Orbot

Is Orbot safe?

Yes. Orbot is a trustworthy way to send your phone's traffic through Tor, and it is free, open source and collects almost nothing. Guardian Project has built it since about 2009, and its store listings are published under The Tor Project's name. Apple's label says no data is collected, and Google Play lists only an optional email address. We score it 84/100, below Mullvad VPN (91) and Proton VPN (88), mainly because far less outside testing backs it.

Orbot has more than 10 million downloads on Google Play. It is the tool Onion Browser uses on iPhone for its safer connection mode, and on Android it can route any app you choose through Tor.

What does Orbot collect?

Very little. The privacy policy is two sentences: Orbot "does not directly collect any data on user activity", and apart from what Google Play itself tracks, it uses no third-party analytics. The App Store label agrees ("Data Not Collected"). On Google Play the only item is an email address, which is optional and used for app functions, and nothing is shared with other companies.

There is no account, sign-up or payment. The privacy comes from Tor's design: your traffic passes through three volunteer relays, so the site you visit sees a Tor exit address and your internet provider sees only that you use Tor. That is a stronger structure than a commercial VPN, where one company could, in principle, see both ends.

Two limits are worth knowing. The last relay can read anything not encrypted, so stick to HTTPS. And Orbot hides your address, not your identity: an app you are logged in to still knows who you are.

How secure is Orbot?

The code is solid and kept current, but the outside checks are thin. Orbot updates its built-in Tor quickly. In October 2026 the iOS app moved to Tor 0.4.9.14, as did an Android test release, and the iOS version history shows many releases that update Tor and its censorship tools, such as Snowflake and Lyrebird.

What it lacks is the evidence that lifts Mullvad and Proton. We found no published independent audit of Orbot. The Tor Project runs a bug bounty on HackerOne, but its scope marks Orbot as not eligible, and we found no paid program run by Guardian Project.

The iOS version has a structural problem. Apple gives VPN-style apps only 50 MB of memory, and the Tor client often comes close to that limit, so iOS shuts it down and Orbot restarts. In June 2024 the developers had to remove bridge support on iOS, the feature that helps in countries that block Tor; it returned in version 1.10.0 in April 2026.

On Android, the risk is the system rather than the app. In May 2026 Mullvad described a bug in Android 16 that lets a malicious app send traffic outside any VPN tunnel, even with "Block connections without VPN" on. Google closed the report as infeasible to fix, so the leak affects Orbot like every other VPN app.

Parental filters, the dark web and look-alikes

Orbot has no feed, chat or ads, and Apple rates it 4+. The risk for families is what it unlocks. Like any VPN, it gets around router, school and parental filters, and once it is running, any browser on the phone can open .onion sites that nobody moderates.

In the App Store, apps from other developers that charge through in-app purchases use names such as "TOR Browser: Onion VPN & Orbot". The real Orbot is free, with no in-app purchases listed on its App Store page.

Kindness Mode is a separate feature that lets your phone act as a Snowflake proxy for people in censored countries. Guardian Project says their traffic is encrypted and invisible to you, but your internet provider can see the connections and your IP address is kept in the Snowflake broker's logs.

How to use Orbot safely

1. Install Orbot from Google Play or the App Store, and check that it is free with no subscription.
2. On Android, choose which apps go through Tor, and set Android's Always-on VPN option with "Block connections without VPN" so traffic stops if Orbot drops.
3. Use a Tor-aware browser such as Tor Browser for websites; routing a normal browser through Orbot hides your IP address but not your browser fingerprint.
4. On iPhone, if Tor keeps restarting, clear the cache in settings or try a bridge.
5. Turn on Kindness Mode only on your own unlimited home network, never on work or public Wi-Fi.

How we scored it

Privacy (93) is the strongest factor: almost nothing collected, no account and Tor's three-relay design. Security (78) is held back by the lack of a published audit or paid bug bounty and by the unstable iOS version. Scams and harmful content (72) reflects how easily any VPN, and this one in particular, gets around filters and opens the dark web. The regulatory record (88) is clean over about 17 years, but no regulator or auditor has tested it.