> ## Content Index
> Fetch the complete content index at: https://news4cyber.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# How Does the Tor Network Work? A Visual Guide to Onion Routing
- URL: https://news4cyber.com/how-does-the-tor-network-work/
- Published: 2026-10-13T17:38:18.000Z
- Updated: 2026-10-13T17:38:18.000Z
- Description: Follow a request through Tor, peel back its encryption layers, and discover what relays can see—with interactive diagrams and a practical Wikipedia example.
- Author: WoodPecker

NETWORK PRIVACY / VISUAL EXPLAINER

One request. Three relays. No single complete view.

What happens between clicking a link in Tor Browser and seeing a page? Follow Alice’s request, unwrap its protective layers, and discover where privacy comes from—and where it can end.

Beginner friendly6 visual chaptersInteractive diagrams

[01 · What is Tor?](#tor-what)[02 · Onion routing](#tor-layers)[03 · Three relays](#tor-relays)[04 · Follow Alice](#tor-example)[05 · HTTPS](#tor-https)[06 · Onion services](#tor-onion)

## 1\. What Is Tor?

**Tor (The Onion Router)** is a privacy network that forwards traffic through relays operated by volunteers. Instead of connecting directly to a website, your client uses a circuit of relays to make linking your network address to your browsing destination more difficult. See [What is Tor?](https://support.torproject.org/about-tor/introduction/what-is-tor/?ref=news4cyber.com).

Onion routing began as research at the US Naval Research Laboratory in the 1990s: could a network carry communications without revealing who was communicating with whom? Tor developed from that work into an open-source project. Read the [Tor Project history](https://www.torproject.org/about/history/?ref=news4cyber.com).

### The network

The distributed relays and protocols that carry traffic.

### The browser

Tor Browser is a modified Firefox-based browser configured to use Tor, with additional privacy protections. It is the accessible way to browse through the network. See [About Tor Browser](https://support.torproject.org/tor-browser/getting-started/about-tor-browser/?ref=news4cyber.com).

Legitimate uses include everyday privacy, sensitive research, journalism, and accessing information where censorship blocks it. These uses depend on separating the origin of a connection from its destination.

### A direct connection

1. **User**
2. **ISP**
3. **Website**

Your Internet service provider carries the connection toward the website. HTTPS can protect its contents, but does not conceal every piece of connection metadata.

### A connection through Tor

1. **User**
2. **Guard**
3. **Middle**
4. **Exit**
5. **Website**

This diagram shows an ordinary Internet website reached through Tor. Your ISP still carries your connection to Tor; it has been omitted here to emphasize the relay circuit. Onion services use a different path, introduced in chapter 6.

## 2\. How Onion Routing Works

Imagine a message inside three nested envelopes. The outer envelope can be opened by the guard, the next by the middle relay, and the innermost by the exit. Each opening reveals just the material needed for the next stage.

In the actual protocol, the client builds a circuit and negotiates separate keys with its relays. Outgoing data carried in relay cells receives layers of encryption. A relay processes its own layer and forwards the remaining protected data. The envelopes below are a teaching analogy, rather than a literal packet format or a description of the key exchange. See the [Tor protocol introduction](https://spec.torproject.org/intro/index.html?ref=news4cyber.com) and [relay-cell routing specification](https://spec.torproject.org/tor-spec/routing-relay-cells.html?ref=news4cyber.com).

### Peel the layers, one relay at a time

Next relay →Reset layers

Three nested encryption layers: guard, middle and exit, around application data1 · Guard layer2 · Middle layer3 · Exit layerApplication data 

At Alice: three Tor layers protect the outgoing data.

Static reading: Alice adds three layers → guard removes one → middle removes one → exit removes the last. If Alice uses HTTPS, the application data remains protected by TLS after the Tor layers are removed.

**Separate pieces of the puzzle.** A relay normally learns its immediate neighbors and the information required for its role. No single relay normally learns both the client’s IP address and the final Internet destination. This does not rule out attacks that combine observations from multiple locations.

## 3\. The Three Tor Relays

A typical circuit to an ordinary website has a guard, a middle relay, and an exit. Select a relay below with a mouse, touch, or the keyboard.

1. **Alice**
2. **Guard**Explore relay
3. **Middle**Explore relay
4. **Exit**Explore relay
5. **Website**

**Explore the circuit.** Choose a relay; its full description is also available below.

Cyan = guard · purple = middle · amber = exit. Labels carry the same information as color.

Guard Relay — the first hop

The guard receives Alice’s connection and knows her source IP address. It forwards protected data to the middle relay and normally does not know the final site. Guards are kept for a persistent period to reduce exposure to potentially malicious entry relays, rather than being replaced with every page load. See [Understanding guard relays](https://support.torproject.org/tor-browser/security/guard-relay/?ref=news4cyber.com).

Middle Relay — the separating hop

The middle links the guard to the exit. It sees its adjacent relays, but normally neither Alice’s IP address nor the final destination. Its role helps separate the circuit’s two ends.

Exit Relay — the connection to the web

The exit opens a connection to the ordinary website. It knows the external destination and accessible connection metadata, but normally not Alice’s real IP address. Unencrypted HTTP data can be read or altered here. With valid HTTPS, TLS protects the application content between Alice’s browser and the website, including against the exit. Routing roles: [Tor protocol introduction](https://spec.torproject.org/intro/index.html?ref=news4cyber.com); content protection: [Secure connections in Tor Browser](https://support.torproject.org/tor-browser/features/secure-connections/?ref=news4cyber.com).

## 4\. Concrete Example: Visiting Wikipedia Through Tor

**A fictional walkthrough:** Alice lives in Paris and wants to read Wikipedia in Tor Browser. We use `https://www.wikipedia.org/`, an ordinary Internet address. Relay locations and identities are deliberately unspecified; Tor circuits are not selected as a simple geographic itinerary.

1. Alice opens Tor Browser and connects to Tor.
2. Her client establishes a circuit using relay information and cryptographic handshakes.
3. The request enters the guard.
4. The middle forwards it along the circuit.
5. The exit processes the final Tor layer.
6. The exit contacts Wikipedia; Alice’s browser and the site communicate using HTTPS through that connection.
7. Wikipedia’s reply travels back through the exit, middle, and guard to Alice.

### Follow the request and the response

1. **Alice**
2. **Guard**
3. **Middle**
4. **Exit**
5. **Wikipedia**

Play journeyNext stepReset journey

Ready: Alice opens Tor Browser. The arrows show the outgoing request; the response follows the reverse path.

A conceptual animation, not a live Tor connection or packet capture. Outgoing and returning traffic use the circuit in opposite directions. Protocol background: [Tor protocol introduction](https://spec.torproject.org/intro/index.html?ref=news4cyber.com).

__Who normally sees what in this example?__
| Actor                     | Normally visible information                                                                                    |
| ------------------------- | --------------------------------------------------------------------------------------------------------------- |
| Internet service provider | A connection to Tor, with timing and volume, unless special concealment mechanisms make it harder to recognize. |
| Guard relay               | Alice’s source IP address and its adjacent middle relay.                                                        |
| Middle relay              | The adjacent relays on the circuit.                                                                             |
| Exit relay                | The external destination and accessible metadata; HTTPS content remains encrypted.                              |
| Wikipedia                 | The exit relay’s IP address, plus the requests it receives and any information Alice supplies.                  |

**An IP address is only one identifier.** Signing into a personal account, sending identifying information, or presenting recognizable cookies can identify Alice independently of her IP address. Tor Browser limits some tracking, but it cannot make a logged-in account anonymous to its own website. See [Tor Browser best practices](https://support.torproject.org/tor-browser/security/using-tb-safely/?ref=news4cyber.com).

## 5\. What Happens When You Use HTTPS?

Tor separates the network origin from the destination. HTTPS protects the application conversation and authenticates the site through a valid TLS connection. These protections work together. Tor Browser includes HTTPS-Only Mode, which favors HTTPS when available. See [Secure connections in Tor Browser](https://support.torproject.org/tor-browser/features/secure-connections/?ref=news4cyber.com).

### Tor + HTTP

1. **Alice**
2. **Guard**
3. **Middle**
4. **Exit**
5. **Website**

Tor circuit protection: Alice → exitExit → website: HTTP content exposed

The exit must handle the unencrypted HTTP stream. It can potentially inspect or change page content, submitted forms, and other HTTP data. Tor’s relay encryption does not extend to the ordinary website.

### Tor + HTTPS

1. **Alice**
2. **Guard**
3. **Middle**
4. **Exit**
5. **Website**

Tor circuit protection: Alice → exitHTTPS / TLS protection: browser → website

The exit forwards TLS-protected bytes. With a valid TLS connection, it cannot read the HTTP path, page contents, passwords, or cookies inside that stream. The website decrypts the application data at its TLS endpoint.

HTTPS does not hide all metadata from the exit: the destination IP address, connection timing and volume remain observable; the hostname is often available through connection setup or DNS. It also does not prevent the destination website from reading what you send to it. Never treat a certificate warning as a harmless formality.

## 6\. What Are Onion Services?

An onion service uses a `.onion` address and is reached inside Tor. Unlike an ordinary website reached through an exit, the service also builds Tor circuits. This can protect its network location as well as the client’s. Modern onion addresses are tied to the service’s cryptographic identity. See [What are onion services?](https://support.torproject.org/about-tor/onion-services/what-is-a-dot-onion/?ref=news4cyber.com).

### Meet inside Tor

1. **Tor client**
2. **Client circuit**
3. **Rendezvous**
1. **Rendezvous**
2. **Service circuit**
3. **Onion service**

Client Tor → circuit Tor → rendezvous point ← circuit Tor ← onion service. Each “circuit” represents multiple relays. The repeated rendezvous box represents the same meeting point, not two different relays.

### Introduction point

A contact point advertised by the service. The client uses an introduction to tell the service how to join a chosen rendezvous point.

### Rendezvous point

The relay where the client and service circuits meet. It carries their traffic without needing to learn both endpoints’ real IP addresses.

The service sets up introduction points and publishes a descriptor that lets a client find them. The client selects a rendezvous relay, then sends an introduction through an introduction point. The service builds its own circuit to the rendezvous. Once connected, application traffic goes through the rendezvous rather than through the introduction point. See [How onion services work](https://community.torproject.org/onion-services/overview/index.html?ref=news4cyber.com).

**No ordinary exit relay.** Traffic stays within Tor’s onion-service connection instead of leaving through an exit to the public Internet. The onion-service protocol provides encryption and authenticates the service associated with the onion address. Verify that you obtained the intended address from a trustworthy source. See [onion-service security properties](https://onionservices.torproject.org/technology/properties/?ref=news4cyber.com).

__Two ways to reach a website using Tor__
| Property           | Ordinary website                | Onion service                               |
| ------------------ | ------------------------------- | ------------------------------------------- |
| Address            | For example, wikipedia.org      | A .onion address                            |
| Connection         | Client circuit → exit → website | Client and service circuits meet inside Tor |
| Content protection | Use valid HTTPS to the site     | Onion-service encryption and authentication |
| Service location   | Public Internet infrastructure  | Can remain concealed from the client        |

## Check Your Understanding

Try answering before opening each explanation.

Does the guard normally know which Wikipedia page Alice reads?

No. It knows Alice’s source IP address and forwards layered traffic to the next relay. It does not normally learn the final website or page.

Can an exit read an HTTPS password?

With a valid TLS connection, the password is protected until it reaches the website. An unencrypted HTTP password would be exposed.

Does an onion service use a normal exit?

No. Client and service circuits meet at a rendezvous point inside Tor.

**Keep the limits in view.** Tor is designed for privacy, with no guarantee of perfect anonymity. An adversary observing both ends may correlate traffic timing and volume. Compromised devices and identifying behavior also bypass the protection of network routing. Running Tor Browser does not automatically route every application on your computer through Tor. See [Tor Browser best practices](https://support.torproject.org/tor-browser/security/using-tb-safely/?ref=news4cyber.com) and [attacks that remain against onion routing](https://support.torproject.org/about-tor/security/attacks-on-onion-routing/?ref=news4cyber.com).

Further reading: [What is Tor?](https://support.torproject.org/about-tor/introduction/what-is-tor/?ref=news4cyber.com), [Understanding guard relays](https://support.torproject.org/tor-browser/security/guard-relay/?ref=news4cyber.com), [Secure connections in Tor Browser](https://support.torproject.org/tor-browser/features/secure-connections/?ref=news4cyber.com), and [How onion services work](https://community.torproject.org/onion-services/overview/index.html?ref=news4cyber.com). Diagrams and examples are original educational illustrations. Documentation checked on 11 October 2026.