How to Use Tor Browser Safely: Habits That Protect You

Additional resource for the lesson “How to Use TOR Safely” — Online Anonymity course

Knowing how to use Tor Browser safely matters more than having it installed. Tor Browser is built to keep what you do online from being tied back to who you are, but a few ordinary habits can quietly undo that work: signing in to a personal account, adding a favourite extension, opening a downloaded file in another application. This resource turns the habits that keep Tor Browser doing its job into a short routine.

A. Why this matters

In this course, privacy is deciding what others know about you; anonymity is being able to act without what you do being linked to who you are. Tor Browser is designed for the second. It sends your connection through the Tor network, so the sites you visit do not see your usual internet address, and your local network does not see which sites you visit.

That design protects one link well: the one between your connection and your activity. It cannot protect links you create yourself. Sign in, install an extension that makes your browser stand out, or let a document open in another application while online, and you can reconnect a session to yourself while the browser works perfectly.

So using Tor Browser well is less about technical skill than about a handful of simple habits. Rules on using such tools vary by country, so it is worth checking the situation where you live.

What the sources say

The Tor Project, which builds Tor Browser, is candid about its limits. Its best-practices page says that “Generally it is impossible to have perfect anonymity, even with Tor.” It explains that Tor tries to prevent attackers “from learning what destination websites you connect to”, and adds that, by default, “it does not prevent somebody watching your Internet traffic from learning that you’re using Tor.”

The Electronic Frontier Foundation (EFF), a digital rights organisation, describes Tor in its Surveillance Self-Defense guide as providing privacy and anonymity “by masking who you are and where you are connecting from”. It also reminds readers that “Other apps or services installed on your device will not be routed through Tor.”

In Europe, ENISA, the EU’s cybersecurity agency, lists onion routing networks such as Tor among the ways to protect metadata (who connects to whom, and when). Its 2022 report on data protection engineering explains that “user traffic is routed through a series of relay servers”, and notes that Tor remains vulnerable to attackers who can observe traffic where it enters and leaves the network.

B. Key concepts: how to use Tor Browser safely

Six ideas, each tied to one habit. Most ask you to leave Tor Browser’s settings alone.

What travels through Tor, and what does not

Tor Browser sends its own traffic through the Tor network. The rest of your device does not follow: the Tor Project notes that “Tor only protects applications that are properly configured to send their Internet traffic through Tor.” Your email app, a chat app or a document reader all use your normal connection.

Downloads matter most. A document can contain online resources, and the Tor Project warns that these “will be downloaded outside of Tor by the application that opens them.” The result: “This will reveal your non-Tor IP address.” Tor Browser shows a warning before it hands a file to an external application.

Why it matters to you: Your anonymity stops at the edge of the browser window. Treat that warning as a real decision, and open downloaded documents only once you are offline, or not at all.

Signing in reconnects the session to you

When you sign in to a site in Tor Browser, it cannot see where you are connecting from, but it sees your account. The Tor Project puts it plainly: “If you sign in to that website, they still don’t know your location but they know who you are.” The same applies to forms where you type your name, email address or phone number.

Why it matters to you: An account is the strongest link between activity and identity. Keep personal accounts out of any session you want unlinked. Signing in through Tor can make sense for other reasons, but then you are protecting your location, not your identity.

Looking like everyone else: add-ons and defaults

Tor Browser protects you partly by making its users look alike. The Tor Project says it “is specifically engineered to have a nearly identical (we’re not perfect!) fingerprint across its users”, meaning the bundle of settings a site can read. That is why it discourages installing other add-ons: they “can harm your privacy, weaken security, and make you easier to track.”

The window works the same way. Tor Browser opens at a standard size, and if you enlarge it, a feature called letterboxing adds margins so that your window stays close to common sizes. Leave that behaviour in place. Tor Browser also offers security levels (Standard, Safer and Safest, with Standard as the default) that switch off some web features; choosing between them is covered at the Intermediate level.

Why it matters to you: Every change that makes your Tor Browser more personal makes it more distinctive. The unmodified version blends in.

HTTPS still matters inside Tor

Tor encrypts your traffic within its network, but the last stretch, from the exit to the website, is protected only if the site uses HTTPS. The Tor Project notes that “the encryption of your traffic to the final destination website depends on that website.”

Tor Browser includes HTTPS-Only Mode, which pushes connections to HTTPS where a site supports it. Still, check the address bar for “https://” and the site name you expect before typing anything sensitive.

Why it matters to you: Tor hides your internet address from the site; HTTPS hides what you send from anyone in between. You need both.

An up-to-date browser is part of the protection

The Tor Project is direct: “Tor Browser must be kept updated at all times.” It adds that using an outdated version “puts you at risk of serious vulnerabilities and deanonymization”, meaning weaknesses that could reveal who you are.

Tor Browser prompts you when a new version is out. On desktop, the update is in the main menu (≡), under “Update available – restart now”.

Why it matters to you: An update is the one change to Tor Browser worth always making.

New Identity: a clean break between activities

New Identity, in the toolbar and the main menu, closes all your tabs and windows, clears private information such as cookies and browsing history, and uses new Tor circuits (the chain of relays your connection passes through). The Tor Project describes it as useful to “prevent your subsequent browser activity from being linkable to what you were doing before.” Do not confuse it with “New Tor circuit for this site”, which only changes the route for one tab and, in the Tor Project’s words, “does not clear any private information or unlink your activity”; the resource on checking your Tor circuit in this section explains when to use it.

Why it matters to you: New Identity is the button that separates two activities. It does not erase what you have already told a site.

C. A practical example: Elena’s first Tor sessions

Elena is 35 and works in marketing. She is thinking about moving to another agency, and wants to read job listings and an industry forum without that reading being tied to her usual browser, where she is signed in to work tools all day. She installed Tor Browser from the official site and started browsing.

Several habits from her everyday browser came along. She signed in to her personal webmail to fetch a copy of her CV. She added the ad-blocking extension she uses everywhere else. She downloaded an industry report as a PDF and clicked through the warning that it would open in another application. Later, an update prompt sat unanswered in the main menu.

None of this was careless: each step was what she would do in any browser. But the sign-in told that service who was behind the session, the extension made her Tor Browser less like everyone else’s, and the PDF reader opened the report over her normal connection.

What changed when Elena set up a routine

Elena did the exercise in section D, calmly, wanting the tool to do what she had installed it for:

• She removed the extension and left Tor Browser as it came, accepting more adverts on some pages.
• She kept webmail in her usual browser, and saves downloads to read later, offline.
• She applied the update, and now starts each session by checking for one.

She also closes every session with New Identity. Tor Browser does not make her invisible, and she knows it: if she signs in somewhere, that site knows it is her. What changed is that her job research no longer travels with the rest of her online life by accident.

D. Try it yourself: a clean-session routine (15 minutes)

Five short steps for the next time you open Tor Browser. An ordinary news site is enough to practise.

Step 1 — Decide what this session is for (2 minutes)

• Write one line: “In this session I will ___, and I will not sign in to ___.”
• Keep to one activity per session where you can: two activities in one session can be linked to each other.
• If the activity needs your personal account, your usual browser may be the better tool.

Step 2 — Check the browser before you start (4 minutes)

• Open the main menu (≡) and look for “Update available – restart now”. If it is there, update first.
• Check the add-ons page for anything that was not there when you installed Tor Browser, and remove it.
• Leave the window size and security level as they are.

Step 3 — Browse without signing in (4 minutes)

• Visit two or three ordinary sites. Do not sign in or fill in any form with your name, email address or phone number.
• Before typing anything, check that the address begins with “https://” and shows the name you expect.
• If a site insists on an account, leave that task for another browser.

Step 4 — Handle one download carefully (2 minutes)

• Download a harmless file, such as a public PDF leaflet, and watch for Tor Browser’s warning about external applications.
• Do not open it now. Note where it was saved.
• Decide your own rule: open such files only after disconnecting from the internet, or not at all for anything you want kept unlinked.

Step 5 — Close with New Identity (3 minutes)

• Click New Identity in the toolbar or the main menu, and read the warning Tor Browser shows before it closes everything.
• Confirm, and notice that the tabs, cookies and history from before are gone.
• Write your routine on a card: purpose, update, no sign-in, downloads, New Identity.

A routine you actually follow does more for your anonymity than a list of settings you might change one day.

Already covered in the Online Security course

Privacy Focused Browser: The Setting You Use All Day
It covers configuring the browser you use every day, from HTTPS-only mode and tracking protection to extensions and site permissions; this resource adds why Tor Browser works best when you leave its defaults alone and keep your own identity out of the session.

E. Videos, articles and further resources

The Tor Project’s own support pages first, then a digital rights guide and a European source. All in English.

The Tor Project: official support

The Tor Project — Tor Browser best practices
Signing in and web forms, add-ons, HTTPS, downloaded documents and what Tor does and does not offer, on one page.
https://support.torproject.org/tor-browser/security/using-tb-safely/

The Tor Project — Managing identities
What New Identity does, where to find it, and what signing in over Tor reveals.
https://support.torproject.org/tor-browser/features/managing-identities/

The Tor Project — Plugins
Why installing extra add-ons is strongly discouraged, and how scripts relate to the security levels.
https://support.torproject.org/tor-browser/features/plugins/

The Tor Project — Fingerprinting protections
How Tor Browser keeps its users looking alike, including standard window sizes and letterboxing.
https://support.torproject.org/tor-browser/features/fingerprinting-protections/

The Tor Project — Updating
Why Tor Browser must stay up to date, and how to update automatically or by hand.
https://support.torproject.org/tor-browser/getting-started/updating/

The Tor Project — Security levels
What the Standard, Safer and Safest levels change, for when you are ready to look further.
https://support.torproject.org/tor-browser/features/security-levels/

Digital rights guides and institutional sources

Electronic Frontier Foundation — How to: Use Tor
A Surveillance Self-Defense guide to what Tor Browser protects, its limits and sensible habits, last reviewed in January 2025.
https://ssd.eff.org/module/how-to-use-tor

ENISA (European Union Agency for Cybersecurity) — Data Protection Engineering: From Theory to Practice
A 2022 report that places onion routing networks such as Tor among the techniques for protecting metadata, with their limits.
https://www.enisa.europa.eu/sites/default/files/publications/ENISA%20Report%20-%20Data%20Protection%20Engineering.pdf

Links checked in November 2026. If an address changes, searching for the title on the organisation’s site usually finds it.

F. The Cyber Welfare Framework: Skills, Awareness, Secure Behaviour

This resource sits on the Secure Behaviour pillar at level FL3 – Autonomous: turning what you know about Tor Browser into habits you repeat.

Skills

• Finding the update prompt and New Identity in Tor Browser.
• Checking an address for HTTPS and the expected site name before typing anything.
• Spotting and removing an add-on that was not part of the original installation.

Awareness

• Understanding that signing in tells a site who you are, even if it cannot see where you are.
• Knowing that only Tor Browser’s own traffic goes through Tor, and that downloaded files may open outside it.
• Recognising that a personalised Tor Browser stands out, while an ordinary one blends in.

Secure Behaviour

• Keeping one purpose per session and closing it with New Identity.
• Accepting every Tor Browser update before you start browsing.
• Opening downloaded documents only offline.

G. Questions to sit with

• Which of your online activities would you prefer not to be linked to your name?
• Which habit from your everyday browser would be hardest to leave behind in Tor Browser, and why?
• If a task needs you to sign in, what is Tor Browser still protecting?

H. What to do now

The recommendations (R) and security measures (MS) from the Cyber Welfare database that apply most directly here.

1. Before and during a session

• R6 — Keep your software up to date: update Tor Browser as soon as the prompt appears; an outdated version puts your anonymity at risk too.
• R9 — Browse only over HTTPS: HTTPS-Only Mode helps; a glance at the address bar before you type does the rest.
• Leave Tor Browser’s add-ons, window size and security level as they came, unless you have a reason you could explain.

Minimum commitment: next time you open Tor Browser, check the main menu for an update before visiting any site.

2. Keeping sessions apart from you

• MS9 — Tor Browser (and OnionShare for anonymous file sharing): keep Tor Browser for the activities you want kept apart from your identity.
• Do not sign in to personal accounts or type identifying details in a session you want unlinked.
• Close each session with New Identity before moving on to something unrelated.

Minimum commitment: write your five-word routine on a card and keep it next to your computer: purpose, update, no sign-in, downloads, New Identity.

In short

• To use Tor Browser safely, keep its defaults: no extra add-ons, the standard window behaviour and every update.
• Signing in or typing your details tells a site who you are, even though it cannot see where you are.
• Downloaded documents may open outside Tor and reveal your usual address: open them offline, or not at all.
• New Identity separates one activity from the next; Tor Browser reduces links to you, but it cannot remove the ones you create.

Related resources in this course

• What Is Tor? How Tor Browser Protects Your Anonymity
• How to Install Tor Browser and Verify It: Windows, Mac, Linux
• Is Tor Browser Really Connected? Check Your Tor Circuit

Discover more companion resources from the online courses of the Protect Your Digital Privacy programme.