How Tor Works: Onion Routing Explained

Tor (short for The Onion Router) is a free overlay network that lets people browse and publish online without revealing their IP address or physical location. It works through a technique called onion routing, in which your traffic is wrapped in multiple layers of encryption and relayed through a chain of independent servers. Understanding how Tor works reveals both the strength of its anonymity guarantees and the specific threats it cannot defend against.

What Tor and Onion Routing Are

Tor is a network of thousands of volunteer-operated servers called relays (or nodes). Instead of connecting directly to a website, a Tor client routes each connection through a sequence of relays, and no single relay ever sees the full path. The name "onion routing" comes from the layered encryption model: your client encrypts each packet in nested layers, like the layers of an onion, and each relay peels off exactly one layer.

This design separates two pieces of information that together identify you: who you are (your IP address) and what you are doing (your destination). In a normal connection, your internet provider and the destination server both learn both facts. Tor ensures no single point in the path knows both at once.

A set of trusted servers called directory authorities publishes a signed consensus listing the available relays and their public keys. Clients download this consensus so they can choose relays and verify their identities before building a path.

The Layered Encryption Model

A standard Tor path, called a circuit, uses three relays:

1. The guard (entry) relay, which sees your real IP address but not your destination.
2. The middle relay, which only relays encrypted data between the guard and the exit and learns neither endpoint.
3. The exit relay, which sees the destination and the traffic leaving the network but not your IP address.

Your client establishes a separate encryption key with each relay, then wraps the payload in three layers. As the data travels forward, each relay removes the outermost layer it can decrypt and forwards the rest:

onion = E_guard( E_middle( E_exit( payload ) ) )
# guard  removes E_guard  -> forwards E_middle(E_exit(payload))
# middle removes E_middle -> forwards E_exit(payload)
# exit   removes E_exit   -> sends payload to the destination

Data moves in fixed-size units called cells (512 bytes) so that packet sizes do not leak information about the content.

Building a Tor Circuit

Tor builds circuits using a telescoping handshake so that keys are never shared with a relay that could link them to another hop. The client extends the circuit one relay at a time:

1. It performs an authenticated key exchange (the ntor handshake, based on Curve25519 Diffie-Hellman) with the guard relay, producing a shared session key.
2. Through the guard, it tunnels a handshake with the middle relay, deriving a second key that the guard cannot read.
3. Through the guard and middle, it tunnels a handshake with the exit relay for a third key.

Because each key is negotiated using ephemeral Diffie-Hellman, Tor circuits have forward secrecy: even if a relay's long-term identity key is later compromised, past traffic cannot be decrypted. Clients typically rotate to a fresh circuit every ten minutes, while keeping the same guard for longer to resist certain deanonymization attacks.

What Each Relay Can and Cannot See

The security of onion routing rests on distributing trust. Assuming at least one relay in the circuit is honest:

• The guard knows your IP but sees only encrypted cells, not your destination.
• The middle relay sees neither your IP nor your destination.
• The exit relay sees the destination but not your IP.

Crucially, the exit relay can read any traffic that is not additionally encrypted. This is why using end-to-end encryption such as HTTPS on top of Tor is essential: it prevents a malicious exit relay from reading or tampering with your data.

Onion Services

Tor also supports onion services (addresses ending in .onion), which let a server receive connections without revealing its IP address. Both the client and server stay inside the Tor network and meet at a rendezvous point chosen by the client, after connecting through introduction points the service advertises.

In version 3 onion services, the .onion address is derived directly from the service's ed25519 public key, encoded in base32 with a checksum and version byte. Because the address is the key, clients can cryptographically verify they reached the correct service without any certificate authority.

Limitations and Threats

Tor provides strong anonymity but is not a magic cloak:

• Traffic-correlation attacks. An adversary who can observe both the traffic entering the guard and leaving the exit may correlate timing and volume to link the two ends. Tor does not defend against a truly global passive observer.
• Malicious exit relays. Unencrypted traffic can be read or modified at the exit, so protocol-level encryption remains necessary.
• Application leaks. Software that ignores the Tor proxy, or that reveals identifying details, can expose you regardless of the network. The Tor Browser mitigates this by resisting fingerprinting and blocking risky features.
• Behavioral links. Logging into personal accounts over Tor ties your identity to your activity. Reducing metadata exposure is part of using Tor safely.

Key Takeaways

• Tor uses onion routing, wrapping traffic in layered encryption and relaying it through a guard, middle, and exit relay so no single relay learns both your identity and your destination.
• Circuits are built with a telescoping ephemeral Diffie-Hellman handshake, giving forward secrecy for past traffic.
• Exit relays see unencrypted traffic, so end-to-end encryption like HTTPS is still required.
• Onion services provide server anonymity, with v3 addresses derived directly from the service's public key.
• Tor cannot stop end-to-end traffic correlation by a global observer or leaks from misconfigured applications.