enforcement. If you live in or travel to a country with internet censorship, check whether Tor is accessible and whether using it carries legal risk. The Tor Project maintains a list of censorship-circumvention techniques, but local laws vary.

What This Means for You

If you are in the UK, the US, or another jurisdiction where Tor is legal, using Tor Browser to protect your privacy is lawful. Your ISP will know you are using Tor[3], but that fact alone does not imply wrongdoing. Over two million people worldwide use Tor for legitimate purposes: secure communication, research, journalism, and avoiding tracking[3].

The Electronic Frontier Foundation's Tor legal FAQ notes that legal issues surrounding Tor vary by jurisdiction and factual situation, and its guidance is specific to the United States and does not constitute legal advice[9]. If you have concerns about your specific situation, consult a solicitor familiar with digital privacy law in your country.

The Communications Decency Act shields The Tor Project, Inc. from liability for dark web transactions conducted by users[10]. This protection does not extend to you: if you use Tor to break the law, you remain responsible for your actions.

Can You Be Tracked on Tor? What the FBI and Others Can Do

Tor is not 100% untraceable. Law enforcement agencies, including the FBI, have successfully identified Tor users in documented investigations. These operations typically exploit browser vulnerabilities, correlate traffic patterns, seize or operate malicious nodes, or investigate mistakes users make outside the Tor network. Understanding these methods shows where Tor's protection ends and where your own operational security must begin.

Documented Methods of Deanonymization

The FBI and other agencies use several techniques to identify Tor users:

• Exploiting browser vulnerabilities: In the 2015 Playpen investigation, the FBI deployed malware that exploited a Firefox vulnerability in Tor Browser. The malware retrieved users' real IP addresses, hostnames, active usernames, and MAC addresses[4]. This technique bypassed Tor's routing entirely by attacking the software running on users' computers.

• Traffic correlation: An adversary who monitors both your internet connection and the destination server can compare traffic timing and volume to link you to your activity. In 2014, Carnegie Mellon University researchers demonstrated a technique that could 'de-anonymise hundreds of thousands Tor clients and thousands of hidden services'[8]. The FBI later obtained this data through a court order.

• Seizing or operating malicious nodes: Law enforcement can run exit nodes to monitor unencrypted traffic or compromise entry nodes to identify users. While Tor's design prevents any single relay from knowing both your identity and your destination[2], controlling multiple points in the network makes correlation attacks feasible.

• Investigating operational security failures: Most Tor users are identified not by breaking the network, but by their own actions. The 2013 Silk Road takedown resulted from the site operator reusing a username across Tor and clearnet forums, posting a question on Stack Overflow with his real email address, and making other identifying mistakes. The FBI did not break Tor's cryptography; it followed digital breadcrumbs left by the operator.

High-Profile Cases and What They Reveal

The 2014 Operation Onymous resulted in the seizure of over 400 hidden services, including Silk Road 2.0 and other dark web marketplaces. Law enforcement agencies did not disclose the exact methods used, but subsequent analysis suggested a combination of server seizures, traffic correlation, and exploiting vulnerabilities in site configurations. No evidence emerged that Tor's core encryption was broken.

These cases share a common pattern: success relied on vulnerabilities outside Tor's design. Browser exploits, server misconfigurations, and user mistakes provided the entry points. Tor's three-relay circuit[1][6] and layered encryption remain robust against direct cryptographic attack. The documented risks come from the endpoints—your computer, the destination server, and the human behaviour connecting them.

For more on how hidden services operate within Tor, see our guide to Dark Web Onion Links: What You Need to Know.

What This Means for You

You can be tracked on Tor if you enable JavaScript on untrusted sites, log into personal accounts, or make operational security mistakes. You can also be tracked if a well-resourced adversary monitors both your internet connection and your destination, or if law enforcement deploys malware targeting a known vulnerability. Tor makes tracking difficult and expensive, but it does not make it impossible.

If you face a nation-state adversary or are under active investigation, Tor alone is not sufficient. You need additional operational security: no overlap between your Tor and real-world identities, no reused usernames, no personal accounts, and no files opened outside Tor Browser. For most users—those avoiding tracking by websites, advertisers, or casual surveillance—Tor provides strong protection. For those facing targeted law enforcement attention, Tor is one layer in a broader security strategy, not a guarantee of anonymity.

Tor Browser Best Practices That Actually Reduce Risk

Most deanonymization happens not because Tor's network fails, but because you make a preventable mistake. The following checklist synthesizes the highest-impact practices from official Tor Project guidance and documented investigations. Each item addresses a specific risk vector that has led to real-world identification.

Use Only Tor Browser for Tor Activity

Standard browsers—Chrome, Firefox, Safari—are not configured to route traffic through Tor and will leak your real IP address. Tor Browser is purpose-built to prevent leaks and includes privacy protections that general-purpose browsers lack. Do not configure other applications to use Tor unless you fully understand the risks; many applications send identifying information outside the Tor circuit.

Do Not Install Browser Plugins or Extensions

Flash, Java, and most browser extensions can bypass Tor and contact servers with your real IP address. Tor Browser disables plugins by default. Do not re-enable them. Even seemingly harmless extensions—password managers, ad blockers—can fingerprint your browser or leak data. If a site demands Flash or another plugin, assume it is unsafe to visit through Tor.

Do Not Torrent Over Tor

BitTorrent clients ignore proxy settings and connect directly to peers, exposing your real IP address. Torrenting also consumes massive bandwidth, degrading the network for everyone. Tor's design—routing traffic through three relays[1][6]—is optimized for low-latency browsing, not large file transfers. If you need to download large files anonymously, use a different method.

Use HTTPS Versions of Sites

Tor encrypts your traffic between your computer and the exit node, but the exit node sees unencrypted HTTP traffic. A malicious exit node can read passwords, messages, and any data you send over HTTP. Always use HTTPS—look for the padlock icon in the address bar. Tor Browser includes HTTPS-Only Mode, which forces encrypted connections whenever possible[7]. Enable it.

Do Not Open Documents Downloaded Through Tor While Online

PDFs, Word documents, and other files can contain embedded tracking code that contacts a server with your real IP address when opened. If you download a file through Tor, disconnect from the internet before opening it, or open it inside a virtual machine isolated from your network. This practice prevents the file from bypassing Tor and revealing your location.

Control What Information You Provide Through Web Forms

Every piece of information you enter—email addresses, usernames, payment details—can link your Tor session to your real identity. Do not log into personal accounts. Do not reuse usernames from clearnet sites. If a site requires registration, create a new email address and username that have no connection to your real-world identity. Treat every form field as a potential deanonymization vector.

Adjust Security Level Based on Threat

Tor Browser's 'Safest' security level disables JavaScript by default, which blocks many exploit vectors but breaks functionality on many sites[7]. The 'Standard' level enables JavaScript, accepting greater risk for convenience. If you are visiting untrusted sites or face a serious threat, use 'Safest'. If you are browsing news sites or forums with no personal login, 'Standard' may be acceptable. The choice depends on your threat model, not a universal rule.

Do Not Maximize the Browser Window

Tor Browser starts with a non-maximized window to reduce fingerprinting. Your screen resolution is one data point sites use to identify you. Resizing the window to full-screen makes your resolution visible. Leave the window at its default size.

These practices do not eliminate risk, but they close the gaps that have led to documented deanonymization. Tor's three-relay circuit[1][6] protects your traffic from network-level surveillance; these steps protect you from endpoint attacks and your own operational security failures. If you follow this checklist, you reduce the surface area for tracking to the point where only well-resourced adversaries with specific targeting can realistically identify you.

Tor Without a VPN: Is It Safe Enough?

Tor alone provides strong anonymity for most users. Your internet service provider can see that you're using Tor—the network's entry nodes are public—but cannot see what you're doing inside the network[3]. A VPN adds a layer of obfuscation by hiding Tor usage from your ISP, but it introduces a new point of trust: the VPN provider can see your real IP address and knows you're connecting to Tor. If the VPN keeps logs or is compromised, you've traded one observer for another.

Tor Over VPN vs. VPN Over Tor

These are different setups with different threat models:

• Tor over VPN: You connect to a VPN, then launch Tor Browser. Your ISP sees only VPN traffic, not Tor. The VPN provider sees your real IP and knows you're using Tor, but cannot see your Tor traffic. The Tor entry node sees the VPN's IP, not yours. This setup hides Tor usage from your ISP and can bypass ISP throttling or network blocks.

• VPN over Tor: You connect to Tor first, then route your traffic through a VPN. The Tor exit node sees VPN traffic, and the VPN provider sees the exit node's IP, not yours. This setup is difficult to configure correctly and offers little practical benefit for most users. It does not hide Tor usage from your ISP[3].

Neither setup makes Tor 'more anonymous'. Tor's three-relay circuit[1][6] already ensures that no single relay knows both your identity and your destination[2]. Adding a VPN changes who can observe which part of the connection, but does not strengthen the core anonymity Tor provides.

When a VPN Might Be Considered

A VPN before Tor makes sense in specific situations:

• Your ISP throttles or blocks Tor traffic, and you need reliable access.

• You live in a jurisdiction where using Tor attracts suspicion, and you want to hide that fact from your ISP[3].

• You're on a network—such as a university or workplace—that monitors or restricts Tor connections.

In these cases, choose a VPN provider with a documented no-logs policy, payment options that do not require personal information, and servers in a jurisdiction with strong privacy protections. Understand that you are trusting the VPN provider not to log your connection or cooperate with authorities. A misconfigured VPN can leak your real IP address, negating any benefit.

Recommendation for Most Users

Tor Browser alone is safe enough for the vast majority of use cases. Over 2 million people use Tor worldwide, and this crowd makes it difficult to single out any individual[3]. Your ISP will know you're using Tor[3], but in the United States and the United Kingdom, there is nothing illegal about that[3][5]. If your threat model includes hiding Tor usage from your ISP, add a VPN. If your threat model is avoiding tracking by websites, advertisers, or casual surveillance, Tor Browser by itself provides robust protection without introducing a new trusted party.

For more on accessing hidden services within Tor, see our guide to Dark Web Onion: Understanding Its Role.

Common Mistakes That Break Tor Anonymity

Tor's network design is robust, but most deanonymization happens because of user error, not because the three-relay circuit[1][6] fails. The following mistakes have led to real-world identification in documented cases. Each one creates a vector for tracking that bypasses Tor's protections entirely.

Logging Into Personal Accounts

When you log into Facebook, Gmail, or any account tied to your real identity, you link that Tor session to yourself. The site knows who you are—you just told it. Tor hides your IP address, but it cannot hide the fact that you authenticated as a specific person. If you need to access a personal account, do it outside Tor. If you must use Tor for sensitive communication, create a new account with no connection to your real name, email, or payment method.

Resizing the Browser Window

Tor Browser starts with a non-maximized window to prevent sites from reading your screen resolution, which is one fingerprinting data point. Maximizing the window exposes your full resolution. Leave the window at its default size. This is a small detail, but fingerprinting works by combining many small details into a unique profile.

Enabling JavaScript Globally

Tor Browser's 'Standard' security level enables JavaScript by default[7]. Many exploits—including the FBI's 2015 Playpen malware[4]—relied on JavaScript to retrieve real IP addresses and system information. The 'Safest' security level disables JavaScript on all sites[7], which breaks functionality on many pages but closes this attack vector. If you're visiting untrusted sites or downloading files, use 'Safest'. If you enable JavaScript, understand that you're accepting greater risk for convenience.

Installing Browser Extensions

Extensions can bypass Tor and contact servers with your real IP address. They can also fingerprint your browser, making you more identifiable within the Tor network. Tor Browser disables extensions by default. Do not add password managers, ad blockers, or any other plugin. If a site demands Flash or Java, assume it is unsafe to visit through Tor.

Using Tor for Torrenting

BitTorrent clients ignore proxy settings and connect directly to peers, leaking your real IP address. Torrenting also consumes bandwidth that degrades the network for everyone. Tor's design—three relays routing low-latency traffic[1][6]—is not built for large file transfers. If you torrent over Tor, you will be identified. Use a different method for large downloads.

Opening Downloaded Files While Online

PDFs, Word documents, and images can contain embedded tracking code that contacts a server when opened. If you download a file through Tor and open it while connected to the internet, the file can bypass Tor and reveal your real IP address. Disconnect from the internet before opening any file downloaded through Tor, or open it inside a virtual machine isolated from your network.

Using the Same Identity Across Tor and Clearnet

Reusing a username, email address, or writing style across Tor and regular internet activity links your sessions. If you post on a forum with the same handle you use on Twitter, anyone can connect the two. Create separate identities for Tor use, with no overlap in usernames, email addresses, or personal details. Treat operational security as seriously as the technical protections Tor provides.

Each of these mistakes has led to documented deanonymization. Tor's three-relay circuit[1][6] protects your traffic from network-level surveillance, but it cannot protect you from your own choices. If you avoid these errors, you close the gaps that have allowed law enforcement and other adversaries to identify Tor users in the past.

What Tor Is Not: Limits You Should Accept

Tor Browser is a tool for anonymity, not a complete security solution. It hides your IP address and routes your traffic through three relays[1], but it does not protect you from every threat on the internet. Setting realistic expectations prevents dangerous misunderstandings about what Tor can and cannot do.

Tor Does Not Protect Against Malware or Phishing

If you download a malicious file or enter your password on a fake login page, Tor cannot stop that. The network anonymizes your connection, but it does not scan files for viruses or verify that a website is legitimate. You still need antivirus software, common sense about downloads, and careful attention to URLs. Tor Browser includes HTTPS-Only Mode[7], which helps prevent some man-in-the-middle attacks, but it does not block phishing sites or prevent you from running malware you've downloaded.

Tor Does Not Make You Invisible to Websites You Log Into

When you authenticate to a service—Facebook, Gmail, a forum—you identify yourself to that service. Tor hides your IP address from the site, but the site knows who you are because you told it. If you log into a personal account through Tor, you link that session to your real identity. Tor's three-relay circuit[1][6] protects your network traffic, not the information you voluntarily provide.

Tor Does Not Defend Against Keyloggers or Social Engineering

If your computer is compromised by a keylogger, it records everything you type before Tor encrypts it. If someone tricks you into revealing your identity—through a phone call, an email, or a fake website—Tor cannot prevent that. The network protects your traffic in transit[2], but it does not secure your device or your judgment.

Tor May Be Slower Than Your Regular Connection

Routing traffic through three relays[1][6] adds latency. Websites load more slowly. Video streaming is impractical. This is a design trade-off: anonymity costs speed. If you need fast downloads or real-time applications, Tor is not the right tool.

Tor May Be Blocked by Some Services

Banks, streaming platforms, and some websites block traffic from known Tor exit nodes. They see Tor as a risk for fraud or abuse. You may encounter CAPTCHAs more frequently, or you may be denied access entirely. This is not a flaw in Tor; it is a choice those services make.

Tor Is Not Illegal, But It Does Not Make Illegal Activity Legal

Using Tor is legal in the United States and the United Kingdom[3][5]. Your internet service provider can see that you're using Tor, even if it cannot see what you're doing[3]. However, Tor does not grant immunity for illegal actions. If you commit a crime through Tor, you can still be prosecuted. Law enforcement has deployed malware[4] and obtained research data[8] to identify Tor users in specific investigations. Tor anonymizes your connection; it does not make you untouchable.

The Tor Project's Documentation Is the Authoritative Source

The Tor Project publishes detailed documentation on the network's design, limitations, and current threats. If you want to understand what Tor can and cannot do, read the official specifications and FAQs. Do not rely on forum posts, marketing claims, or outdated guides. The network evolves, and the Tor Project's own materials reflect the current state.

Tor is a powerful tool for anonymity, but it is one tool among many. Pair it with good operational security, realistic expectations, and an understanding of your threat model. It will not solve every problem, and it will not protect you from every mistake.

Common Misconceptions About Tor

People often assume Tor fails because they misunderstand what it protects. The network's design is sound: your traffic passes through three relays, and no single relay knows both your identity and your destination[1][2]. What breaks anonymity is usually a wrong assumption about what Tor covers. These are the most frequent misconceptions and the practical corrections.

'Tor Makes Me Completely Anonymous'

The most dangerous belief is that Tor guarantees total anonymity. It does not. Tor anonymizes your network traffic by hiding your IP address and encrypting your connection through three relays[1], but it cannot protect you from your own behavior. If you log into a personal account, download a malicious file, or reuse a username from your regular life, you link your Tor session to your real identity. The 2015 Playpen investigation showed how the FBI deployed malware through the site itself to retrieve IP addresses and MAC addresses from visitors, regardless of Tor[4]. You should treat Tor as one layer of protection, not a shield against every mistake.

'My ISP Cannot See That I Use Tor'

Many people believe Tor hides their activity from their internet service provider entirely. That is half true. Your ISP cannot see what you are doing inside Tor or which sites you visit, but it can see that you are connecting to the Tor network[3]. The fact of Tor usage itself is visible. In some countries, that visibility alone may draw scrutiny, even though using Tor is legal in the United States and the United Kingdom[3][5]. If you need to hide the fact that you use Tor from your ISP or network administrator, you need a different configuration—such as a VPN before Tor—which introduces its own trust considerations.

'JavaScript Is Safe Because Tor Encrypts My Traffic'

Tor encrypts your traffic in transit, but JavaScript runs in your browser after the traffic arrives. That is a critical distinction. The FBI's Playpen malware relied on JavaScript to extract identifying information from computers that visited the site[4]. Tor Browser's 'Standard' security level enables JavaScript by default, while the 'Safest' level disables it on all sites[7]. If you visit untrusted sites or download files, switch to 'Safest' and accept that some pages will break. JavaScript is not inherently malicious, but it expands the attack surface significantly.

'A VPN Plus Tor Always Improves Security'

The relationship between Tor and VPNs is often oversimplified. There are two distinct configurations, and they serve different purposes. A VPN before Tor hides the fact that you use Tor from your ISP, because your ISP sees only the VPN connection. A VPN after Tor routes your traffic from the exit relay to a VPN server, which can help access services that block Tor exit nodes but requires you to trust the VPN provider with your destination traffic. Neither configuration is 'always better'. Choose based on your specific threat model: if you need to conceal Tor usage from your ISP, use VPN before Tor; if you need to reach services that block Tor, consider VPN after Tor—but understand that the VPN provider becomes a new trusted party.

'Tor Is Only for Criminals'

This misconception persists despite documented evidence to the contrary. The Tor network has over 2 million users worldwide, and that crowd makes it difficult to identify any single individual[3]. Government actors themselves depend on Tor—the CIA hosts a website within the network[3]. The US State Department and USAID have funded Tor development as a tool for circumventing censorship and protecting communications[5]. The Tor Project is a registered nonprofit organization headquartered in the United States[5]. Journalists, activists, researchers, and ordinary privacy-conscious individuals use Tor for legitimate reasons. Using Tor is not illegal in the United States or the United Kingdom[3][5], though illegal activity conducted through Tor remains illegal.

'If I Use Tor, Law Enforcement Cannot Find Me'

Tor makes network-level tracking much harder, but it does not make you untouchable. Law enforcement has multiple documented methods for identifying Tor users in specific investigations. The FBI used a court order to obtain data from a 2014 Carnegie Mellon University project that researchers said could 'de-anonymise hundreds of thousands Tor clients and thousands of hidden services'[8]. In the Playpen case, the FBI deployed malware that retrieved IP addresses, host names, usernames, and MAC addresses from computers that logged into the site[4]. These methods targeted specific sites and specific users, not the entire network. Your risk depends on your threat model: if you are a target of a focused investigation, Tor alone is not sufficient protection.

Each of these misconceptions leads to a false sense of security or an unnecessary fear of the tool itself. Tor's three-relay circuit[1][6] protects your traffic from network-level surveillance, but it does not protect you from your own operational mistakes. Understand what Tor does and does not cover, then configure your behavior accordingly.

Conclusions

• Tor protects your traffic in transit, not your behavior. Logging into personal accounts, reusing usernames, or opening downloaded files while online can link your session to your real identity.

• Your ISP can see that you use Tor, even though it cannot see what you do inside the network[3]. If that visibility matters, configure a VPN before Tor and accept the new trust relationship.

• JavaScript expands your attack surface. Set Tor Browser to the ‘Safest’ security level on untrusted sites, and expect some pages to break[7].

• Law enforcement has documented methods for identifying specific Tor users in focused investigations, including malware deployed through a site itself[4]. Tor is not a shield against a targeted operation.

• Using Tor is legal in the United States and the United Kingdom, but illegal activity conducted through Tor remains illegal[3][5].

Start with one concrete step: open Tor Browser, set the security level to ‘Safest’, and visit only .onion sites you have verified from a trusted source. When you are ready to understand what you might encounter, read What Can You Find on the Dark Web?.