Tor Browser is what people install when they want to disappear online. It is genuinely good at one part of that job and completely unable to do another, and the confusion between the two is where people get into trouble. What follows is a plain description of what the browser does to your traffic, where the protection stops, and the handful of habits that matter more than any setting. None of it requires a technical background. It only requires you to stop treating a piece of software as a guarantee.
How Tor Browser Actually Hides You
Tor Browser is Firefox with a routing layer underneath it and a long list of defaults changed. When you open a site, your request doesn't travel straight there. It passes through three relays run by volunteers: an entry guard, a middle relay, and an exit. Each hop knows only the address of the hop before it and the one after it. The exit relay is the one that finally hands your request to the website.
That design gives you two concrete protections. The site you visit sees the exit relay's IP address instead of yours. Your internet provider sees that you are connected to the Tor network, but not which pages you opened inside it. Neither side gets the full picture, and that is the entire point of the arrangement.
The browser layer adds a second kind of protection on top. Tor Browser tries to make every user look identical, so that sites can't single you out by the size of your window, the fonts installed on your machine, or the way your graphics card draws an image. Cookies are held in memory and thrown away when you close the browser or click New Identity. Browsing history isn't recorded at all.
What the Design Does Not Cover
The exit relay can read unencrypted traffic
Encryption is what keeps the exit relay honest. If a site uses HTTPS, the relay forwards scrambled data it can't read. If a site doesn't, the relay — and anyone watching that relay — sees the page in plain text, including anything you type into a form. Tor Browser ships with an HTTPS-Only mode. Turn it on and leave it on.
Your accounts identify you, not your IP
The moment you log into an email address, a social profile, or a forum you also visit in your normal browser, the website knows exactly who you are. Tor hid your location. You volunteered your identity. Location and identity are different things, and Tor only handles the first.
Your device sits outside the threat model
Malware, a keylogger, a synced cloud folder, someone with physical access to your laptop, a webcam in the room — none of that is Tor's problem to solve, and it won't. Browser extensions and plugins are a well-known way to leak your real IP address, which is why the standard advice is not to install any. If you need to run Tor Browser alongside your regular browser, keep them as separate as you can.
Torrent clients leak your address
BitTorrent over Tor is a documented deanonymization path and it strains the network. Use a VPN or nothing. Not both stacked on top of each other unless you understand why you're doing it.
Misconceptions Worth Retiring
- "Using Tor makes me anonymous." It makes your connection difficult to trace. Anonymity is a set of habits you maintain, not a program you open.
- "Tor is only for criminals." Journalists, researchers, domestic abuse survivors, activists, and ordinary people who dislike being profiled all rely on it.
- "Tor is illegal." In most countries, running the browser is perfectly legal; some governments block or restrict the network. Check your own jurisdiction or speak to a lawyer — general information here is not legal advice.
- "The exit node sees everything I do." It sees what isn't encrypted. On an HTTPS-only browsing session, that's very little.
- "Tor is slow because it's badly built." Three relays scattered across the world add delay by design. Speed is traded for unlinkability.
Setting It Up Without Fooling Yourself
- Download the browser from the official Tor Project site, and verify the signature if you can. Third-party mirrors and "faster Tor" bundles are a common way to get malware.
- Leave the security level at Standard while you learn. Safer blocks JavaScript on non-HTTPS sites; Safest blocks it everywhere. Many sites break without it, so raise the level only when you need to.
- Switch on HTTPS-Only mode in the settings. This is the single highest-value change most beginners can make.
- Don't resize the window to odd dimensions. Letterboxing pads the viewport to a standard set of sizes specifically so you blend in with everyone else.
- Use New Identity between separate tasks. It wipes cookies and starts fresh circuits, so two unrelated sessions don't get linked together.
- If the network is blocked where you are, open the connection settings and try bridges. Start with the built-in options before hunting down custom ones.
- Never sign into accounts you use anywhere else. If you must, create a dedicated identity and keep it strictly separate.
A Realistic Standard of Safety
Tor Browser is one layer, and a good one. It works best when the layers around it are solid: an updated operating system, full-disk encryption, a password manager, and the discipline to keep your Tor identity and your everyday identity from ever touching.
Think in terms of cost rather than impossibility. No tool makes you unfindable. What Tor does is make linking your browsing to your name expensive and unreliable for anyone watching — provided you don't hand over the connection yourself by logging in, downloading a suspicious file, or installing an extension that phones home. Use it for what it's good at, understand the gaps, and you'll get far more out of it than the people who assume the green onion means they're untouchable.
Photo: PagArt_ / Pixabay