Tor Browser

Is Tor Browser safe?

Yes, and for privacy it is in a class of its own. Tor Browser sends every page through three volunteer-run relays, so the site you visit never sees your IP address and your internet provider never sees which site you visit. Google Play lists no data collected and none shared, and the browser's own code locks telemetry off. We score it 85/100, ahead of Brave (80) and Firefox (79), a point above DuckDuckGo (84).

The score is not higher because privacy and safety are different things. Tor Browser switches off Google's phishing and malware warnings, it opens dark-web .onion sites where scams are common, and fake copies of the installer have carried spyware. About 3 to 3.7 million people connected to Tor each day in mid-October 2026, according to Tor Metrics.

What does Tor Browser collect?

Nothing about you, as far as the evidence shows. The privacy policy, in force since 30 October 2025, says Tor Browser does not collect IP addresses, browsing history, device IDs or location, and that there is "no tracking, telemetry, or analytics" and no user accounts. It names two small exceptions. In countries that block Tor, the browser may briefly connect outside Tor to fetch bridge addresses, and the Tor Project says it logs no personal details from those requests. On desktop, it may check anonymously for updates.

You do not have to take that on trust. Tor Browser's default settings file is public, and it turns telemetry off with a lock so it cannot be switched on by accident, and it disables health reports and crash reports too. On Android the app does not ask for contacts, location or device identifiers.

The other half of Tor's privacy is design. Tor Browser tries to make every user look the same to websites, with a standard window size and fonts, and it keeps each site's cookies apart. History and cookies disappear when you close it. That is why the Tor Project tells people not to install extra add-ons: each one makes you easier to pick out.

How secure is Tor Browser?

Mostly secure, with one built-in weakness: it is Firefox underneath. Tor Browser is based on Firefox's Extended Support Release, so Firefox flaws reach it too. In November 2016 an exploit for CVE-2016-9079 was found "in the wild targeting Firefox and Tor Browser users on Windows", in Mozilla's words. In October 2024 the Tor Project told users to update to Tor Browser 13.5.7 "immediately" for CVE-2024-9680, a Firefox flaw used in real attacks. Updates usually arrive within days, and the latest stable version, 15.0.26, came out on 21 October 2026 to block compromised eMudhra certificates.

The defences are strong. HTTPS-Only mode is on by default, which matters because the last relay in the chain, the exit relay, can see any traffic that is not encrypted. Three Security Levels (Standard, Safer, Safest) let you switch off JavaScript on unencrypted sites or everywhere, which blocks the kind of script-based exploit used in 2016. The Tor Project runs a bug bounty on HackerOne for Tor and Tor Browser, and Radically Open Security audited Tor Browser for desktop and Android between April and August 2023.

What about the 2024 reports that police "broke" Tor? The Tor Project's September 2024 response says one user of Ricochet, a chat app retired years earlier, was identified through a guard discovery attack because that old software lacked protections added since. It said Tor Browser users were not affected. The lesson is simple: anonymity depends on keeping your Tor software current.

Scams, malware and the dark web

This is Tor Browser's weakest area. Its default settings switch off Google Safe Browsing, because checking pages against Google's lists would leak where you go. So there is no red warning page for a known phishing site or a malware download. Firefox, Brave and DuckDuckGo all keep some form of that protection.

The browser also opens .onion sites, which ordinary browsers cannot reach. Many are legitimate, from news outlets to privacy services, but the dark web is full of fake shops, crypto fraud and illegal content, and nobody moderates it. Tor Browser has no parental controls, while Google Play shows the app as suitable for all ages in Germany.

The biggest practical risk is a fake copy. In October 2022 Kaspersky described a trojanised Tor Browser installer shared through a Chinese-language YouTube channel with more than 180,000 subscribers. The fake browser saved history and form data and carried spyware. It spread because the real site is blocked in China.

How to use Tor Browser safely

1. Download it only from torproject.org, Google Play or the Tor Project's F-Droid repository, and check the signature on a computer.
2. Set the Security Level to Safer or Safest if your safety depends on staying anonymous. Some sites will break.
3. Do not log in to personal accounts in the same session as anonymous browsing. Use New Identity to start clean.
4. Do not install extra add-ons, and open downloaded documents only after you go offline.
5. Treat every .onion shop or crypto offer as a likely scam, and type addresses yourself instead of clicking links.
6. Install updates the day they appear.

How we scored it

Privacy (95) is the highest of any browser we score: no data collected, no accounts and telemetry locked off in the code. Security (84) is strong but carries Firefox's exploited flaws. Scams and harmful content (58) is the weakest factor, because Tor Browser drops phishing warnings and opens the unmoderated dark web. The regulatory record (90) rests on a long record with no fine and a 2023 independent audit. For everyday browsing with ad blocking and phishing warnings, Brave is the easier choice.