Onion Browser

Is Onion Browser safe?

It is the safest way to use Tor on an iPhone, but it is not as safe as Tor Browser on a computer or Android phone. Onion Browser, made by Mike Tigas's company with Benjamin Erhart and Guardian Project, is the app the Tor Project recommends for iOS. Apple's label says it collects no data, and it hides your IP address from websites by routing pages through Tor. We score it 77/100, below Tor Browser (85) and Safari (81).

The gap comes from Apple's rules more than from the developers. Every browser on iOS must use Apple's WebKit engine, which, in the Tor Project's words, "prevents Onion Browser from having the same privacy protections as Tor Browser." Several leaks were fixed in the last two years, and look-alike apps with paid subscriptions sit next to it in the App Store.

What does Onion Browser collect?

Nothing, as far as its label and policy show. The App Store listing reads "Data Not Collected". The privacy policy, four sentences long, says the app "does not directly collect any data on user activity" and uses no third-party analytics, beyond the opt-in reports Apple collects from iOS itself.

By default the app does not keep cookies or caches, forgets everything when you switch away from it, and does not send what you type to a search engine before you press Enter. DuckDuckGo is the default search engine, reached through its .onion address. The app is free, carries no ads and sells only optional tips.

Orbot or built-in Tor: which is safer?

This is the setting that matters most. Onion Browser can connect through its own built-in Tor, available since version 3.1 on iOS 17 and later, or through the separate Orbot app, which runs Tor as a VPN for the whole device.

The developers' FAQ is blunt: "Orbot is safer." With the built-in Tor, websites can learn your real IP address through WebRTC, a feature used for video calls, and audio and video streams do not go through Tor at all. Both are limits of WebKit. Orbot closes those holes, but Apple lets VPN apps use only 50 MB of memory, so Tor sometimes gets shut down and restarts. Privacy Guides reached the same view in its September 2024 review: built-in Tor is easier, Orbot is better protection.

How secure is Onion Browser?

Reasonably, with known limits. Because it uses WebKit, it avoids Firefox flaws that hit Tor Browser, but it inherits WebKit's own and gets its engine fixes only through iOS updates. It also cannot copy Tor Browser's fingerprinting defences. The developers' advice is to look like every other iPhone user rather than try.

The version history shows a steady stream of leak fixes. In March 2025, version 3.2.0 closed leaks through bookmark icons, a bookmark sync service, live search results and downloads when using the built-in Tor, and added support for Apple's Lockdown Mode. Version 3.2.2 in July 2025 fixed a leak through the share sheet. Version 3.4.1 in August 2026 fixed "IP leaks during DNS prefetch found by Mysk". Updates arrive often: version 3.4.4 came out on 20 October 2026.

Outside checking is thin. Cure53 audited Onion Browser in 2014, and we found no audit since. The Tor Project's HackerOne bounty does not list the app. The three security levels (Bronze, Silver and Gold) are less strict than Tor Browser's, and Privacy Guides found per-site choices could reset unexpectedly.

Look-alike apps and the dark web

Search the App Store for "Tor" and you will find apps with very similar names. In October 2026 Apple showed "TOR Browser: Onion VPN & Orbot" from Stellar Apps Limited, with subscriptions up to $69.99 a year, and "Onion Browser : Private VPN" from Falling Rain Software, with a weekly subscription of $8.99, beside the real listing. The real Onion Browser is free and published by Mike Tigas.

The app also opens .onion sites, many of which are fake shops, crypto scams or illegal content with no moderation. It has no phishing warnings of its own. Apple rates it 16+ for unrestricted web access.

How to use Onion Browser safely

1. Install the app published by Mike Tigas, which is free. Skip any "Tor" app that asks for a subscription.
2. Install Orbot too and choose it on first launch instead of the built-in Tor.
3. Raise the security level to Gold for sensitive sites, and turn on Lockdown Mode in iOS settings if you face serious risks.
4. Keep iOS and the app updated, since WebKit fixes arrive only with iOS updates.
5. If your safety depends on anonymity, use Tor Browser on a computer instead.

How we scored it

Privacy (88) is strong, with no data collected, but the built-in Tor's WebRTC leak and fixed leaks keep it below Tor Browser's 95. Security (68) is the second-weakest factor: WebKit limits, a run of leak fixes and an audit from 2014. Scams and harmful content (55) is the weakest because of paid look-alike apps, no phishing warnings and open access to the dark web. The regulatory record (87) is clean over about 14 years, but no regulator has looked at the app.