Tor · guides

Tor browser: what it is for, and when a VPN is not

By Alberto Gulotta · Updated 17 September 2026 · 5 min read

This is the entrance to the tor browser tower. It is the only building on this island where the software is the easy part and the person using it is the hard part, and every floor planned above will be shaped by that.

Tor exists because of a specific problem no other tool on this island solves. A VPN moves the trust from your internet provider to a company; somebody in the middle can still see both ends, and that company has an address, a legal department and a jurisdiction. Tor is built so that no single point in the path knows both who you are and where you are going. That is the whole design, it is why the system is slow, and it is why the answer to “should I just use a VPN instead” depends entirely on what you are protecting yourself from.

The tower is being written for two audiences, and each floor will say which one it is for. The first is people who are curious and will use it once — for them the important floors are the ones about what not to do. The second is people who need it for work: reaching a source, publishing from somewhere it is not safe to publish, reading what a government has blocked. For them the software floors will be the least important part of the building.

The floors listed below arrive one at a time, and until the rest are here this page says where to go today instead of only pointing upstairs. The three pages that already exist and border on this one are the VPN atrium, which is the comparison almost everybody arrives holding; private browsers and fingerprinting, for what a browser gives away before the network sees anything; and what the dark web is, and what it is not, which is the subject this tool gets confused with most often.

One idea is worth carrying up the stairs, because it explains why this tower is arranged the way it is. The software those floors will describe is genuinely excellent and it is genuinely free, and in almost every case where somebody using it has been identified, the software did exactly what it promised. What failed was ordinary human behaviour: an account logged into out of habit, a file downloaded and then opened later on the everyday computer, a photograph that carried a location inside it, a username reused from a different life. That is why habits sit at the same level as software in this building rather than as an appendix to it, and why a reader who only has ten minutes should spend them on what not to do.

Not covered here. It will not publish addresses. No onion links, no directories, no mirrors, not as illustration and not as curiosity. Explaining how the network functions is education; handing somebody a door is something else.

It will not help anybody do anything illegal, and it will not pretend that is an unusual position. The network was built by people who wanted journalists and dissidents to be able to work, that remains its most important use, and the floors here will be written for that reader.

And it will not tell somebody whose safety depends on this that a web page was enough. Where the stakes are real, the right move is training and support from an organisation that does this properly, in person and with your own situation in front of them.

On sourcing: everything here about how the network behaves is taken from the documentation of the project that maintains it, with the date it was read. This subject attracts an unusual amount of confident writing from people who have never used any of it, and the only defence against joining them is to quote the people who build the thing. What holds instead is simple: no addresses are published here, and nothing in this tower is for sale.