Guides › VPN over Tor
VPN over Tor: what it is, what it protects, and how to do it
Tor and a VPN solve different problems, and the order you stack them in decides who can see what. Our apps support one specific order, VPN over Tor, so that even we never see the address you connect from.
Updated
Two different stacks with confusingly similar names
Both put Tor and a VPN in the same path. What differs is the order, and the order decides who sees your real address.
| Tor over VPN | VPN over Tor | |
|---|---|---|
| Path | You → VPN → Tor → internet | You → Tor → VPN → internet |
| Your ISP sees | A VPN connection | A Tor connection |
| The VPN sees | Your real address | A Tor exit node |
| Tor's entry guard sees | The VPN's address | Your real address |
| The website sees | A Tor exit | The VPN server |
| How you do it | Connect the VPN, then open Tor Browser | Turn on Tor mode in our app |
Tor over VPN needs nothing from us: connect normally and run Tor Browser. It hides Tor use from your ISP and hides your address from the Tor network, but the VPN still knows who you are, and the sites you visit see a Tor exit, with all the CAPTCHAs and blocks that brings.
VPN over Tor is the one our apps implement. The VPN connection itself is carried through Tor, so the server, and therefore we, see a Tor exit and never your address. Sites see an ordinary VPN address, not a Tor exit, so they behave normally. The price is speed and the loss of UDP.
What Tor mode actually does
Tor is a SOCKS proxy on your own machine. OpenVPN can be told to reach the server through a SOCKS proxy, and that is the whole mechanism. With Tor mode on, the app:
- Builds a profile that uses OpenVPN over TCP, because Tor carries only TCP, with the server named by its IP address, so no DNS lookup escapes before the tunnel exists.
- Points OpenVPN at Tor's SOCKS port. On Windows, macOS and Linux it looks for Tor Browser (port 9150) or a running tor service (port 9050). On Android it hands the connection to Orbot and, importantly, excludes Orbot from the tunnel so Tor's own guard connections are not routed into the tunnel they are carrying.
- Sends the app's own requests to our panel through the same proxy when you ask it to, so the sign-in and the server list come from a Tor exit too.
- Disables WireGuard for the duration, because WireGuard is UDP only.
We do not bundle Tor. The Tor Project's own build carries your traffic, updated on their schedule, and the app simply finds it. If nothing is listening on either port the app says so rather than silently connecting without Tor.
What it protects, precisely
Our connection record for a Tor-mode session holds the salted hash of the address the session came from, and that address is a Tor exit. The session identifier contains a Tor exit. The node's daemon log records a Tor exit. There is nothing in our possession that links the session to you, which is a stronger statement than "we promise not to look".
It does not make you anonymous to the sites you use. They see the VPN server's address, and if you sign in to an account under your name, that is still you. It also does not hide Tor use from your ISP or your network: they see a Tor connection. If that is a problem where you are, Tor over VPN, or a Tor bridge, is the better order.
What it costs
- Speed. Three Tor relays, then TCP inside TCP. Expect a fraction of your usual throughput and higher latency. It is a mode for when the source address matters more than the bandwidth.
- No UDP, no WireGuard. Everything runs over OpenVPN TCP.
- Port forwarding is beside the point. A reserved port still works, but you are trying to be unreachable, and a forwarded port is a way in. Release your ports first.
- Reconnects are slower. A dropped Tor circuit means rebuilding the circuit, then the VPN session.
Turning it on
- Install Tor Browser from torproject.org and leave it open, or install the tor service on Linux (
apt install tor). On Android, install Orbot from F-Droid or Play. - In our app, tick Connect through Tor on the Connect screen. The Test button next to it checks that Tor is reachable and tells you which port it found. There is a matching option on the sign-in screen, so the sign-in itself can go through Tor.
- Connect as usual. The app fetches your profile through Tor and tells you so while it does; if Tor is not running it says that instead of connecting without it.
Paying with Monero and connecting through Tor mode is, together, the thinnest account we know how to offer: an email address, a payment nobody can trace, and sessions that arrive from Tor.
Questions
What is the difference between VPN over Tor and Tor over VPN?
VPN over Tor means your VPN connection travels through Tor: the VPN server sees a Tor exit, not you. Tor over VPN means you connect to the VPN first and run Tor Browser inside it: your ISP sees only the VPN, and the Tor entry guard sees the VPN's address. Our apps implement the first.
Do I need to install Tor?
Yes. On Windows, macOS and Linux the app looks for Tor Browser (port 9150) or a tor service (port 9050) on your machine. On Android it uses Orbot. We do not bundle Tor, so the Tor project's own build is what carries your traffic.
Why is it slower?
Every packet crosses three Tor relays before reaching the VPN server, and OpenVPN has to run over TCP because Tor carries only TCP. Expect a fraction of your normal speed; it is a mode for when your address matters more than your bandwidth.
Can I use WireGuard with Tor mode?
No. WireGuard is UDP only and Tor carries only TCP, so Tor mode uses OpenVPN over TCP. The app disables the WireGuard option while Tor mode is on.
Try it
Every new account starts with a free trial, every plan includes every location, and you can pay by card, Bitcoin, Lightning or Monero.