Tor is a free, global network that lets you browse the Internet and the dark web anonymously. There are, however, a few things you need to keep in mind to use Tor securely.

As online surveillance becomes more and more prevalent, tools that can help you stay private and secure online are critical. While VPNs are one such tool (learn why you should use a VPN(new window)), there are other options. Tor (which stands for “The Onion Router”) is a powerful tool for online anonymity.

However, there is no such thing as 100% security, and even Tor has some vulnerabilities. It is essential to consider its threat model and make sure that you understand what Tor can and can’t protect you against. Furthermore, if you do not adhere to certain best practices when using Tor, you could expose yourself to vulnerabilities and exploits that could compromise your privacy or your device.

This article will explain the factors to consider before using Tor and what you can do to mitigate its weaknesses.  

Is Tor illegal?

This is often the first question users ask because Tor and the “dark web” have become associated with illegal enterprises like the Silk Road(new window) marketplace. The answer is no. It is not illegal to be anonymous, and Tor has many legitimate uses. The dark web itself is a powerful tool(new window) to protect privacy and free speech.

Tor is an open network of servers run by volunteers and free software (the Tor Browser) that is guided by the non-profit Tor Project(new window). Both the network and the software can be used to browse the “clearweb” (the Internet most of us are familiar with) like any other browser. According to the Tor Project, neither the network nor the browser is illegal(new window) anywhere in the world, and using Tor is not a criminal act.

Tor vulnerabilities

Like any technology, Tor is not 100% secure, and attackers can still compromise Tor’s security. In 2014, a research team from Carnegie Mellon University(new window) gained control of enough servers in the Tor network to observe the relays on both ends of the Tor circuit and compare the traffic timing, volume, and other unique characteristics to identify which other Tor relays were part of which circuits. By putting the entire circuit together, the researchers were able to see the IP address of the user on the first relay and the final destination of their web traffic on the last relay, allowing them to match users to their online activity. (For those interested in a more technical explanation, the Tor Project analyzed the attack(new window).) The FBI then used this attack to round up a number of criminals on the dark web as part of their Operation Onymous(new window). Tor upgraded their relays to deal with the specific protocol used by the researchers, but correlation attacks (identifying users through the timing and volume of their traffic) are still possible.

Recently, Zerodium, an exploit vendor, discovered a new flaw in the Tor Browser that allowed attackers to run malicious JavaScript code. The Zerodium hack(new window) took advantage of a bug in the NoScript add-on to the Tor Browser. Both NoScript and the Tor Browser have been updated, and in Tor Browser v. 8.0 and later, the flaw is fixed.

These instances should not dissuade you from using Tor; rather they illustrate that even Tor is not 100% secure.

How to use Tor safely

Like with any privacy tool, proper usage is critical. Misusing Tor can compromise your online privacy in unexpected ways.

  • Tor will encrypt your data as it passes through the Tor network, but the encryption of your traffic between the final Tor relay and your destination site depends upon that website. Only visit websites that use the Hypertext Transfer Protocol Secure, or HTTPS. This protocol establishes an encrypted link between the final Tor relay and your destination website. Any site that has a URL that begins with “https://” uses HTTPS, and the Tor Browser comes with the HTTPS Everywhere(new window) add-on. The Electronic Frontier Foundation has a great diagram(new window) that illustrates how Tor and HTTPS work together to protect your data.
  • The Tor Browser blocks many plugins, such as Flash, RealPlayer, and QuickTime. These plugins can be manipulated into exposing your IP address in ways that Tor cannot prevent.
  • If you are using the Tor Browser, be aware that only the Tor Browser’s Internet traffic will be routed through Tor. Other apps on your device will still connect normally to the Internet and may expose your real IP address.
  • You should not maximize the Tor Browser window. If you maximize the Tor Browser, websites can determine the size of your device’s screen, which can narrow down which device you are using and help those sites track your activity. Tor recommends you always use the Tor Browser’s default screen size.
  • You should not open documents downloaded through the Tor Browser while you are online. These documents could contain Internet resources that would reveal your true IP address. If you need to view a .doc or .pdf file, you should disconnect your computer from the Internet first, or you should use the Tor OS, Tails(new window).
  • Similarly, you cannot use BitTorrent over Tor. Torrenting will send out your real IP address in the tracker GET request, deanonymizing your torrent and web traffic. It will also slow down the entire Tor network.
  • It is also important to note that Tor will not protect your privacy from a website you must sign in to. Once you sign in, you have identified yourself to that website — and anyone who might be observing the activity on that site.
  • Finally, if you are using Tor to access the dark web, you must be extremely cautious. Only use dark web URLs you know to be accurate. Do not click on any ads on any site on the dark web. Inspect every link on the dark web before you click it. Visiting unknown sites on the dark web is a quick way to infect your device. Trusted sites on the dark web, such as Proton Mail’s Tor email portal(new window), usually will have a valid SSL certificate.

Secure alternatives to Tor

Tor provides an excellent way to anonymize online activity, but certain limitations, particularly its slow browsing speeds, can be quite limiting for the average Internet user.

Proton VPN

For users who find Tor too complex or need higher performance, a trustworthy VPN(new window) like Proton VPN is a good alternative. A VPN will encrypt your online traffic and prevent attackers from monitoring your browsing activity. It is also much faster and easier to use than Tor. Once you install the VPN app, all it takes is a single click to establish an encrypted VPN connection. Switching your connection between countries is also much easier with a VPN than with Tor. The Proton VPN feature Tor over VPN(new window) also lets you access onion sites(new window) without having to download and set up the Tor Browser. However, VPNs, like Tor, also have their limitations when it comes to security and privacy, so it is important to understand the VPN threat model(new window).

While not 100% secure, for those in dire need of online anonymity, Tor is the best option, provided you follow the guidelines. For everybody else who wants to be able to stream Netflix(new window) or use BitTorrent(new window) while also hiding your IP address and location from advertisers and trackers, Proton VPN is a more practical option.

Best Regards,
The Proton VPN Team

You can get a free Proton VPN account here(new window).

Follow us on social media to stay up to date on the latest Proton VPN releases:  Twitter (new window)Facebook(new window) | Reddit(new window)

To get a free Proton Mail encrypted email account, visit: proton.me/mail(new window)


Protect your privacy and security online
Get Proton VPN free

Related articles

AirTags are small devices designed to help you locate lost items using Apple’s Find My network. They emit a secure Bluetooth signal detectable by nearby Apple devices, which then use their location services to anonymously relay the location to the ow
Why a VPN is important when working remotely
In 2023, roughly 40% of workers in the US worked remotely or on hybrid schedules (some days in the office, some days at home). This arrangement offers benefits to employees and employers, but it also introduces new cybersecurity vulnerabilities, like
Proton VPN now operates one of the largest VPN server networks in the world.
At Proton VPN, we’ve reached a new milestone in our mission to make online privacy the default for everyone. Now offering over 5500 servers on six continents, Proton VPN is one of the largest and most popular VPN services in the world. And we’re grow
What is DNS security?
In this article, we’ll look at DNS security, what it means for your businesses, and how using Proton VPN provides your business with the DNS security it needs.  The Domain Name System (DNS) translates human-friendly domain names to numeric IP addres
Paris Olympics
The 2024 Summer Olympics in Paris begins this July. While you’ve likely already missed your chance to get a ticket and witness the best athletes from around the world in person, there are plenty of ways to enjoy the games from the comfort of your hom
Where to watch euros
Every four years, the entire continent of Europe turns its eyes to see who will be crowned as the continent’s champion of football (or soccer for the Americans).  This is the 17th edition of the UEFA European Football Championship, in which 24 natio