Dark Web

How Does Tor Work?

Tor is the technology behind the dark web — and behind a great deal of ordinary private browsing. It works on a simple idea: split the knowledge about a connection across three separate relays, so that no single party ever knows both who you are and where you are going. This guide walks through that idea step by step, with no jargon left unexplained.

By Abdul Hannan · Published 14 November 2026 · Updated 14 November 2026

Try the tool: Tor Circuit Visualizer

Education only. This page explains how Tor works. It does not help anyone access illegal content or break the law. Tor is a privacy tool, not a guarantee of anonymity. Laws differ by country — check your local law.

The problem Tor solves

When you visit a website normally, your connection is a straight line: your computer talks to the site, and everything in between can see both ends. Your internet provider knows your address and the site you asked for. The site knows your address and what you asked for. Anyone watching the wire in the middle can see both.

That is fine for most everyday browsing, but it is a problem when privacy matters — for a journalist protecting a source, a researcher in a censored country, or anyone who does not want their reading habits tied to their name. Encryption helps, but on its own it does not hide who is talking to whom: your provider can still see the address you connected to, and the site can still see your address.

Tor solves the who is talking to whom problem, not the encryption problem. It does it by refusing to let any single machine see the whole picture.

The short version

Tor routes your traffic through three volunteer-run servers called relays, in a chain called a circuit. Before your message leaves your computer, it is wrapped in three layers of encryption — one for each relay. Each relay peels off its own layer and passes the message on. By the time the message reaches its destination, no single relay has seen both ends of the journey. Your provider sees you using Tor, but not what you do. The destination sees the final relay, but not you.

Peel the onion: a visual walkthrough

The layers below are the layers your message wears on its journey. Read from the outside in: each box is one layer of encryption, and each layer is removed by exactly one relay.

Outer layer — for the guard relay. This is the first relay your message reaches. It can see your real address, because you connected to it directly — but the message is still wrapped in two more layers, so it cannot read what you sent or see where it is going.

Middle layer — for the middle relay. The guard relay peels the outer layer and hands the message on. The middle relay knows only the guard relay and the exit relay. It cannot see your address, and it cannot see your destination.

Inner layer — for the exit relay. The middle relay peels the second layer and hands the message on. The exit relay removes the last layer and finally sees the destination — but it never saw your address, so it has no idea who you are.

The message itself. The exit relay delivers your request to the website. The website sees the exit relay's address, not yours. It has no way to know, from the connection alone, who sent the request.

That is the whole trick, and it is why the network is named after an onion: each layer is peeled by a different relay, and no relay gets the whole vegetable. The idea itself is old — onion routing was developed at the United States Naval Research Laboratory in the mid-1990s by Paul Syverson, Michael Reed and David Goldschlag, to protect intelligence communications. Tor is the second-generation design built on that idea, developed openly by the Tor Project, a non-profit founded in 2006.

The three relays, and what each one knows

Relay	Knows your address?	Knows the destination?	Can read your message?
Guard (entry)	Yes — you connected to it	No — two layers still cover it	No
Middle	No	No	No
Exit	No	Yes — it delivers the request	Only if the connection is unencrypted

That table is the heart of Tor's design. To learn both your address and your destination, an attacker would have to control or observe both the guard relay and the exit relay of the same circuit — and circuits are chosen at random from thousands of volunteer relays around the world.

How a circuit is built

Building a circuit is more careful than it sounds. Your Tor client does not simply send the wrapped message to the first relay and hope for the best. It builds the path one hop at a time, in a process sometimes called telescoping:

Your client downloads a directory of available relays. This list is signed by directory authorities, so your client can check it has not been tampered with.
It picks three relays at random — a guard, a middle, and an exit — and opens an encrypted channel to the guard.
It negotiates a separate key with each relay, one at a time, reaching through the relays it has already connected to. Each relay only ever holds the key for its own layer.
Your message is wrapped in three layers and sent down the circuit. Each relay removes its layer and forwards the rest.
The circuit is rebuilt regularly — roughly every ten minutes, and a different circuit is used for each website — so that activity on one site is not easily linked to activity on another.

The guard relay is special: your client keeps using the same guard relay for weeks or months, rather than picking a new one for every circuit. That sounds less private, but it is a deliberate defence. If your client picked a new guard relay every time, it would eventually, by chance, pick a malicious one. Sticking to one guard means a single bad guard is the only risk, and guards are chosen from the most stable, long-running relays.

What about onion services?

So far we have described visiting an ordinary website through Tor. Onion services — the .onion sites of the dark web — work differently, and more privately: the connection never leaves the Tor network at all.

Instead of your traffic exiting to the public internet, both sides build circuits into the network and meet at a rendezvous point inside Tor. Your circuit has three relays, the service's circuit has three relays, and they join in the middle. Neither side learns the other's address, and there is no exit relay to observe the traffic. That is why an onion service can hide the location of its server as well as the location of its visitors.

The address of an onion service is derived from its public key, which is why it looks like a random string of characters ending in .onion. The address is the identity: if the address matches the key, you are talking to the right service.

Bridges: Tor when Tor is blocked

In some countries, connecting to Tor is itself blocked — internet providers refuse connections to the public list of relays. Tor's answer is bridges: relays that are not listed in the public directory, so they are harder to block. A bridge works exactly like a guard relay, except that you have to get its address from the Tor Project rather than from the public list.

Bridges are a censorship-circumvention tool, and using one is a decision with legal consequences in the countries that block Tor. This site does not provide bridges or instructions for evading a specific country's blocking — the Tor Project's own documentation is the place for that, and local law is the thing to check first.

The honest limits

Tor is a strong tool with real, documented limits. Understanding them is part of understanding Tor:

The exit relay can see unencrypted traffic. If you visit a site without HTTPS, the exit relay can read what passes through it. Tor does not encrypt your traffic after it leaves the network — that is the website's job. Always look for HTTPS, and treat unencrypted sites as public.
Tor hides your address, not your behaviour. Log in to an account, and the site knows who you are regardless of Tor. Download a document with identifying details, and it can identify you. Enable scripts or plugins, and they can leak information about your device.
Your provider knows you use Tor. The first hop is visible to your internet provider and to anyone watching your local network. Tor hides what you do, not that you use Tor.
Correlation attacks are possible. An observer who can watch traffic entering and leaving the network can, in principle, match up timing and volume to link a user to a destination. This is a known weakness of all low-latency anonymity networks, documented since Tor's earliest research papers, and it is why Tor is described as making tracing harder, never impossible.
Tor is slower by design. Three hops, encryption and decryption at each step, and volunteer hardware around the world add delay. Video and large downloads suffer most.
Many sites block Tor. Some websites refuse connections from exit relays, or demand endless verification checks, because exit relay addresses are public and shared by many users.
Malicious relays exist. Anyone can run a relay, including attackers. The design limits what any single relay can learn, which is exactly why the design splits knowledge three ways — but it does not eliminate the risk.

No anonymity tool is a guarantee. Tor reduces the likelihood of being traced. It does not erase it. Anyone who promises you complete anonymity on the internet — with Tor, a VPN, or anything else — is selling you something.

Tor Browser vs the Tor network

A common confusion is worth clearing up: Tor is the network, and Tor Browser is the easiest way to use it. Tor Browser is a modified browser with privacy protections built in — it routes all its traffic through Tor, blocks trackers, and resists fingerprinting — but it is not the only way to use the network. Other tools can route their traffic through Tor too.

The important point for a beginner is that Tor Browser is designed so you do not have to configure anything: install it from torproject.org, open it, and it connects. The privacy protections are in the defaults, and changing them — installing add-ons, enabling plugins, maximising the window — can weaken them.

Who runs Tor?

Tor is free and open-source software, maintained by the Tor Project, a non-profit organisation. The network itself is run by thousands of volunteers around the world who operate relays at their own expense. Nobody is paid to relay your traffic, and nobody owns the network. That volunteer structure is both Tor's strength — no single company to pressure or buy — and its weakness, because relay capacity and speed depend on volunteers.

The number of relays changes daily as volunteers join and leave. Tor Metrics, the Tor Project's own statistics site, publishes the running count, and it is the only place to get a current figure rather than a stale quote from an article.

Sources

Tor Project — A short introduction to Tor (Tor Specifications, accessed 14 November 2026)
Dingledine, Mathewson and Syverson — Challenges in deploying low-latency anonymity (Tor Tech Report 2005-02-001, February 2005)
Tor Project — Download Tor Browser (accessed 14 November 2026)
Tor Metrics — Servers: relays and bridges (accessed 14 November 2026)
Onion services — Wikipedia (accessed 14 November 2026)

Last checked: 14 November 2026.

Frequently asked questions

How does Tor work in simple terms?

Tor wraps your message in three layers of encryption and sends it through three volunteer relays. Each relay peels off one layer and passes it on. No single relay knows both who you are and where you are going, so your location stays hidden from the website you visit.

What are Tor relays?

Relays are volunteer-run servers that pass Tor traffic along. A circuit normally uses three: a guard relay that knows your address but not your destination, a middle relay that knows neither, and an exit relay that knows the destination but not who you are.

Is Tor really anonymous?

Tor makes it much harder to trace your activity, but it is not a guarantee of anonymity. Logging in to an account, downloading files, running scripts, or a website that knows who you are can still identify you. Tor hides your address, not your behaviour.

Can my internet provider see I am using Tor?

Yes. Your provider can see that you are connecting to Tor, because the first relay you contact is visible to it. What your provider cannot see is which websites you visit or what you do there — that is hidden by Tor's encryption.

Why is Tor slow?

Tor routes your traffic through three relays, often on volunteer hardware around the world, and your data is encrypted and decrypted three times. That adds delay by design. Most users notice it most on video and large downloads; ordinary reading is usually fine.

What is a Tor circuit?

A circuit is the path your traffic takes through the Tor network — normally three relays chosen at random. Tor builds a new circuit roughly every ten minutes, and a different circuit is used for each website, so activity on one site is not easily linked to activity on another.