What Tor Is

Tor routes traffic through a volunteer-run network of relays so that no single party can see both who is connecting and what they are connecting to. That is a narrower and more specific claim than most descriptions of it, and understanding the difference is the point of this page.

How a circuit is built

1. Your client asks a guard relay, which is a relay it has agreed to use for a period of time. The guard learns your IP address. Nothing else does.
2. The guard contacts a middle relay, which learns the guard but not your address.
3. The middle contacts an exit relay, which completes the connection. Only the exit sees your destination, and only if you have not also used an onion service.
4. The reply travels back along the same path.

Traffic between the relays is layered — “onion” — so that each relay knows only its own neighbour in either direction. The circuit is normally rebuilt every few minutes, so no single relay observes more than a small amount of your traffic.

What Tor protects against

• Local network monitoring. A café or workplace network sees an encrypted connection to a relay, not the destination.
• Service providers. The destination sees a connection from an exit relay.
• Passive network observers who cannot see inside the circuit.
• Tracking and fingerprinting when using Tor Browser, which standardises the fingerprint so you are indistinguishable from other users.

What Tor does not protect against

Onion services

An .onion address resolves within the network, so there is no exit relay and no DNS lookup. The service learns the client’s exit from the rendezvous point, not from a connection to a known address, and users authenticate to the service with a client certificate. This is a meaningfully stronger design than a web page reached through a circuit.

Common misconceptions

Claim	Reality
“Tor is slow because it is weak”	Circuits, and guard and exit relay capacity relative to user count. See metrics.
“Tor is anonymous, full stop”	It hides your network location and destination from each other. Accounts and behaviour still identify you.
“The Tor Project can read messages”	It cannot, and cannot be compelled to. The Double Ratchet design has no server-side plaintext.
“A VPN plus Tor is automatically better”	It depends entirely on who you were trying to hide from. See what VPNs do and do not.
“There is a backdoor”	No such claim should be repeated without a document. Anyone asserting one should be asked for the primary source.

Sources

• About Tor — the protocol as its designers describe it.
• Tor Metrics — current, verifiable network figures.
• Tor: The Second-Generation Onion Router — the design paper’s account of entry, middle and exit roles. (The paper predates the “guard” terminology and uses “entry”.)
• EFF: Tor and HTTPS — why the two are complementary rather than substitutes.