Combining Tor and VPN for unmatched online privacy | The Independent (2024)

In the pursuit of online privacy, two tools often take centre stage: The Onion Router (Tor) and Virtual Private Networks (VPNs). Individually, both offer significant advantages.

Tor enables anonymous communication, while VPNs protect your data by encrypting your online activity and hiding your real IP address. However, combined, they form a powerful shield for enhancing online security and anonymity, safeguarding users from data breaches and other cyberthreats.

In this article, we explore the benefits of using Tor and VPN together, explain their operation, and guide you through the setup process. We also debunk some common myths surrounding their combined usage.

Tor is a powerful, open-source tool designed to facilitate anonymous online communication. It uses a multi-layered routing strategy to mask your online activities, making them much more difficult to trace.

How Tor works

When you access the internet through Tor, your traffic doesn’t take a direct route to its destination. Instead, it’s sent on a zigzag path through multiple randomised nodes, giving Tor its distinct layering effect, akin to the layers of an onion.

When you initiate a request, Tor wraps it in three layers of encryption. This request then travels through at least three servers or nodes: the entry node, the relay node and the exit node.

• Entry node: Your encrypted traffic first reaches an entry node. While this node can see your real IP address, it can’t read your encrypted data. It removes one layer of encryption and forwards your data to the next stage.
• Relay node: The relay, or middle, node receives the partially decrypted data. It doesn’t know your real IP address or your request’s final destination. The relay node strips away another layer of encryption and sends your data to the final stage.
• Exit node: The exit node removes the last layer of encryption. It can see where your traffic is going and its content without knowing its origin. The exit node sends your unencrypted data to its final destination.

Tor is generally accessed through the Tor Browser, which is optimised for heightened security and privacy. Although the system is slower due to its complex routing process, it remains an effective tool for anonymising your internet traffic.

The role of VPNs

VPNs play a significant role in encrypting and tunnelling internet connections. They function by creating a secure, private tunnel between your device and the internet. All data that passes through this tunnel is encrypted, which makes it unreadable to anyone who might intercept it, including your internet service provider (ISP) or potential hackers.

Unlike Tor, which is a free and open network, a VPN is typically a paid service (although there are free VPN options) and all your data is routed through the VPN’s servers. Reliable VPN providers do not keep any user logs to maintain privacy.

Individual benefits

Both Tor and VPN have their advantages and potential limitations. Tor’s strength lies in its ability to anonymise internet traffic effectively. However, it can be slower and less efficient due to its routing process. Also, by default, Tor only protects your browsing data, not applications running on your device.

On the other hand, a VPN offers comprehensive encryption of all your internet data and is typically faster than Tor. However, it entails entrusting the VPN provider with all your data going through its servers. It’s also important to note that, while both tools significantly enhance online privacy, neither provides 100 per cent guaranteed anonymity.

Pairing Tor and a VPN leverages the unique strengths of both tools, creating a robust shield for your online privacy and security. While Tor provides unparalleled anonymity by routing your traffic through multiple nodes, a VPN complements this by encrypting your entire network connection, cloaking your digital activities.

Combining Tor and VPN can slightly impact browsing speeds due to the additional encryption. But if you prioritise utmost privacy and security over speed, this minor inconvenience is a small price to pay.

There are two common ways to use Tor and VPN together:

Tor over VPN: Best for enhanced privacy

With the Tor over VPN method, you first connect to a VPN, then to the Tor network. This approach offers a significant benefit; the VPN encrypts the data before entering the Tor network. Thus, your real IP address is masked with the VPN’s IP address, adding an extra layer of security and privacy.

The benefits of this approach are:

• Your ISP can’t see that you’re accessing the Tor network, which enhances your privacy.
• The Tor entry node doesn’t see your real IP address, which adds another layer of anonymity.

VPN over Tor: Best for strengthened anonymity

The VPN over Tor method works the other way around: You first connect to Tor, then to the VPN. This method offers the following advantages:

• It permits access to sites that disallow connections from known Tor exit nodes.
• The VPN provider can’t see your real IP address but only that of the Tor exit node, offering even more anonymity.
• All your VPN traffic passes through the Tor network, providing comprehensive coverage.

Although it offers enhanced anonymity, we don’t recommend the VPN over Tor method. It involves first connecting to the Tor network, followed by the VPN. However, such a set-up reintroduces an element of trust into an otherwise trustless situation, as your VPN service could see your traffic.

While it’s true that a VPN that does not keep activity or connection logs may be trusted with this information, the trade-off is the additional complexity and slower speeds due to routing through the Tor network. Here are a few points to consider:

• You can access sites that block connections from known Tor exit nodes
• The VPN provider only sees the IP address of the Tor exit node, not your actual one
• All VPN traffic goes through the Tor network, offering comprehensive coverage

However, we caution against this method due to these significant concerns:

• It could considerably slow down your VPN
• Additional configuration may be required, potentially needing technical knowledge and patience
• The VPN provider, instead of the Tor exit node, would be able to see your traffic, negating some anonymity benefits

In both configurations, trust in your VPN provider remains essential. An audited no-logs VPN provider can add a significant layer of security, ensuring that your online activities remain private and secure.

Setting up Tor and VPN together, commonly known as Tor over VPN or Onion over VPN, ensures high privacy protection. Here’s a straightforward guide to get you started:

Step 1: Install VPN client

Download and install the VPN client on your device. Many providers offer clients for various operating systems, including Windows, MacOS, Linux, Android, and iOS.

Step 2: Connect to a VPN server

Launch your VPN client and connect to a server. To optimise connection speed, select a server closest to your location.

Step 3: Download and install the Tor browser

The Tor Browser is free to download and install. It’s available for various operating systems and even as a portable version.

Step 4: Launch the Tor browser

Once you’ve connected to your VPN, open the Tor Browser and connect to the Tor network.

You’re now using Tor over VPN, providing an extra layer of security and privacy. This method obscures your home IP address, ensures encrypted traffic, and enables access to the Tor network even where it may be blocked.

We highly recommend using the following VPNs for the optimal Tor over VPN setup:

• NordVPN: A top-tier choice for Tor browsing with high-grade encryption and impressive speed
• Surfshark: A cost-effective solution offering robust security measures and unlimited device connections
• ExpressVPN: Noted for its superior security and high-speed servers, it provides a seamless Tor browsing experience
• CyberGhost: Best for high-speed servers and user-friendly apps, it’s ideal for speedy browsing on Tor

When using Tor and VPN together, there are some key points to keep in mind to ensure the most secure and efficient browsing experience.

Regularly update

Keep both your VPN and Tor software up to date. Updates often include important security patches and performance improvements.

Choose reputable providers

Not all VPNs are created equal. Stick with trusted providers known for strong security measures, no-log policies, and high-speed servers. While there are some decent cheap VPNs out there, pay for the level of security with which you feel comfortable.

Consider performance impact

While providing an extra layer of security, the combined use of Tor and VPN can significantly impact your internet speed. Be prepared for slower load times.

Protect against IP leaks

Use the features of your VPN, such as the kill switch, to ensure that your IP address isn’t exposed.

Remember, no solution offers 100 per cent security or anonymity. Always exercise caution and make informed choices about your online privacy and security.

Illegality

A prevalent misconception is that the combined usage of Tor and VPN is illegal. In reality, using these tools for privacy and security is perfectly legal in most jurisdictions. However, the content accessed and actions taken while using these tools must comply with local laws.

Complete anonymity

Another common myth is that Tor over VPN makes you completely anonymous. While this setup greatly enhances your privacy, no tool can provide absolute anonymity. Your behaviour online, your device’s security and your VPN provider’s policies all play a crucial role in maintaining your privacy.

Pairing Tor and VPN is a viable way to improve online privacy. The optimal method is to use Tor over VPN, which entails connecting to a robust VPN service, such as NordVPN, before launching the Tor browser.

Remember that this layering of security tools might affect your internet speed due to the enhanced encryption process. Despite this, the trade-off is worthwhile for an increased layer of privacy.

You don’t need to worry about legal issues when using Tor and a VPN together, as it is entirely legal. However, updating both applications to ensure maximum security benefits is essential.