Knowing how to use Tor Browser safely is less about installing the right software and more about understanding what Tor actually does — and what it deliberately leaves unprotected. Tor routes your traffic through three volunteer-operated relays, encrypting it at each hop so no single relay can link your identity to your destination. The exit relay, however, can see unencrypted traffic if you’re not using HTTPS. That one fact shapes most of the rules below.
Download, Verify, and Nothing Else
Every safety guide starts here because the attack surface is obvious: a fake Tor installer is a perfect credential logger. Download Tor Browser only from torproject.org and use the release offered for your supported platform. Check that page for platform-specific guidance.
After downloading, verify the cryptographic signature against Tor’s published signing key before running anything. The Tor Project’s signature verification guide walks through GPG verification on each platform. Skip this step and you have no way to distinguish a real build from a tampered one.
Do not install Tor Browser from app stores, third-party mirrors, or any link posted in a forum. Stick to the canonical URL.
Configure the Security Level for Your Threat Model
Tor Browser ships with three security presets, accessible via the shield icon in the toolbar:
Standard — the default. JavaScript runs everywhere, all site features work. Suitable for general browsing where you want anonymity from your ISP and ad networks but aren’t worried about targeted browser exploits.
Safer — disables JavaScript on non-HTTPS sites, blocks some audio/video media, and removes certain font fingerprinting vectors. Most modern sites still function. This is the right starting point for anyone whose threat model includes an adversary willing to serve malicious JavaScript.
Safest — disables JavaScript globally, blocks most fonts and icons, and disables WebGL. Many sites break. Use this when your threat model includes active exploitation attempts, e.g., a journalist on a hostile network or a researcher handling sensitive sources.
Tor Project’s security-levels page makes Standard the default and asks you to weigh your security needs against the usability you require; Safer and Safest disable more site features in exchange for a smaller attack surface.
Leave HTTPS-Only Mode on (it has been enabled by default since Tor Browser 11.5) so connections upgrade to HTTPS where available. Check for the padlock or onion icon in the address bar before entering credentials anywhere.
What Tor Protects — and What It Doesn’t
This is where most people’s mental model breaks down.
Tor Browser anonymizes traffic from within Tor Browser. It does not anonymize your email client, your Slack app, your system DNS lookups, or any other process running on your machine. Those applications communicate directly over your regular internet connection, fully visible to your ISP.
The EFF’s Surveillance Self-Defense puts it directly: “Keep in mind that only activities you do inside of Tor Browser itself will be anonymized.” For an operating-system approach, review the routing boundaries in the Tails, Whonix, and Qubes comparison.
Additionally, if you log into a personal account while using Tor — Google, Twitter, your bank — that site now knows who you are even if it doesn’t know your IP address. Tor hides your location, not your identity. Logging in collapses the anonymity you built up the moment you authenticate.
Operational Rules That Actually Matter
These behaviors undo Tor anonymity more reliably than any technical vulnerability:
No torrenting. Torrent clients have been observed bypassing proxy settings and making direct connections even when configured otherwise. This exposes your real IP and degrades the network for everyone else. Tor Project explicitly warns against this.
No additional browser extensions. Tor Browser includes NoScript. Adding extensions can increase your attack surface and make your browser fingerprint more distinctive. Follow the Tor Project’s safety guidance and use the built-in security levels.
Don’t open downloaded documents while connected. PDF readers, Word, and similar apps may load external resources — images, fonts, templates — over your regular network connection, bypassing Tor entirely. Download the file, disconnect from the internet or switch to airplane mode, then open it. The Tor Project flags this as a known de-anonymization vector.
Keep letterboxing enabled. Tor Browser adds margins to group viewports into shared size buckets, including when you resize the window. Resizing alone does not defeat that protection. Leave letterboxing enabled and avoid unusual configuration changes; the browser fingerprinting guide explains the shared-size approach.
Avoid logging personal information into any site. No real name, email address, or phone number in forms unless you specifically intend for that site to identify you. Treat every session as if the exit relay is logging everything.
Bridges: When Tor Access Is Blocked or Monitored
In some countries, ISPs block connections to the Tor network by detecting the distinctive handshake with public relays. Bridges are unlisted relays that don’t appear in public directories. The Tor Browser connection wizard offers three bridge types:
- obfs4: Obfuscates traffic to look like random noise. The most widely effective option.
- Snowflake: Routes traffic through WebRTC to look like video conferencing. Effective where obfs4 is blocked.
- meek: Makes your connection look like ordinary website browsing. Very slow because of bandwidth limits, so use it as a last resort.
Request bridges at bridges.torproject.org or within the Tor Browser connection settings. Don’t share bridge addresses publicly — once a bridge appears in a forum, censors can block it.
Verify Your Setup After Connecting
After connecting to Tor, visit check.torproject.org to confirm you’re routing through the Tor network. For a more complete picture, coveryourtracks.eff.org shows what fingerprinting data your browser exposes.
Two things to confirm:
- The Tor check page shows a green “Congratulations” message.
- CoverYourTracks shows your browser looks similar to other Tor Browser users — not unique.
If your fingerprint looks unusual, review added extensions and changes to fingerprinting protections. Keep letterboxing enabled rather than assuming a resized window caused the result. Interpret the test within its sample of browsers; a distinct result is a reason to review your configuration, not proof that a tracker has identified you.
