VPN vs Tor: What Each Hides and When to Combine Them

A VPN sends your traffic through one company’s server. Your network cannot read it, and websites see the server’s IP, but that company sees where it goes. Tor routes it through at least three volunteer relays, so no single party sees both who you are and what you visit. A VPN suits everyday privacy. Tor is built for anonymity.

Tor is a network of relays run by volunteers, which you use through Tor Browser. A relay is a computer that passes traffic on to the next one. An IP address is the number that identifies your internet connection.

How a VPN and Tor each work

A VPN app opens an encrypted tunnel from your device to a server the provider runs. Every connection you make comes out of that server. Your internet provider, your employer’s network or the café’s Wi-Fi sees only encrypted traffic to one address. Websites see the VPN server’s address instead of yours. But the provider’s server decrypts the tunnel. So the provider knows your real IP address and every destination you connect to. This is true even when HTTPS keeps the content itself private. HTTPS is the encryption behind the lock icon in your browser. Our pages on what a VPN is and how a VPN works cover the mechanics in more depth.

Tor works differently. Tor Browser builds a circuit, a path through at least three relays run by volunteers. It wraps your traffic in a separate layer of encryption for each relay. The Tor Project describes the result. A bad first relay can see encrypted Tor traffic coming from your computer. It learns only that your IP address is using Tor. A bad third relay, called the exit, can see the traffic you sent into Tor but not who sent it. With HTTPS, it learns only the destination. No single relay, and no single operator, holds both halves.

Onion services go further. These are the addresses ending in .onion. They are reachable only inside the Tor network. The connection is encrypted end to end, from the Tor software on your device to the service. There is no exit relay at all.

What each hides, and from whom

The useful comparison is not which tool is “more private”. It is who can see what. The table is the threat model for a VPN on its own and for Tor Browser on its own. A threat model lists who might watch you and what each of them can see.

The difference comes down to trust. The Tor Project’s own comparison says a single proxy or VPN “creates a single point of trust and failure”. That is because the provider knows both who you are and what you browse. With a VPN, you move your trust from your ISP to one company. So two things matter. The first is whether its no-logs policy has been independently examined. A no-logs policy is a promise not to record what you do. The second is which jurisdiction can compel it, meaning which country’s laws apply to it.

The Tor Project’s wiki adds a second point. Most providers keep some records, and “there is a money trail” unless you can pay anonymously. That is why Mullvad issues numbered accounts with no email address and accepts cash by post. It is also why IVPN uses random account IDs and takes cash and Monero. Monero is a cryptocurrency designed for privacy. Both are recorded in our provider data on 31 October 2026. Those steps narrow the trail, but the provider still sees the traffic.

Tor removes the single point of trust by design. It does not remove these:

• the exit relay’s view of unencrypted traffic
• a website’s ability to recognize and block Tor exits
• anything you reveal yourself by logging in

Speed and usability

Each Tor circuit crosses three relays chosen from a volunteer network. So every request travels further, through machines nobody is paid to keep fast. Some sites block Tor exits or add challenges. The problem is common enough that the Tor Project keeps a support article on websites blocking access over Tor. A VPN is one hop to a commercial server, with apps on every platform. Streaming and gaming are ordinary uses. Whether a given service works is the provider’s documented claim, not a guarantee. We have not yet tested the throughput, or speed, of either in our lab, so this page makes no speed claims. Our how we test page explains what the lab will measure.

Onion over VPN and VPN over Tor

There are two ways to chain them, and they protect against different things.

Tor over VPN, also sold as Onion over VPN, means you connect to the VPN first and then open Tor. The path is you, then the VPN server, then the three Tor relays. Your ISP sees only a VPN connection. The Tor entry relay sees the VPN server’s IP address instead of yours. The Tor Project’s wiki notes that this might stop your ISP from seeing that you use Tor. It notes that it does stop Tor from seeing who you are. But the wiki says this assumes the VPN provider’s network “is in fact sufficiently safer than your own network”. The VPN provider now knows you use Tor, even if it cannot see what you do inside it.

As of 31 October 2026, NordVPN is the only one of the twelve providers we track whose data record documents a Tor-over-VPN server type. Its Onion Over VPN servers route traffic through a NordVPN server and then into the Tor network. NordVPN’s help center describes the feature as mixing VPN encryption with the Tor network. Its December 2024 Deloitte no-logs assurance engagement covered the Onion Over VPN servers as well as the standard ones. In that kind of engagement, an outside firm checks the provider’s no-logs claim.

One caveat applies to every such feature: it changes the network path only. Everything that identifies you inside the browser stays the same. That includes logins, cookies and the browser’s fingerprint, the mix of settings that makes it recognizable. This is why the Tor Project’s guidance assumes you are using Tor Browser.

VPN over Tor reverses the order. You connect to Tor first and then to a VPN through it, so the VPN server acts as a fixed exit. The Tor Project’s wiki describes the trade-offs of this setup. You get to choose your exit. But the wiki also lists these drawbacks:

• You must pay for the VPN anonymously.
• The VPN has to run in TCP mode. TCP is the method that confirms each packet arrives.
• Establishing the connection is “chancy”.
• You create a bottleneck where one company can build a profile of everything you do.

None of the twelve provider records we maintain documents a VPN-over-Tor configuration, and we do not recommend one.

The Tor Project gives its overall position on its support site. Combining a VPN with Tor can reduce anonymity or break Tor’s protections if it is misconfigured. The Tor Project does not recommend it unless you are an advanced user who knows how to configure both. If your goal is extra hops without Tor, a double VPN is the simpler option. A double VPN sends your traffic through two VPN servers in a row. If you are weighing a VPN against a plain proxy, see VPN vs proxy.

Which should you use?

• Everyday privacy: use a VPN. This covers public Wi-Fi, hiding your browsing from your ISP and appearing in another country for streaming. Our best VPNs for privacy page ranks providers on audits, jurisdiction and payment options.
• Anonymity from the site you are visiting: use Tor Browser on its own. The same goes for reaching .onion services, or for research where the destination must not learn who you are.
• Hiding Tor use from your network: try Tor’s own bridges first. Connecting to a VPN first is the alternative, with the trust shift described above.
• Torrenting: never over Tor, which is a volunteer network not built for bulk transfer. Use a VPN with a working kill switch. A kill switch blocks your internet if the VPN connection drops. See best VPNs for torrenting.
• Both at once: only if you understand what each layer adds. Use Tor Browser, not an ordinary browser pointed at an Onion server.

Our reviews hub lists every provider on our site, with the data record behind each page. More explainers are in the Learn hub.

Related

• What is a VPN?
• How does a VPN work?
• VPN vs proxy
• Double VPN explained
• No-logs policies explained
• Five, Nine and Fourteen Eyes
• Best VPNs for privacy
• All VPN reviews