Table of Contents
Overview
Tor (The Onion Router) is free, open-source software that enables anonymous communication over the internet. It directs internet traffic through a worldwide volunteer network of over 6,500 relays to conceal users location and usage from surveillance and traffic analysis.
History & Development
Research Begins
David Goldschlag, Michael Reed, and Paul Syverson at the U.S. Naval Research Laboratory begin developing onion routing to protect U.S. intelligence communications.
Alpha Release
Roger Dingledine and Nick Mathewson join Syverson to develop Tor. The alpha version is deployed and code released under free license.
Public Release
The Naval Research Laboratory releases Tor under a free license. The Electronic Frontier Foundation (EFF) begins funding development.
Tor Project Founded
The Tor Project, Inc. is founded as a 501(c)(3) nonprofit organization to maintain Tor development.
Tor Browser Bundle
First Tor Browser Bundle released, making Tor accessible to non-technical users.
How Tor Works
Tor implements onion routing—a technique where messages are encrypted in multiple layers, like the layers of an onion. Each relay decrypts one layer to reveal the next destination, but no single relay knows both the origin and final destination.
┌──────────┐ ┌────────────┐ ┌────────────┐ ┌────────────┐ ┌──────────┐
│ YOU │────▶│ GUARD │────▶│ MIDDLE │────▶│ EXIT │────▶│ TARGET │
│ (Client) │ │ (Entry) │ │ (Relay) │ │ (Node) │ │ (Server) │
└──────────┘ └────────────┘ └────────────┘ └────────────┘ └──────────┘
│ │ │ │ │
│ │ │ │ │
Knows: Knows: Knows: Knows: Knows:
- Your IP - Your IP - Guard IP - Middle IP - Exit IP
- Guard IP - Middle IP - Exit IP - Target IP - Request
NOT destination NOT origin NOT origin
Encryption Layers:
Message → [Exit Layer [Middle Layer [Guard Layer [MESSAGE]]]]
Each relay removes ONE layer, sees only the NEXT hop
Step-by-Step Process
- Circuit Creation: Your Tor client selects 3 relays from a list of ~6,500 available nodes
- Key Exchange: Diffie-Hellman key exchange establishes unique encryption keys with each relay
- Layer Encryption: Your request is encrypted 3 times—once for each relay, in reverse order
- Transmission: Each relay decrypts its layer and forwards to the next
- Response: The response travels back through the same circuit, re-encrypted at each hop
Circuit Lifetime: Tor creates a new circuit every 10 minutes for new connections. This limits the window for traffic analysis attacks.
Types of Relays
Guard (Entry) Nodes
The first relay in your circuit. It knows your real IP address but not your destination. Tor uses the same guard for 2-3 months to prevent certain attacks.
~2,500 nodesMiddle Relays
Intermediate nodes that only see encrypted traffic. They know the previous and next relay, but not the origin or destination. The safest to operate.
~4,000 nodesExit Nodes
The final relay that connects to the regular internet. It sees the destination and unencrypted traffic (if not HTTPS). Legally risky to operate—often subpoenaed.
~1,200 nodesBridge Relays
Unlisted entry points for users in countries that block Tor. Their IPs are not published in the main directory, making them harder to block.
~2,000 bridgesHidden Services (.onion)
Hidden services (also called onion services) allow servers to hide their location while offering services through Tor. Both the user and server remain anonymous.
duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion
This is DuckDuckGos official onion service. The 56-character address is derived from the services public key.
How Hidden Services Work
- Introduction Points: The hidden service selects relays to act as introduction points and publishes their addresses
- Descriptor Publication: Service details are published to a distributed hash table (DHT)
- Client Lookup: User downloads the descriptor and creates a circuit to an introduction point
- Rendezvous: Both parties meet at a "rendezvous point"—a relay chosen by the client
- Communication: All traffic flows through the rendezvous point, both sides anonymous
Limitations & Weaknesses
Known Attack Vectors
- Traffic Correlation: An adversary controlling both entry and exit can correlate timing to deanonymize users
- Sybil Attacks: Running many malicious relays to increase chances of controlling a circuit
- Exit Node Sniffing: Exit nodes can see unencrypted traffic (use HTTPS!)
- Browser Exploits: JavaScript vulnerabilities have been used to deanonymize users (e.g., FBI vs. Freedom Hosting)
- Timing Attacks: Precise timing analysis can link entry and exit traffic
Critical: Tor provides strong anonymity but is not bulletproof. Operational security mistakes—reusing usernames, logging into personal accounts, or downloading files—have led to most arrests, not Tor vulnerabilities.
Network Statistics (2025)
Current Network Status
| Total Relays | ~6,500 |
| Daily Users | ~2,500,000 |
| Total Bandwidth | ~700 Gbit/s |
| Onion Services | ~65,000 |
| Countries with Relays | 50+ |
Source: Tor Project Metrics (metrics.torproject.org)