Back to blog

Blog Post

How Tor Works

Share on social

Apr 26, 2022

Lorem ipsum

Table of contents

Share on social

Join the newsletter
How Tor Works

[What Is Tor?]

the onion router (tor) is one of the most commonly used dark web networks

What is tor?

Tor is a privacy network and free browser software that enables more anonymous internet activity than standard web browsers. It also hosts sites that are inaccessible through standard web browsers, known as hidden services or onions. Tor achieves this anonymization via a process called onion routing. Originally developed at the U.S. Naval Research Lab to enable secure communication, Tor is now maintained and managed by a non-profit organization called The Tor Project with thousands of relays – also called nodes – all over the world.

How does Tor Work?

When using a standard browser, the user's computer encrypts their data to be sent into packets and makes a direct TCP connection, also known as a TCP handshake, with the website's server before the data is decrypted. This direct connection enables any observers, such as the user's internet service provider (ISP) or the website's owners, to view the user's IP address and by extension their location. This method of sending and receiving data is used as it is fast and simple.

When using Tor to access a website, data is encrypted in multiple layers – like an onion – before being sent through a networking protocol known as onion routing. Unlike a standard HTTPS connection, onion routing works by sending the packets of encrypted data through multiple servers, also called relays or nodes. These nodes are located and maintained worldwide, thus obscuring the user's true location. As the data passes through each node, a single layer of encryption is removed. When the data eventually reaches the website’s server, its original location cannot be viewed, protecting user anonymity.

[Who Uses Tor & Beyond]

Who Uses Tor?

There are several reasons why someone would choose to use the Tor network, though use cases can generally be categorized into three main groups. The first user group can be classed as privacy advocates who, while not necessarily doing anything untoward, feel strongly about the increasing levels of surveillance in the modern world, be it at the hands of governments or other powerful actors such as corporations. These netizens use Tor in order to minimize the extent to which their data and internet use is observed or harvested.

The second user group of Tor, and arguably the most well-known, is comprised of criminal actors, including fraudsters, hackers, drug dealers, and those producing, distributing, or consuming CSEA (child sexual exploitation and abuse) content. The relative anonymity conferred by Tor lends itself to these actors’ need to evade detection by law enforcement while still operating fairly openly. Though some of the user base in this group perpetrate scams, relying on Tor's anonymity and the lack of legal recourse available to those seeking or selling illicit goods and services, the majority of buyers and vendors on dark web markets are genuine. As well as online marketplaces, this subset of Tor users often congregate on dark web forums, to take part in discussions, knowledge sharing, and reviews relevant to their particular criminal niche.

The final typology of Tor users are those attempting to evade government censorship of the internet, in countries where access to information and self expression online is tightly controlled by the state. In China, for example, many foreign websites are restricted by the “Great Firewall”. In order to circumvent these restrictions, netizens can use the Tor network to access blocked sites and criticize their government relatively freely, as well as engaging in whistleblowing activities such as sending documents securely to journalists.

Other dark webs

While the most popular and populous, Tor is not the only privacy network that enables users to access the “hidden” spaces of the dark web. Other examples of privacy networks that work to achieve the same goal – protecting the user’s anonymity – include the Invisible Internet Project (I2P), Zeronet, Freenet and BitBazaar.

Dr. Gareth Owenson

Author

Dr. Gareth Owenson

CTO and Co-Founder at Searchlight Cyber

Dr. Gareth Owenson is the CTO and Co-Founder of the company Searchlight Cyber, a leader in preemptive cybersecurity. Gareth completed his Ph.D. in Computer Science in 2007 and is a world leader in Tor dark web research. He advises governments, military, and law enforcement on dark web technologies and guides the development of a suite of technologies that have put Searchlight Cyber in the forefront of criminal investigative and intelligence efforts. Gareth co-founded Searchlight Cyber in 2017 to help governments, law enforcement – and today that same attacker intelligence is used by enterprises worldwide to see what attackers are planning and take preemptive action.

Related Blog Posts

August 13, 2026

Phishing and Takedown now managed entirely in Monitor

August 6, 2026

How to Measure Preemptive Threat Exposure Management (PTEM) Success

August 5, 2026

August 4th – This Week’s Top Cybersecurity and Dark Web Stories

July 31, 2026

How Does Preemptive Threat Exposure Management Improve Exposure Prioritization?

July 29, 2026

July 28th – This Week’s Top Cybersecurity and Dark Web Stories

July 24, 2026

Preemptive Threat Exposure Management: Frequently Asked Questions

Never miss a beat

Get all news and updates about Searchlight Cyber, directly in your inbox.

Subscribe
Please enter a valid email address.
Background Gradient