Definition

TOR (The Onion Router) is a privacy-focused network design that sends your traffic through multiple intermediary relays. Instead of one direct path between you and a destination, TOR uses layered encryption so that each relay only knows limited information.

A simple model of how it works

Think of TOR as building a temporary “circuit” for a specific connection.

  1. When you start a connection, TOR chooses several relays in sequence.
  2. Your client wraps the data in multiple encryption layers (the “onion”).
  3. Each relay removes only one layer and forwards the data to the next relay.
  4. The final relay sends the data toward the destination (and handles responses in the reverse direction).

Because each relay only sees what comes from the previous hop and where it sends the next hop, no single relay should automatically know both the original source and the final destination at the same time.

What TOR protects—and what it doesn’t

TOR’s design is meant to reduce straightforward tracing through intermediate hops, but it is not a guarantee of “invisibility.” Key limits include:

  • Endpoint information still matters. If the starting device or the browser reveals identifying details (for example through account logins, unique settings, or unsafe behavior), the network layer can’t fully prevent that.
  • Correlation is possible in principle. Observers with some capability over traffic timing or patterns may attempt to link activity, especially if multiple points are observed.
  • Traffic outside the TOR model is a risk. If other connections or identifiers bypass the TOR circuit, or if DNS resolution is handled in a way that leaks information, anonymity can be reduced.

So, TOR can make tracing more difficult through relay intermediaries, but it can’t eliminate all ways activity could be connected to a person or device.

Practical checks you can do

To evaluate how well TOR fits your needs, focus on controllable factors rather than absolute promises:

  • Use the intended TOR browser setup rather than mixing identities or accounts with normal, identifying sessions.
  • Avoid activities that recreate your identity (for instance, logging into accounts you use elsewhere in the same recognizable way).
  • Watch for leaks caused by misconfiguration—for example, connections that appear to bypass TOR.
  • Assume software and behavior matter: privacy improvements depend on safe endpoint use as much as on relay routing.

Differences from a typical VPN-style idea

A VPN generally creates a protected tunnel between you and a provider-side endpoint, leaving less visible internal relay structure for intermediaries. TOR, by contrast, intentionally uses multiple relays and layered encryption so that each hop has only partial visibility. That difference affects threat models: TOR is designed around reducing linkage across hops, while VPN approaches often concentrate on protecting a single path to a provider.

If your goal is understanding “how it works,” the core takeaway remains the same: TOR routes through multiple relays with layered encryption, but the security you get also depends on how your device, browser, and connections behave at the endpoints.