VPN or Tor: what each one actually changes

Step by step

1. Understand what a VPN changes

   A VPN puts an encrypted tunnel between your device and a server run by the VPN provider. Your local network and your ISP see only that you connect to the VPN; websites see the VPN server's IP address instead of yours.

   The trade: your traffic is now visible to the VPN provider, as EFF's Surveillance Self-Defense puts it. You have not removed a party who can watch you; you have swapped your ISP and the local network for the provider. That is only an improvement if you trust the provider more.

2. Know what a VPN does not do

   • It is not anonymity. EFF says plainly that a VPN is not a tool for anonymity: the provider knows your real IP and what you connect to.
   • It does not stop tracking. Cookies, pixels, browser fingerprinting, app analytics and GPS location still work over a VPN. If you log in, the site knows it is you.
   • Logging policies are claims. A provider may keep logs unless its policy rules it out, and courts or agencies in its jurisdiction can request what it holds. An audit helps, but it is a snapshot.
   • It moves risk, it does not remove it. A malicious or breached provider sees as much as your ISP did.

3. Understand how Tor works

   Tor sends your traffic along a random path through volunteer-run relays, three by default. Each relay knows only the one before and the one after it, and the encryption keys are set up separately for each hop. The first relay knows your IP but not your destination; the last (exit) relay knows the destination but not who you are.

   Onion services (addresses ending in .onion) are reachable only through Tor. The service's location and IP stay hidden, the connection is end-to-end encrypted, and the address is generated automatically and verifies that you reached the right destination.

   The simplest correct way to use Tor for browsing is Tor Browser, downloaded from the Tor Project's own site.

4. Know Tor's limits

   • The exit relay sees unencrypted traffic. Tor encrypts inside the network, not from the exit to the website. Use HTTPS-only sites (on desktop, Tor Browser has turned on HTTPS-Only Mode by default since version 11.5) or onion services.
   • Timing correlation. The Tor Project says it does not protect against an observer who can see both you and the destination or your exit relay.
   • It can be slower, because traffic is routed through volunteer relays around the world.
   • Sites challenge it. Many people share the same exit relays, so some sites show CAPTCHAs or warnings about unusual activity.
   • Your behaviour links your identity. Logging in to your usual accounts, reusing a username, or running other apps over the same circuit ties Tor activity back to you. The Tor Project warns that circuit reuse can associate anonymous and non-anonymous traffic at an exit.

5. Threat: untrusted public Wi-Fi

   On café, hotel or airport Wi-Fi, the risk is the local network operator and other users on it. HTTPS already protects page contents; what leaks is which sites you visit (DNS and connection metadata).

   Choose: a VPN you trust, or Tor Browser for the session, or your phone's mobile data. A VPN is usually the most convenient here, because it covers every app, not just the browser.

6. Threat: a hostile ISP or state

   If your ISP sells browsing data, or the state monitors or censors the network, a VPN hides your destinations from them but puts one company in the same position, and that company may be reachable by the same state.

   Choose: Tor Browser when you need no single party to see both you and your destination. If Tor itself is blocked, the Tor Project offers bridges and other anti-censorship options. At High threat level, use an amnesic system such as Tails, which routes everything through Tor and leaves no trace on the computer.

7. Threat: hiding from the website itself

   If the adversary is the site (an advertiser, a forum operator, a company you are researching), your IP is only one clue. Cookies, fingerprinting and anything you log in with matter more.

   Choose: Tor Browser, which is designed to make its users' browser fingerprints as similar as possible, and never log in to an account tied to your real identity in the same session. A VPN plus a hardened browser hides your IP but leaves the rest; it is enough for casual tracking, not for a determined site.

8. If you choose a VPN, judge the provider, not the advert

   This guide does not rank providers. Check, from the provider's own documents: who owns it and in which country, what its privacy policy says it logs, whether an independent audit was published, how you can pay, and whether it shows you its kill-switch and DNS settings. EFF's VPN module lists the same questions. Avoid free VPNs whose business model you cannot explain.

Your ticks are saved in this browser only (see or delete local data). Clear ticks