Tor vs VPN: what the Tor Project, EFF and VPN vendors say

Two different questions

Windscribe, which sells a VPN, puts the difference as privacy against anonymity. Its page says privacy is hiding what you are doing and anonymity is hiding who you are, and that a VPN is a privacy tool while Tor is an anonymity network. Kaspersky, which also sells a VPN, starts from what the two have in common: both aim to keep the site you visit from seeing your real IP address and to keep your internet provider from seeing which pages you open. Where they differ, it says, is in how they hide your traffic.

EFF’s Surveillance Self-Defense guide, last reviewed on 28 July 2026, is blunter about the VPN side. It says VPN advertisements vastly oversell the benefits, and that VPNs are best suited to one thing: routing your network connection through a different network. It names two circumstances where that is useful, getting around censorship on a network that blocks certain sites and connecting to the corporate intranet of an office from somewhere else. It also says a VPN is not a tool for anonymity, and that if you are interested in increased anonymity, Tor is a better solution than a VPN. That line is one sentence inside a guide about choosing a VPN; we did not read EFF’s own page on how Tor works.

NordVPN’s blog draws the line a third way. It says Tor is used to access the Onion network, the .onion sites that a regular browser cannot open, while a VPN protects your entire connection on any network. Windscribe makes the same point about the .onion mirrors kept by email providers, news outlets and human rights organizations, which it says only Tor Browser can reach, and Kaspersky lists .onion services among the cases for Tor.

Who wrote each page matters here. Kaspersky, Norton, Windscribe and NordVPN all sell VPNs, and CNET’s page says it may earn a commission if you buy through its links. EFF says in its guide that it cannot vouch for any VPN or ratings. We use the vendor and magazine pages for how the tools work and name them whenever we give their opinions.

Who can see what

Kaspersky describes Tor as three relays chosen at random and run by volunteers. Your traffic is wrapped in three layers of encryption. The entry relay, which it also calls the guard, sees your IP address but not your destination. The middle relay sees neither end, only the relay before it and the relay after it. The exit relay removes the last layer and passes your request to the site, so it sees the destination but not you, and the website records the exit relay’s address rather than yours. CNET, Norton, Windscribe and NordVPN give the same three steps in their own words.

The Tor Project’s FAQ, which we read as an archived page from 2019, adds two points. It says the IP address you connect to through Tor changes at most every ten minutes, and often more frequently, which makes it hard for websites to build a lasting profile of a Tor user who has not identified themselves in other ways. It also says that, because of the three-hop circuit, no one Tor relay knows enough to compromise a user.

On a VPN, Kaspersky says your internet provider sees encrypted traffic heading toward a VPN server and the site you visit sees the server’s address. The provider itself sees your real IP address and information about the destinations you connect to. EFF puts it the same way: a VPN hides your traffic from your internet provider and from the owner of the local network, such as a coffee shop or a hotel, but all of it is visible to the VPN provider.

The same 2019 FAQ page is the harshest on this point. Under the heading “Is Tor like a VPN?” it tells readers not to use a VPN as an anonymity solution, and says a VPN has a single point of failure, the provider. The same entry says that if you want a trusted way into the Tor network, or want to obscure the fact that you are using Tor, setting up a private server as a bridge works quite well. It says a technically proficient attacker or a number of employees could retrieve the identity information tied to a user, that identities can be found by following a money trail or by persuading the provider to hand over logs, and that when a provider says it keeps no logs, users have to take its word for it. EFF adds that VPN providers are subject to law enforcement requests, that many providers save as much information as internet providers do, and that paying by card ties the service to your identity.

The vendors do not dispute the trust point. CNET says using a VPN requires trusting that company, Windscribe says you are trusting one provider instead of your internet provider, and NordVPN lists trust in a single provider as the main limitation of a VPN. CNET says most providers keep strict no-logging policies and that independent audits back up such claims, though it adds that you can and should still be skeptical, while EFF says a claim is not a guarantee. We cannot check any provider’s logging from these pages.

Tor has its own blind spot at the far end. Kaspersky says traffic leaving the exit relay is no longer wrapped in Tor’s encryption, so whoever runs that relay can read anything sent over plain HTTP, while HTTPS keeps the last stretch encrypted. NordVPN says the same of exit nodes and unencrypted traffic.

Public Wi-Fi is where the pages split. Kaspersky, Norton and NordVPN list it as a reason to use a VPN. EFF says it used to be a standard recommendation but is not as necessary for everyone now, because the majority of web traffic is encrypted with HTTPS. It adds that HTTPS protects the content of what you do, not the metadata, so the domain names you visit and when you visit them can usually still be seen along the path, and that a VPN you trust may be useful on a network you do not trust.

What each one does not cover

The first gap is scope. CNET says Tor Browser does not encrypt all of your device’s traffic, only what is in the browser window, so a games app or an email client is left outside. Windscribe calls Tor “a secure room you walk into” and not something you wear everywhere. A VPN app, CNET and Norton say, covers every app and browser on the device.

The second is what identifies you anyway. Kaspersky says account logins, cookies and browser fingerprinting expose personal information that neither Tor nor a VPN can hide, and that if you log into an email account the site knows who you are however your traffic got there. EFF lists cookies, tracking pixels and fingerprinting among the other ways companies may track you through a VPN. Windscribe says a VPN does not stop browser fingerprinting, and that Tor Browser is well shielded against it. Norton says Tor reduces tracking and fingerprinting unless you log in to personal accounts or change default settings.

The third is an adversary who can watch both ends. Kaspersky says a government agency watching traffic at both ends of the network may still match the timing and size of what enters against what leaves, and work out who you are. Norton calls such traffic-correlation attacks “difficult but not impossible”, and says that is why Tor stresses it cannot guarantee perfect anonymity.

The fourth is the setup itself. Kaspersky says a DNS request that escapes the tunnel, or an app that ignores your proxy settings, can leak your real IP address without you noticing. Windscribe says a sloppy VPN app can suffer DNS or IPv6 leaks that reveal your activity to your internet provider anyway, and it adds WebRTC leaks, which use the browser’s own real-time communication features. The Tor Project’s archived wiki page, last edited in June 2020, describes the same kind of failure: without special precautions, when a VPN connection breaks down, direct connections are made without the VPN.

Speed, price and the law

The pages that compare speed say a VPN is faster, and they give the same reason: fewer stops. CNET says a VPN typically relies on a single server, while Tor sends traffic through at least three. Windscribe adds that Tor’s speed is capped by the slowest volunteer relay in the circuit. Kaspersky says streaming, gaming and large downloads usually run better on a VPN, and Norton calls Tor unsuitable for downloading large files or streaming high-quality media.

The numbers come from two sources, and both are claims. CNET’s article says that in the author’s experience the fastest VPNs lower internet speed by around 11 per cent on average. Windscribe says Tor typically sits at about 500 KB per second, roughly 4 Mbps, and that a VPN using WireGuard adds 5 to 10 per cent of overhead on a decent home line. We did not find a method behind either figure in the pages we read, and EFF’s guide gives no speed figures.

On price, Kaspersky says Tor has no fees and no premium tier, and that its relays run on bandwidth donated by volunteers and organizations, which is why capacity is limited. Norton’s comparison table puts VPNs at $2 to $30 per month, usually on a subscription, with limited free options; that is a vendor’s own range. EFF describes the business models it has seen: freemium VPNs that charge after a data cap, VPNs that are free but sell your data, and recurring subscriptions that keep charging if you forget to cancel.

On location, CNET says a VPN lets you choose where you appear to be, which is how people unblock a streaming library from another country, whereas Tor usually does not. NordVPN says choosing a specific country’s IP address on Tor is difficult.

On the law, Kaspersky says Tor is legal in most countries, including the United States and across the European Union, and that some governments restrict or block it. Norton names China, Russia and Iran as places where it is blocked or restricted, Windscribe names China and Russia, and NordVPN lists Russia, Belarus, China and Saudi Arabia. Kaspersky adds that what you do while connected is still governed by local law. For networks that block Tor, Kaspersky points to bridges, which it calls unlisted entry points, and Windscribe to the Snowflake and obfs4 transports.

Using both together

The Tor Project’s support page is short on this. It says that while combining a VPN with Tor might seem to increase privacy, in practice it can reduce anonymity or break Tor’s protections if not configured correctly. It says the project does not recommend using a VPN with Tor unless you are an advanced user who knows how to configure both in a way that does not compromise your privacy, and it points to a wiki for more detail.

That wiki page is an archive, last edited on 15 June 2020. It says you can very well decrease your anonymity by using a VPN or SSH tunnel in addition to Tor. If the VPN server is controlled by an adversary, it says, you weaken the protection Tor provides; if the server is trustworthy, you can increase the anonymity or privacy, depending on the setup. It adds that most VPN and SSH providers log and that there is a money trail if you cannot pay really anonymously. Against a global adversary with unlimited resources, it says, more hops make passive attacks slightly harder but active attacks easier.

The wiki goes through the orders one by one. With the VPN first and Tor second, it says the setup might stop your internet provider from seeing that you use Tor, but that a VPN gives no strong guarantee: an attack called website traffic fingerprinting can guess which site is visited from encrypted VPN traffic, and the wiki says papers exist on that attack against VPNs but not on Tor traffic hidden behind one. It also names an advantage: Tor cannot see who you are behind the VPN, which helps if Tor were broken and the VPN kept its promises. With Tor first and a VPN after it, the wiki says activity is hidden from exit nodes but creates a bottleneck where the VPN can build a profile of everything you do, and it calls routing from Tor onward to a fixed destination “generally a really poor plan”.

The vendors name the two orders. Kaspersky says Tor over VPN means connecting to the VPN first and then opening Tor Browser: your internet provider sees a VPN connection, and the Tor entry relay sees the VPN server instead of your address. VPN over Tor reverses it, so the entry relay still sees your real address and the destination sees the VPN server; Kaspersky says few providers support it and setup takes work. Windscribe adds that with Tor over VPN the VPN company can see you connecting to the Tor network. Norton says Tor over VPN has “limited benefits for most users”: it hides Tor use from your internet provider, which still sees the VPN, it slows browsing, and it does not protect against a malicious exit node. NordVPN describes the second order as protecting traffic from malicious exit nodes but not giving full anonymity, because the VPN provider sees the traffic leave Tor.

Advice differs, and each side is on record. CNET says journalists, political activists and asylum-seekers who need as much anonymity as possible should consider pairing a VPN with Tor, and names NordVPN’s Onion Over VPN and Proton VPN’s Tor Over VPN servers, which are services their providers sell. Kaspersky says running both adds delay and rarely improves privacy for everyday users, and that one tool you understand may protect you better than two that are not configured correctly. Windscribe says you can stack them, but that doing so does not always mean you should, and that for 99 per cent of people stacking is overkill.

What the pages we read do not say

The pages we read do not report how often traffic correlation has identified real people on Tor; Kaspersky and Norton say only that it is possible. They do not give an independent measurement of how fast Tor or a VPN is, only the figures from CNET and Windscribe. The five vendor and magazine pages do not mention the Tor Project’s wiki page on combining the two.

The FAQ is a copy from 2019 and the wiki page was last edited in 2020. The pages we read do not say whether the Tor Project’s position has changed since; its current support page repeats the caution.

We tested neither tool. We did not open the Panda Security page, the shattered.io page or the Reddit thread, and nothing on this page rests on them. One sentence in the Kaspersky page reads like an editing instruction left in the text, and we did not use it.