Is Tor Browser safe?
It is safe to use, and it keeps you anonymous only until you log in or tell a website who you are.
Yes. Tor Browser is free, open-source software from the nonprofit Tor Project, and it is safe to use when you download it from torproject.org. It sends your traffic through three volunteer relays, so websites see a Tor address instead of yours and your internet provider sees only that you use Tor. It cannot protect you once you log in to an account, type personal details into a form, or install add-ons, and the last relay can read anything that is not sent over HTTPS.
How Tor Browser works
Tor Browser is a heavily modified version of Firefox ESR. The current stable release, Tor Browser 16.0, came out on October 29, 2026, and is based on Firefox ESR 153.
Tor Browser normally sends each connection through three randomly chosen relays run by volunteers. The first relay, the guard, sees your IP address. The last, the exit relay, sends your request to the website, so the website sees the exit relay's address instead of yours. No single relay learns both who you are and where you are going. Tor encrypts your traffic in layers, and each relay removes one layer.
Your guard relay stays the same for two to three months, while the other two relays change for each new site. Tor also routes different websites over different circuits, so a tracker embedded on two sites cannot tell that both visits came from the same browser.
Tor Browser keeps no browsing history, and cookies last only until you close it or click New Identity.
What Tor protects, and what it does not
| Threat | Does Tor Browser stop it? |
|---|---|
| Your ISP or Wi-Fi owner seeing which sites you visit | Yes. They see only that you connect to Tor. |
| Websites learning your IP address and location | Yes. They see the exit relay's address. |
| Trackers following you from site to site | Mostly. Per-site circuits and fingerprinting defenses make you look like other Tor users. |
| Your ISP knowing you use Tor | No. A bridge reduces that risk. |
| A website knowing who you are after you log in | No. Logging in identifies you to that site. |
| The exit relay reading your traffic | Only when the site uses HTTPS. Tor Browser's HTTPS-Only Mode forces it wherever the site supports it. |
| Other apps on your computer leaking your IP | No. Tor protects only apps configured to use it. |
| Malware already on your device | No. |
The Tor Project's own best-practices page says perfect anonymity is impossible, even with Tor. Treat Tor as a tool that hides your network location.
How to use Tor Browser on a computer
- 1Download Tor Browser only from torproject.org (download.torproject.org). It is free, so any app that charges for "Tor Browser" is a fake.
- 2Verify the download's signature. The Tor Project's install instructions mark this step as recommended on Windows, macOS, and Linux.
- 3Install and open it, then click Connect. If Tor is blocked where you are, open Configure Connection and add a bridge.
- 4Pick a security level in Settings: Standard works on most sites, while Safer or Safest blocks more of the features that attacks rely on.
- 5Check for the padlock or onion icon before you type anything sensitive. Do not install extra add-ons. The only ones tested with Tor Browser are the ones it ships with.
- 6Click New Identity when you want to start fresh. It closes every tab, clears cookies and history, and uses new circuits so later activity cannot be linked to what you did before.
Tor Browser 16.0 runs on Windows 10 and 11, macOS 10.15 or later, and 64-bit Linux, now including ARM64. It dropped 32-bit x86 Linux. Older Windows and macOS versions lost their last legacy builds in March 2026.
Tor Browser security levels
| Level | What it does | Use it when |
|---|---|---|
| Standard | All browser and website features enabled. The default. | Everyday reading where sites need to work. |
| Safer | Disables website features that are often dangerous, including JavaScript on non-HTTPS sites. Audio and video become click-to-play. | A sensible default if you can live with some broken pages. |
| Safest | Allows only what static sites need. JavaScript is off on every site, and some fonts, icons, and images are blocked. | You expect to be targeted, or you are visiting sites you do not trust. |
Tor Browser on Android and iPhone
Tor Browser for Android needs Android 8.0 or newer. Install it from Google Play, from the Guardian Project repository in F-Droid, or from torproject.org. Scanners such as Exodus Privacy flag tracking libraries in the app, and the Tor Project says that code is inherited from Firefox for Android and disabled by default.
There is no Tor Browser for iPhone. The Tor Project recommends Onion Browser, which is open source and routes through Tor, but Apple requires every iOS browser to use WebKit, so Onion Browser cannot match Tor Browser's privacy protections.
The Tor Project also offers Tor VPN, an Android beta that routes several apps through Tor at once and works alongside any browser.
Mistakes that undo Tor
- Logging in to your personal email or social accounts in the same session you want to keep anonymous.
- Filling out forms with your name, address, or phone number. The site may not know where you are, but it now knows who you are.
- Torrenting over Tor. Torrent clients often ignore proxy settings and send your real IP address to trackers and peers.
- Installing add-ons or plugins, which can bypass Tor or make your browser stand out.
- Stacking a VPN on top without knowing exactly how both are configured. The Tor Project does not recommend it except for advanced users.
Tor for your Bitcoin node and wallet
Tor matters most to bitcoiners outside the browser. A wallet that looks up your addresses on someone else's server tells that server your IP address and your addresses in the same request. Running the lookups through Tor removes the IP half.
Bitcoin Core can run behind a Tor proxy with the setting proxy=127.0.0.1:9050 (Tor Browser's own proxy listens on port 9150 instead), and onlynet=onion restricts automatic outbound connections to onion peers. Bitcoin Core 31.0 dropped tor as a network name in these options, so use onion instead. Sparrow starts its built-in Tor automatically when you enter a .onion server address. Sparrow's own docs say a Bitcoin Core connection over Tor is fairly slow and suggest a private Electrum server instead.
You can also reach your own node from outside over Tailscale instead of Tor. Either way, your wallet talks to a server you control, and nobody in the middle learns which addresses are yours. My node guide covers the setup.
Frequently asked questions
Is Tor Browser safe to download?
Yes, from torproject.org or its official mirrors. Verify the signature after downloading. Tor Browser is free, so any paid app using the name is a fake.
Does Tor Browser hide my IP address from my ISP?
Your ISP can see that you connect to the Tor network, while the sites you visit stay hidden from it. Websites see the exit relay's IP address instead of yours. Connecting through a bridge makes it harder for an observer to tell that you use Tor.
Is Tor Browser safe on Android?
Yes, if you install it from Google Play, the Guardian Project F-Droid repository, or torproject.org. It needs Android 8.0 or newer. The tracking code that privacy scanners report is inherited from Firefox and disabled by default.
Is there a Tor Browser for iPhone?
No. The Tor Project recommends Onion Browser for iOS, with the caveat that Apple's WebKit requirement keeps it from matching Tor Browser's protections.
Should I use a VPN with Tor Browser?
Generally no. The Tor Project does not recommend combining them unless you are an advanced user who knows how to configure both without weakening your privacy.