tor

What Is Tor? Three Relays, One Layer Each, and What That Buys You

secure-os· Updated September 4, 2026· 4 min read #tor#anonymity#network#threat-model

Two halves of a white onion on a pale beige surface seen from above, the left half showing its concentric layers in cross section with dry roots at one end

Tor is a network of volunteer-run relays that carries your traffic through three of them in sequence before it reaches the internet.

The point of the three is not redundancy. It is that no single relay ever knows both ends.

The first relay knows who you are, and knows the second relay. It does not know where you are going.
The second knows only the first and the third. It knows nothing about you or your destination.
The third, the exit, knows the destination. It does not know who you are.

Break the chain anywhere and the observer holds half a fact. That is the entire design, and everything else follows from it.

Why it is called onion routing

Your client wraps the data in three layers of encryption, one per relay, in reverse order.

Each relay peels exactly one layer, which reveals only the address of the next hop and nothing else. By the time the traffic leaves the exit, all three layers are gone.

This is the difference from a VPN in one sentence. A VPN operator sees both who you are and where you go, and you trust it not to keep that. Tor arranges that nobody holds both halves, so there is nothing to trust.

Extreme macro of sliced red cabbage against a black background, showing tightly packed rippling purple and white layers with pale branching veins running through them — Sliced red cabbage in macro, its layers pressed tightly together against black. Cut through and you see every layer at once, which is precisely what no relay in the Tor network can do: each one gets a single layer and no view of the rest.

What Tor actually protects

Your address from the site. The destination sees the exit relay, not you.

Your destinations from your provider and your network. They see a connection to a Tor entry point, and nothing about what travels through it.

The link between the two. This is the real product. Not secrecy of content, which HTTPS already gives you, but the fact that nobody can join one end to the other from a single vantage point.

What it does not protect

⚠️ The same four gaps trip up everyone.

Logging in destroys it. Sign in to an account under your own name and the account identifies you, whatever route the packets took. Anonymity is a property of the whole session, not of the network.

The exit sees unencrypted traffic. If a site is not on HTTPS, the exit relay reads what you send. It does not know who you are, but it reads the content. This is the single most misunderstood part of Tor, and it is covered in whether Tor is safe.

Your browser can betray you. Fonts, screen size, plugins and settings compose a fingerprint that survives any network. This is why the Tor Browser exists and why changing its window size or installing extensions is discouraged: the defence is that everyone looks identical, and personalising it removes exactly that.

It does not protect the device. Malware, a keylogger and a seized machine are all unaffected.

Why it is slow, and why that is not a defect

Three relays, chosen from around the world, each adding a hop and a decryption step. Your traffic may cross three continents to reach a site hosted in your own city.

That latency is the cost of the property, not a performance bug waiting to be fixed. Speeding it up by shortening the path would remove the thing you came for. It is why Tor suits reading, publishing and messaging, and suits video calls badly.

Tor or a VPN

They answer different questions and the confusion between them is constant.

A VPN moves trust: your provider stops seeing your destinations, and the VPN operator starts. It is fast, it is convenient, and it works well on untrusted networks. See what a VPN is for what that trade really involves.

Tor removes the need to trust any single party, and pays for it in speed and in websites that treat exit relays with suspicion.

Neither makes you anonymous by itself. A logged-in account, a distinctive browser or a habit of connecting at the same hour each evening will undo either one. What matters is the whole picture, which is what a threat model is for.

What using it looks like in practice

Use the Tor Browser, not an ordinary browser pointed at a proxy. The browser is half the protection.
Leave the window size alone and do not add extensions.
Expect friction. Captchas, blocked sites and slow loads are normal, because many services treat exit addresses as suspect.
Do not log in to anything that identifies you, or accept that you have chosen convenience over the property Tor provides.

The short version

Tor routes through three relays, and no relay knows both ends.
Three layers of encryption, one peeled per hop, hence onion routing.
It hides the link between you and your destination, not the content of unencrypted traffic.
A login, a browser fingerprint or malware defeats it, because anonymity is a property of the session.
Slow by design. The latency is the price of the guarantee, not a fault.