Although Tor and VPNs both serve to protect privacy, they’re fundamentally different in the way they work. Tor encrypts your data multiple times and forwards it via three independent servers worldwide. It separates the user’s identity from their traffic path, helping protect against tracking. Tor also creates new connections every ten minutes to make it considerably more difficult to permanently allocate traffic. A VPN, on the other hand, protects your traffic through a single tunnel via a provider server that hides your IP address, but is able to know your identity.
Thomas Joos
Why using a VPN and Tor together can put your anonymity at risk
Many users hope to achieve double security by combining VPN and Tor, but this approach actually introduces new risks. The VPN provider can see your original IP address and knows you’re connecting to Tor. If the provider keeps logs or comes under pressure, your identity could be exposed.
This risk is especially significant when VPNs store personal data like email addresses or payment information, details often required during registration, which makes tracing you easier.
Also, using a VPN and Tor together can actually make you less safe. VPN servers are often targeted by hackers, and if the VPN app isn’t open source, it might have junk, trackers, or hidden backdoors that can put your security at risk.
Christoph Hoffmann
Why VPN over Tor and Tor over VPN can undermine your privacy
VPN over Tor and Tor over VPN are different setups, both with risks. VPN over Tor is complex and weakens Tor’s privacy. Tor over VPN means trusting the VPN. It’s usually better to just use one—Tor or a VPN, not both.
VPN connections to the Tor network are more conspicuous
Connections from VPN servers to the Tor network stand out from regular Internet traffic, drawing close attention from surveillance authorities. Even when VPN and Tor encryption are used together, these connections remain conspicuous. Advanced techniques like deep packet inspection can detect and classify VPN data streams despite encryption. Additionally, website fingerprinting attacks can analyze traffic patterns to infer which sites have been visited, meaning VPNs do not provide complete anonymity or camouflage.
Thomas Joos
Technical risks associated with simultaneous use
VPN connections can be interrupted or incorrectly configured. Without special protection mechanisms such as a VPN firewall, your real IP address would be transmitted immediately in this case. Complex configurations such as setting up transparent proxies are also prone to errors and difficult to control. The developers of the Tor project expressly warn against such setups because they create new vulnerabilities instead of security.
Paying for a VPN subscription poses a further risk. Anyone who enters personal data when registering or pays by credit card can be deanonymized by payment service providers. Only a few providers accept anonymous payment methods such as Monero.
Operating your own VPN server could theoretically minimize some risks, but does not protect you from being monitored by your internet provider.
When VPN and Tor could be useful together
There are a few exceptional cases in which a combination can be useful. In countries with strong internet censorship in which the Tor network is blocked (like China or Iran), a VPN can help to establish a connection. However, in these cases, the VPN provider would have to be absolutely trustworthy and not keep any logs.
A better solution is Obfs4 bridges, which disguises Tor traffic so that it looks like regular internet traffic. This is useful in countries with strong censorship, as they hide the typical signature of Tor traffic.
Thomas Joos
Whistleblowers, who place particularly high demands on their anonymity, could also benefit from additional protection in individual cases. Nevertheless, the risk remains that VPNs can be exposed by traffic fingerprinting techniques.
Tor alone is often the better choice
Tor is designed to achieve anonymity through diversity and distribution. Every user benefits from the fact that their data traffic is lost in the flow of other connections. If you build additional tunnels, you are more likely to attract attention and thus weaken the actual advantage of the network. It would make more sense than an additional VPN service to invest resources in the operation of a dedicated Tor relay and thus strengthen the security of the entire network.
The Tor project points out that a large number of connections with standard-compliant patterns are crucial for individual users to be able to disappear into the masses. The more a connection stands out from this pattern, the easier it becomes to identify.
Analyzing real cases such as the arrest of the Silk Road operator also shows that the greatest dangers lie less in technical weaknesses than in human error. A clear separation of real names, personal accounts, and anonymous surfing therefore remains essential.
Rely on the strengths of Tor
The simultaneous use of VPN and Tor does not make sense in most cases. Not only does it make anonymity more difficult, it also makes your connection more conspicuous and potentially more vulnerable. If you’re looking for maximum privacy, you should use Tor directly, without additional tunnels, and ensure that your own activities are properly separated. Consciously using Tor bridges and supporting the Tor network with your own relays also contributes effectively to protecting your privacy.
This article originally appeared on our sister publication PC-WELT and was translated and localized from German.
