My IP Help

Tor

Also known as: The Onion Router, Tor Browser

An anonymity network that routes traffic through three volunteer-operated relays with layered encryption so that no single node knows both the source and the destination.

Last updated:

What is Tor?

Tor (originally an acronym for The Onion Router) is a free, open-source anonymity network. A Tor client builds a circuit of three relays — entry (guard), middle, and exit — and sends traffic through all three with layered encryption, so that:

  • The entry relay sees the user's IP but not the destination
  • The middle relay sees neither the user nor the destination
  • The exit relay sees the destination but not the user's IP

This separation of knowledge is what makes Tor resistant to single-point surveillance. It is maintained by the Tor Project and funded largely by grants and donations.

Tor vs. VPN vs. proxy

All three change the apparent source IP, but the trust model differs:

  • A proxy is one hop. You trust the proxy operator fully.
  • A VPN is also one hop (the VPN server) — faster than Tor, but you trust the VPN operator.
  • Tor is three hops operated by independent volunteers, with layered encryption. Much stronger anonymity, much higher latency.

Tor IPs in the wild

Tor exits are publicly listed — the Tor Project itself publishes the current exit-node consensus at https://check.torproject.org/exit-addresses, updated every few minutes. Every major website can look up whether a visiting IP is a Tor exit and make an access decision.

Tor is used for legitimate privacy reasons (journalists, activists, whistleblowers, researchers, users under censorship) and also for scraping, spam, and attacks. Most sites neither block nor privilege Tor users by default — some require an extra CAPTCHA, some block entirely, and some treat it identically to any other IP. Our IP lookup flags Tor exits on every result so operators can decide how to handle them.

Frequently Asked Questions

No. Tor itself is legal in nearly every country, including the US, UK, EU, Canada, and Australia. It is openly used by journalists, researchers, activists, and ordinary privacy-minded users. A handful of countries (China, Russia, Iran, Turkmenistan) actively block or restrict Tor by deep-packet-inspecting connections to known relays, but possession or use is rarely criminalized on its own. Crimes committed over Tor are still crimes — the network is a tool, not a legal shield.
Typically 2-10x slower in bandwidth and 100-500 ms higher in latency than a direct connection. The reason is structural: every request passes through three volunteer relays in three different countries, each adding a hop and decryption step. Speed varies dramatically depending on which circuit Tor builds — pressing "New Tor circuit for this site" in Tor Browser sometimes finds a faster path.
Yes — by default. Your ISP cannot see what you do over Tor or which sites you visit, but the connection to the entry guard is recognizable as Tor traffic because guard IPs are listed in the public consensus. In censoring countries, users instead connect to undisclosed Tor bridges with pluggable transports (obfs4, meek, snowflake) that disguise traffic as normal HTTPS, video calls, or generic noise so the ISP cannot detect Tor at all.
A VPN is one hop — you trust the VPN operator with both your real IP and your traffic destinations. Tor is three hops operated by separate volunteers with layered encryption, so no single relay knows both. VPNs are faster and better for streaming or large downloads. Tor is slower but provides far stronger anonymity, especially against an adversary that can compromise or subpoena one operator.
Because Tor exit IPs are heavily over-represented in scraping, spam, brute-force login attempts, payment fraud, and abuse. The exit list is published every few minutes by the Tor Project itself, so blocking is trivial. Many sites do not block outright — they show extra CAPTCHAs, downgrade to read-only access, or rate-limit Tor traffic separately. Cloudflare offers an "Onion Routing" option that lets Tor users bypass these checks via a `.onion` mirror.
Back to glossary