VPN vs Tor: the two solve overlapping but different problems. A VPN routes your traffic through one server you have to trust; Tor routes it through three independent relays so no single one sees both who you are and what you’re doing — but that design has its own real, documented weaknesses that no amount of marketing about “military-grade anonymity” changes.
Neither is strictly “better” — the right choice depends on your threat model, and this guide covers the real research behind both, including two tools most VPN vs Tor comparisons skip entirely: Tails OS and Tor’s censorship-circumvention bridges.
Table of Contents
How Tor Actually Works
Tor Browser routes your traffic through three volunteer-run relays in sequence, encrypting it in layers (hence “onion routing”):
- Entry/guard node — sees your real IP address, but not your destination.
- Middle node — bridges the connection without seeing either your IP or your destination.
- Exit node — sees your destination and your traffic content (unless the site uses HTTPS), but not your real IP.
No single relay sees both ends of the connection at any point in the circuit. This is fundamentally different from a VPN, where a single provider handles the entire connection and could, in theory, see both your identity and your activity simultaneously.
The Trust Trade-Off
With a VPN
You’re trusting one company. Even with an audited no-logs policy, you’re relying on that provider not logging your activity — and on real-world evidence (like the court cases and police raids we cite in our VPN comparison) that they actually don’t.
With Tor
No single relay operator can see both your identity and your destination — but the exit node can see your unencrypted traffic if you’re not using HTTPS, and exit-node operators are volunteers, not vetted companies.
Documented Exit-Node Risks (Real Cases, Not Theory)
Tor’s exit-node risk isn’t hypothetical — it’s been directly measured:
- “Spoiled Onions” (Winter & Lindskog, Karlstad University, presented at PETS 2014) — researchers built a relay-scanning tool and found 25 malicious or misconfigured exit relays actively snooping on or tampering with traffic over a four-month period.
- An independent honeypot investigation reported by Vice/Motherboard ran a fake unencrypted login page through roughly 1,400 exit nodes over a month; 7 nodes were caught reusing the planted credentials, confirming active interception.
- Later reporting (SecurityWeek, The Hacker News, 2020–2021) documented a single actor controlling as much as an estimated 23–27% of Tor’s exit capacity at one point, reportedly to strip SSL from cryptocurrency exchange traffic.
The practical takeaway: always use HTTPS on top of Tor, since the exit node can read anything that isn’t independently encrypted, regardless of how trustworthy the Tor network itself is at every other hop.
Documented Deanonymization: Operation Onymous
In November 2014, an FBI/Europol-led operation (“Operation Onymous”) took down roughly 27 Tor hidden-service sites — including Silk Road 2.0 — with 17 arrests. The Tor Project’s own blog separately documented that, between January and July 2014, it detected relays actively attempting to deanonymize hidden-service users through traffic-tagging attacks before those relays were removed. Later reporting alleged the attack was linked to FBI-funded university researchers; the Tor Project’s own post treats that link as alleged, not confirmed, and we do the same here rather than stating it as settled fact.
Tails OS: Amnesia by Design
What Tails Actually Is
Most VPN vs Tor comparisons stop at the browser, but there’s a real, actively-maintained tool that goes further: Tails (The Amnesic Incognito Live System), a Debian-based live operating system you boot from a USB drive that routes all connections through Tor by default and leaves no trace on the host computer once you shut it down — no saved files, no browsing history, nothing written to the machine’s own disk unless you explicitly configure persistent storage.
The Snowden Connection
This isn’t a niche tool. Journalists Glenn Greenwald, Laura Poitras, and Barton Gellman — the three journalists who broke the 2013 NSA mass-surveillance story — have each publicly credited Tails as a tool they used while handling the Snowden documents. Edward Snowden himself has stated: “I’ve used TAILS for years. The journalists who broke the mass surveillance revelations all relied on it.” The real-world adoption spike backs this up: Tails downloads rose from roughly 4,670/day before the June 2013 Snowden revelations to about 11,107/day after — more than double, in direct response to a single news event. (Tails Project, official)
Bridges and Pluggable Transports: Getting Around Censorship
What Bridges Actually Do
In countries that actively block Tor, connecting to a public relay is itself detectable and blockable, since the list of public Tor relays is, well, public. Bridges solve this: unlike ordinary relays, they aren’t listed in Tor’s public consensus, so a censoring ISP or government can’t simply enumerate and block them. Per the Tor Project’s own current support documentation, users obtain bridge addresses through Tor’s own distribution channels — emailing bridges@bridges.torproject.org with “get transport obfs4” in the message body, or using the built-in bridge settings inside Tor Browser itself. (Tor Project Support)
obfs4: Disguising Tor Traffic Itself
obfs4 is, per the Tor Project, currently its most widely deployed pluggable transport — a system that transforms Tor’s traffic between your device and a bridge so a censor monitoring the connection sees innocuous-looking traffic instead of a recognizable Tor protocol pattern. This is a materially different capability than any VPN offers: a VPN can hide that you’re using a VPN from some observers, but Tor’s pluggable transport system is specifically engineered to survive active, sophisticated government-level blocking attempts, which is precisely why it exists as a distinct feature.
Onion Services: What Tor Can Do That a VPN Can’t
What They Actually Are
Beyond hiding who’s browsing, Tor supports “onion services” (formerly called hidden services) — websites that only exist reachably within the Tor network itself, at a .onion address, without ever exposing the server’s real IP address or physical location to visitors. A VPN has no equivalent capability; it can hide your traffic from an observer, but it doesn’t let you host a service whose own server location stays hidden from everyone who connects to it, including the visitors themselves.
Legitimate Real-World Use
Onion services aren’t just for the illicit marketplaces the 2014 Operation Onymous takedown targeted, despite that being the association most people default to. Major, legitimate organizations run their own official onion sites specifically so users in heavily censored or monitored regions can reach them without being blocked or identified doing so — a real, practical use case distinct from anything a VPN is built to provide.
Speed: Why Tor Is Slower
Multi-hop routing through three independently-operated relays inherently adds latency compared to a single-hop VPN connection. The Tor Project’s own Tor Metrics is the authoritative source for current network size and performance data — it publishes live relay counts, bandwidth, and estimated daily users (in the low millions, including bridge users). Check it directly for current figures rather than relying on secondhand estimates, since the network changes.
Why Tor Sticks With the Same Guard Node
One Tor design detail surprises people who assume more randomization always means more privacy: your Tor client doesn’t pick a new entry/guard node for every connection. Instead, it deliberately sticks with the same small set of guard relays (typically one at a time) for weeks or months.
This is intentional — if your circuits picked a random guard every time, a malicious relay operator would eventually get selected as your guard purely by chance, and repeated exposure to different potentially-malicious guards over time actually increases the statistical odds that a hostile relay ends up seeing your real IP address. Sticking with a small, stable set of guards instead limits how many different operators are ever in a position to see your entry point at all, trading some theoretical unpredictability for a real, measurable reduction in exposure over time.
Should You Combine a VPN and Tor?
Per the Tor Project’s own support FAQ, Tor Project does not generally recommend combining a VPN with Tor unless you specifically understand the configuration — done incorrectly, it can reduce your anonymity rather than improve it. The general distinction:
- Tor-over-VPN (connect to your VPN first, then open Tor Browser) mainly hides the fact that you’re using Tor from your ISP. It doesn’t add much additional anonymity within the Tor network itself.
- VPN-over-Tor (routing Tor’s output through a VPN) is more fragile to configure correctly and is generally discouraged for typical users.
Which Should You Use?
- Use a VPN if: you want reliable speed, access to region-restricted content, and general privacy from your ISP and websites — and you’re comfortable trusting an audited provider. See our comparison of VPN providers with real audit histories.
- Use Tor if: your threat model specifically requires that no single party can link your identity to your activity — journalism, activism, or research where a VPN’s single point of trust isn’t acceptable — and you can tolerate significantly slower speeds.
- Use Tails if: you need Tor’s protections plus a guarantee that nothing persists on the machine itself afterward — the exact combination that made it a real, documented tool of choice for the journalists who broke the Snowden story.
- Neither is a complete anonymity solution on its own. See our breakdown of what a VPN can and can’t hide — much of it (account logins, browser fingerprinting) applies to Tor Browser too if you’re not careful.
VPN vs Tor: Frequently Asked Questions
Is Tor completely anonymous?
No. Tor significantly raises the difficulty of linking your identity to your activity, but documented cases (exit-node monitoring, the 2014 deanonymization attempt on hidden services) show it isn’t absolute. Logging into an identity-linked account while using Tor defeats its purpose the same way it does with a VPN.
Is it illegal to use Tor?
No — Tor is legal to use in most countries, including the U.S. It’s used by journalists, researchers, law enforcement, and privacy-conscious individuals, not just for illicit purposes. Some countries do restrict or block Tor access, which is exactly what bridges and pluggable transports like obfs4 are designed to work around; check local regulations if that applies to you.
What is Tails OS and do I need it?
Tails is a live operating system that routes everything through Tor and leaves no trace on the computer afterward. Most users don’t need it — Tor Browser alone covers typical use cases — but it’s a real, documented tool for situations demanding that nothing persists on the machine, as with the journalists who used it during the Snowden reporting.
Is Tor slower than a VPN?
Generally yes, because your traffic passes through three independently-operated relays instead of one server. Check Tor Metrics for current network performance data.
Can I use Tor on my phone?
Yes — Tor Project publishes an official Tor Browser for Android. There’s no official Tor Browser for iOS from the Tor Project itself; the Tor Project’s own site should be checked for current recommendations on iOS.
What is an onion service?
A website reachable only within the Tor network at a .onion address, without ever exposing the server’s real IP address or location — a capability no VPN offers, used by both illicit markets (as in the 2014 Operation Onymous takedown) and legitimate organizations reaching censored regions.
Why does Tor keep using the same entry node instead of rotating it?
Sticking with a small, stable set of guard relays for weeks or months, rather than picking a new one every connection, limits how many different relay operators are ever in a position to see your real IP address — a deliberate design choice that reduces exposure over time.
What is a Tor bridge and when do I need one?
A bridge is a Tor relay not listed in the public consensus, making it much harder for a censoring government or ISP to block. You need one specifically if ordinary Tor connections are already being blocked on your network.