How Does Tor Work? Onion Routing in Plain English

If you've ever wondered how Tor works, the answer is a clever idea called onion routing. Instead of connecting you directly to a website — which reveals your IP address — Tor bounces your traffic through a chain of volunteer-run servers and wraps it in layers of encryption, so no single point in the chain knows *both* who you are and what you're doing.

This is a beginner-friendly walkthrough of the whole journey, drawing on the Tor Project's own documentation and the underlying onion routing research.

The Three Relays: Guard, Middle, and Exit

Every standard Tor connection is routed through a circuit of three relays:

  • Guard (entry) relay — the first hop. It knows your real IP address, but not which site you're visiting.
  • Middle relay — a blindfolded courier. It only knows it received data from the guard and must pass it to the exit; it knows neither you nor your destination.
  • Exit relay — the final hop. It knows the destination website, but not who you are.

    • Because no single relay sees the full picture, your identity and your activity are cryptographically separated. This separation is the heart of how Tor anonymises you, and it's maintained by thousands of volunteer relays tracked on the Tor Metrics portal.

    The "Onion": Layered Encryption

    Before your data leaves your device, Tor wraps it in three layers of encryption — one per relay. As the packet travels:

    You  ->  [Guard peels layer 1]  ->  [Middle peels layer 2]  ->  [Exit peels layer 3]  ->  Website

    Each relay removes exactly one layer, revealing only the address of the *next* hop. Like peeling an onion, no relay can see the layers beyond its own — which is why it's called The Onion Router (Tor).

    What Is a Tor Exit Node — and What Can It See?

    A Tor exit node is the last relay before your traffic reaches the open internet — the most misunderstood part of the circuit.

  • The exit node can see the destination and, if the connection is unencrypted (plain HTTP), the content of your traffic.

  • The exit node cannot see your real IP address or identity.

    • This is why HTTPS matters even on Tor: with HTTPS, the exit node sees only *that* you're talking to a site, not *what* you're saying. A malicious exit running traffic analysis is a real, documented threat — one more reason to keep the security slider on "Safest" (see is the Tor Browser safe) and avoid logging into personal accounts.

    Hidden Services: When There's No Exit Node at All

    When you visit a .onion site, your traffic never leaves the Tor network — there's no exit node exposed to the clearnet. Instead, you and the server each build circuits that meet at a rendezvous point, so *neither side learns the other's IP address*. This is what makes hidden services anonymous for the operator too. The full mechanism — introduction points, rendezvous circuits, and the v3 address format — is in our Tor v3 hidden services guide.

    New Circuits and Identity Rotation

    Tor builds a new circuit roughly every 10 minutes for general browsing, so your traffic isn't permanently tied to one path. You can also request a brand-new identity at any time, which tears down existing circuits and builds fresh ones.

    Who Runs Tor?

    Tor is free, open-source software maintained by the non-profit Tor Project, and the network itself is run by thousands of volunteers who operate relays worldwide. Its origins trace back to onion routing research at the U.S. Naval Research Laboratory — the full history is in who created the dark web. Crucially, no single party controls the network, which is part of why privacy advocates like the EFF trust and support it.

    What Tor Protects — and What It Doesn't

    Tor hides:

  • Your IP address from the sites you visit

  • The sites you visit from your ISP and local network

  • Your location and network identity from any single relay

    • Tor does NOT hide:

  • Information you personally reveal (logins, real names, photos with metadata)

  • Malware you download and run

  • The fact that you're *using Tor* from your ISP — for that, use bridges

Bridges and Censorship Circumvention

If your government or ISP blocks Tor, use bridges and pluggable transports — unlisted entry points that disguise Tor traffic so you can connect even where Tor is censored, without revealing that you're using it. The Tor Project's support pages walk through requesting them, and the EFF's Surveillance Self-Defense covers when you need them.

How Tor Works FAQ

How does Tor work in simple terms? It encrypts your traffic in layers and routes it through three relays — guard, middle, exit — so no single hop knows both your identity and your destination.

What does a Tor exit node see? The destination of your traffic (and unencrypted content), but not who you are. Use HTTPS.

Is Tor completely anonymous? It's strong, but not automatic — you can still expose yourself through logins, downloads, or an outdated browser. See safe browsing OpSec.

Is Tor illegal? No — it's legal in most countries and used by journalists, activists, and ordinary people. See is the dark web illegal.

Is Tor the same as a VPN? No — a VPN is one trusted party; Tor distributes trust across three independent relays for stronger anonymity.

Bottom Line

How does Tor work? It layers encryption and routes your traffic through three relays so no single hop knows both who you are and where you're going. A Tor exit node sees where your traffic goes but not who you are; hidden services skip the exit entirely so both sides stay anonymous. The network is robust — but your anonymity still depends on the discipline you bring to it.