How Does the Tor Network Work? A Visual Guide to Onion Routing

1. What Is Tor?

Tor (The Onion Router) is a privacy network that forwards traffic through relays operated by volunteers. Instead of connecting directly to a website, your client uses a circuit of relays to make linking your network address to your browsing destination more difficult. See What is Tor?.

Onion routing began as research at the US Naval Research Laboratory in the 1990s: could a network carry communications without revealing who was communicating with whom? Tor developed from that work into an open-source project. Read the Tor Project history.

Legitimate uses include everyday privacy, sensitive research, journalism, and accessing information where censorship blocks it. These uses depend on separating the origin of a connection from its destination.

2. How Onion Routing Works

Imagine a message inside three nested envelopes. The outer envelope can be opened by the guard, the next by the middle relay, and the innermost by the exit. Each opening reveals just the material needed for the next stage.

In the actual protocol, the client builds a circuit and negotiates separate keys with its relays. Outgoing data carried in relay cells receives layers of encryption. A relay processes its own layer and forwards the remaining protected data. The envelopes below are a teaching analogy, rather than a literal packet format or a description of the key exchange. See the Tor protocol introduction and relay-cell routing specification.

3. The Three Tor Relays

A typical circuit to an ordinary website has a guard, a middle relay, and an exit. Select a relay below with a mouse, touch, or the keyboard.

4. Concrete Example: Visiting Wikipedia Through Tor

A fictional walkthrough: Alice lives in Paris and wants to read Wikipedia in Tor Browser. We use https://www.wikipedia.org/, an ordinary Internet address. Relay locations and identities are deliberately unspecified; Tor circuits are not selected as a simple geographic itinerary.

1. Alice opens Tor Browser and connects to Tor.
2. Her client establishes a circuit using relay information and cryptographic handshakes.
3. The request enters the guard.
4. The middle forwards it along the circuit.
5. The exit processes the final Tor layer.
6. The exit contacts Wikipedia; Alice’s browser and the site communicate using HTTPS through that connection.
7. Wikipedia’s reply travels back through the exit, middle, and guard to Alice.

5. What Happens When You Use HTTPS?

Tor separates the network origin from the destination. HTTPS protects the application conversation and authenticates the site through a valid TLS connection. These protections work together. Tor Browser includes HTTPS-Only Mode, which favors HTTPS when available. See Secure connections in Tor Browser.

HTTPS does not hide all metadata from the exit: the destination IP address, connection timing and volume remain observable; the hostname is often available through connection setup or DNS. It also does not prevent the destination website from reading what you send to it. Never treat a certificate warning as a harmless formality.

6. What Are Onion Services?

An onion service uses a .onion address and is reached inside Tor. Unlike an ordinary website reached through an exit, the service also builds Tor circuits. This can protect its network location as well as the client’s. Modern onion addresses are tied to the service’s cryptographic identity. See What are onion services?.

The service sets up introduction points and publishes a descriptor that lets a client find them. The client selects a rendezvous relay, then sends an introduction through an introduction point. The service builds its own circuit to the rendezvous. Once connected, application traffic goes through the rendezvous rather than through the introduction point. See How onion services work.

Check Your Understanding

Try answering before opening each explanation.