Explainer
A VPN asks you to trust one company. Tor splits your connection across three relays so that no single one sees both who you are and where you are going. They solve different problems, and neither replaces the other.
A VPN sends your traffic through one server run by one company. That company can see both who you are and where you go, and you are trusting it to do nothing with that.
Tor sends your traffic through three relays run by different volunteers. By design, no single relay can see both ends. Your privacy then depends on how the network is built instead of on one company's behaviour, and you pay for that in speed and convenience.
A VPN is one encrypted hop. Tor is three, with a layer of encryption for each relay, and each relay removes only its own layer.
As with a VPN, the Tor encryption stops at the exit. A page without HTTPS is readable by whoever runs that exit relay.
| Compared | VPN | Tor |
|---|---|---|
| Who you trust | One company | No single relay, but the network as a whole |
| Who can link you to your activity | The provider, if it keeps or is ordered to keep the records | No single relay; an observer of both ends may be able to by comparing timing |
| What it covers | Normally all traffic on the device | Usually just Tor Browser |
| Your browser's fingerprint | Unchanged | Tor Browser is built to make its users look alike |
| Speed | Usually fine for video and large downloads | Noticeably slower, by design |
| Payment and accounts | Often a subscription linked to you | Free, with no account |
| How sites respond | Sometimes blocked or challenged | Blocked or challenged more often |
A VPN fits when you want to hide your activity from the network you are on, or show sites a different address, and you are willing to trust a provider. It works with all your apps at everyday speeds, and it is why the register scores the provider as well as the product.
Tor fits when the point is that nobody should be able to connect you with what you are reading, including the service carrying your traffic. It is a poor fit for streaming, large downloads or anything you sign in to by name.
Logging in undoes much of what either tool offers. An account identifies you whichever route it arrived by.
Neither removes malware from your device, stops a false login page or makes a mistake in what you post any less identifying. Your network can also see that you are using Tor, or a VPN, even when it cannot see what is inside.
Tor is not a guarantee either. An adversary able to watch both ends of a connection may match them by timing, and a browser vulnerability can reveal a real address. Tor reduces how much you have to trust any one party, and it does not remove the need for care.
It protects against something different. Tor is built so that no single relay knows both who you are and where you are going, which a VPN provider always can. A VPN covers all the traffic on your device and is much faster, which makes it practical for everyday use.
The better question is who you need protection from.
Usually there is little to gain. Tor already separates who you are from where you go, and adding a VPN adds a company that can see part of that picture. It can also make your setup more distinctive and harder to get right.
A specific reason might justify it. Doing it for extra safety in general does not.
In most countries, no, and the same separation applies as with a VPN: the law cares about what you do. Some countries block Tor or treat its use with suspicion, so check the law where you physically are.
Next
Every explainer ends by naming the pages that own what it only touched.
Public Wi-Fi is less dangerous than the advertising says, because HTTPS already seals most of what you send. A VPN still hides which sites you reach, and some real risks remain that it does nothing about.
A DNS leak happens when your VPN carries your traffic but the name lookups go around it, which shows your network the sites you visit. This page covers why that happens and how to check for it.
A kill switch stops your traffic when the VPN tunnel drops, so it cannot carry on unprotected without your noticing. Kill switches differ in what they cover, and the differences decide when one actually helps.
"Independently audited" can describe very different pieces of work. This page covers the kinds of audit, what each one can show, and the questions to ask before an audit changes your mind about a provider.
Both make a request from another address. A VPN normally carries all your device's traffic and encrypts it; a proxy usually handles one app and may encrypt nothing at all. Here is how to tell which one you have.
Many people do not. A VPN solves a few specific problems well and does nothing for the rest, so the answer depends on which problem you have. This page goes through the common ones.
What happens to a packet between your device and a website when a VPN is on: the handshake, the tunnel, the name lookup and the exit. Each step also explains one way a VPN can fail.
In most of the world, using a VPN is legal. A short list of countries restricts, licenses or blocks them, and what you do through one is a separate question everywhere. This page is a map of that, not legal advice.
Running a VPN costs money every month, so a free one is paid for by something. This page sets out what that usually is, what has gone wrong in practice, and how to tell a sample from a business model.
A VPN protects one stretch of the path: your device to its server. This page covers everything outside that stretch, from your browser and your accounts to malware, a dropped tunnel and the claims made in the advertising.
One encrypted hop between your device and the internet. This page is the starting point for the section: what the hop does, who it hides you from, who it hands the view to instead, and which of the promises made for it survive contact with the mechanism.
Not an explainer but the model itself, for a reader who got to the end of this page and wants to know how the judgement is made.
What the register knows about this market as a whole, and what it does not — every figure from the index, none from a survey.