Using Tor Browser safely: the basics
What Tor protects, what it does not, and the handful of habits that prevent most problems.
Updated
Tor Browser hides where you are connecting from and makes its users look alike. It does not make whatever you open trustworthy, and it cannot protect information you hand over yourself.
Setting up
- Download Tor Browser only from the Tor Project's official website, and keep it updated. Copies from elsewhere are a common way to deliver malware.
- Leave it as it comes. Do not add extensions or change settings you do not understand; each change makes your browser easier to tell apart from the others.
- Raise the security level to Safer or Safest for sites you do not know. It switches off features that most attacks rely on.
While browsing
- Do not sign in to personal accounts, or give your real name, email or phone number, in a session you want kept apart from your identity.
- Do not open downloaded files while online. Documents and media can contact the internet outside Tor and reveal your address.
- Verify an address before you rely on it. See How to verify an onion link.
- Be sceptical of anything that asks for payment or credentials. Fraud is far more common than the service it imitates.
What Tor does not do
- It does not stop malware in a file you chose to run.
- It does not hide from your network provider that you are using Tor, unless you use a bridge.
- It does not make anything legal that is illegal, and it does not undo your own mistakes.
If you need more
People at real risk — sources, journalists, activists — should follow the guidance written for them by the organisation they are contacting; newsroom SecureDrop pages explain exactly what to do. The whistleblowing category lists them.