How to Install Tor Browser and Verify It: Windows, Mac, Linux

Additional resource for the lesson “Installing and Verifying TOR Browser (Windows, macOS, Linux)” — Online Anonymity course

To install Tor Browser well, the download matters as much as the install. A copy from the wrong place can look identical and still work against you. This resource shows you where the genuine browser comes from, what checking its signature proves, and how to install, verify and start it on Windows, Mac or Linux, at a pace that suits you.

A. Why this matters

In this course, privacy means deciding what others know about you; anonymity means being able to act without what you do being linked back to who you are. Tor Browser is one of the main tools for the second: it is designed to make your visits harder to connect to you. The previous resource in this section explains how it works. This one deals with an earlier, quieter question: is the browser you are about to trust the genuine one?

That question matters more here than for most software. A modified copy of an anonymity tool can look and feel exactly like the original while doing the opposite job, quietly creating the very links you wanted to loosen. You cannot tell from the window or the icon. You can tell from where the file came from, and from its signature.

None of this needs to be stressful. The official route is short, it is documented by the people who build the browser, and you only need to learn it once. Rules on using tools such as Tor Browser vary by country, so if you are unsure about the rules where you live, check before you install.

What the sources say

The Tor Project, the non-profit organisation that develops Tor Browser, says that “the safest and simplest way to download Tor Browser is from the official Tor Project website”, adding that the HTTPS connection to the site makes the download much harder to tamper with. As of November 2026, the download link on torproject.org leads to download.torproject.org. For networks where that site is blocked, the same support pages list official mirrors and an automatic service called GetTor.

Its support pages are equally clear about copies sold elsewhere. Tor Browser is open source and free, and “any browser forcing you to pay and is claiming to be Tor Browser is fake.” The Tor Project’s own advice is to visit its download page and, after downloading, to confirm you have the official version by verifying the signature.

This is not a theoretical risk. In 2019 the Electronic Frontier Foundation (EFF), a digital rights organisation, described a “trojanized” version of Tor Browser found by security researchers, promoted through fake “out of date” warnings that sent people to look-alike websites. The fake browser sent a custom user-agent, the short description a browser gives every site it visits, which in the EFF’s words “allowed the attackers to create and track a very specific fingerprint on their victims.”

The tools for checking a signature are free and public. On Windows, the Tor Project points to Gpg4win, a free software package whose own site states: “Creation of Gpg4win was supported by the German Federal Office for Information Security (BSI)”, Germany’s national cyber security authority.

B. Key concepts

Six ideas that explain what you are doing at each stage, and why.

The official source, and only the official source

The genuine Tor Browser for desktop comes from the Tor Project’s download page, which offers versions for Windows, macOS and GNU/Linux. If that page is blocked on your network, the Tor Project lists official mirrors run by partner organisations, and GetTor, which replies to an email or a Telegram message with download links. Search adverts, file-sharing sites, “faster” or “pro” editions and links in messages are not on that list.

Why it matters to you: The source decides everything that follows. A genuine file from an official address can then be checked; a file from an unknown site starts with a question you may not be able to answer.

The digital signature and the .asc file

Next to each download, the Tor Project offers a small signature file with the same name and the extension .asc. It is an OpenPGP signature: a mathematical seal made by the developers with their private key. According to the Tor Project, a signature “ensures a package was generated by its developers and has not been tampered with.”

Why it matters to you: If even one byte of the installer changed after the developers signed it, through a fake site or a corrupted download, the check fails. That is something you can confirm yourself, rather than take on trust.

The signing key and its fingerprint

To check the seal, your computer needs the developers’ public key. A key fingerprint is a long string of letters and numbers that identifies one key; as of November 2026, the Tor Project’s verification page gives the fingerprint of the Tor Browser Developers’ signing key as EF6E286DDA85EA2A4BA7DE684E2C6E8793298290. Compare it with the official page itself rather than with any copy, including this one.

Why it matters to you: Verification proves that a file was signed by a particular key and not altered since. It is only as good as the key you check it against, which is why the key should come from the Tor Project, not from the same place as a doubtful download.

What verification does not do

A good signature tells you that your copy is the one the developers published. It does not make you anonymous, and it does not check whether your computer itself is in good health. It also says nothing about what you do once the browser is open: the next resources in this section cover the habits and checks that matter there.

Why it matters to you: Knowing the limit of a check stops it becoming a false comfort. It answers one question very well, and only that one.

The tool that does the checking

Signatures are checked with GnuPG (GNU Privacy Guard), free software that works from a command line, a text window where you type instructions. The Tor Project explains that on Windows you can install it with Gpg4win, and on macOS with GPGTools, whose package is now called GPG Suite. On Linux, it notes, “most GNU/Linux distributions come with it preinstalled.”

Why it matters to you: You install the checking tool once and can use it again for every new version, and for other software that publishes signatures in the same way.

First launch and the Connect to Tor window

When you start Tor Browser for the first time, the Tor Project explains that you will see the Connect to Tor window. “Connect” usually works without further setup; “Configure Connection” is for networks that are censored or use a proxy, and a toggle called “Always connect automatically” reuses your settings next time. If Tor is blocked where you are, a feature called Connection Assist can suggest a bridge, an alternative entry point to the network.

Why it matters to you: Seeing the connection screen, and choosing to connect, is part of a correct install. If you never see it, something is different from the official experience, and that is worth noticing.

C. A practical example: Marco’s two computers

Marco is 22, studies at university and spends a fair part of his evenings gaming. His desktop computer runs Windows; his laptop, for coursework, runs Linux. After the section of this course on surveillance and censorship, he decided he wanted a browser for reading about some topics without those visits sitting alongside his gaming accounts and university logins.

His first search turned up an advert promising a faster Tor Browser “with extra privacy features”. A friend on a gaming forum shared a direct download link to another copy. Marco nearly clicked both. Then he remembered that the point of the exercise was to reduce links to him, and that a copy he could not check would be a strange place to start.

What changed when Marco used the official route

He set aside one evening, a cup of tea and no deadline:

• He went to the Tor Project’s site by typing the address himself, and downloaded the Windows installer together with its matching .asc signature file.
• On Windows he installed Gpg4win, imported the developers’ key as the official page describes, and compared its fingerprint with the one on that page before checking the installer.
• On his Linux laptop, GnuPG was already there. His first attempt failed with “No such file or directory”: he had copied the example file name from the instructions instead of using the name of his own download. The Tor Project’s page mentions exactly this mistake.
• With both checks showing a good signature from the Tor Browser Developers’ key, he installed the browser on each computer, saw the Connect to Tor window and pressed Connect.

He did not report the forum link or worry about the advert. He simply ignored both, and made a note that the next update would come through the browser itself. Both installs together took less time than he had expected.

D. Try it yourself: install Tor Browser and verify it (40 minutes)

Five steps on one computer. The timings are generous for a first time; a second install, on another system, is much quicker. If anything in the official instructions has changed since this resource was written, follow the official instructions.

Step 1 — Find the official page and the key (5 minutes)

• Type the Tor Project’s address yourself, or follow the download link in section E, rather than using a search advert or a link in a message.
• Open the Tor Project’s page “Verify Tor Browser’s signature” in another tab and keep it open: you will follow it in Step 4.
• Note the last eight characters of the signing key fingerprint shown there, so you can recognise it later.

Step 2 — Download the browser and its signature (5 minutes)

• On the desktop download page, choose your system: Windows (an .exe file), macOS (a .dmg file) or Linux (a .tar.xz archive).
• Download the matching signature file as well, labelled “Sig” next to each download. Keep both in the same folder.
• If the Tor Project’s site does not load on your network, use the official mirrors or GetTor described on its “Downloading” page, never a random copy.

Step 3 — Prepare the checking tool (10 minutes)

• Windows: download Gpg4win from the link on the Tor Project’s verification page and run its installer.
• macOS: install GPG Suite from GPGTools, again from the link on that page.
• Linux: open a terminal and check that GnuPG is present; on most distributions it already is.

Step 4 — Verify the signature (10 minutes)

• Follow the official page step by step: it shows how to fetch the developers’ key from the Tor Project, save it to a keyring file and check your download against its .asc file. Copy its commands, but replace the example file names with the names of your own files.
• Before trusting the result, check that the key’s fingerprint matches the one on the official page.
• Look for a line saying “Good signature from” the Tor Browser Developers’ signing key. If importing the key gives an error, the page says you cannot continue until you have worked out why. If the check does not report a good signature, do not install: download again from the official page.

Step 5 — Install, launch and check for updates (10 minutes)

• Windows: double-click the .exe file and follow the installation steps. macOS: open the .dmg file and follow the steps on screen. Linux: extract the archive, open the Tor Browser folder and click the start-tor-browser.desktop file.
• At first launch, read the Connect to Tor window, then press Connect, or Configure Connection if your network needs it.
• Open the main menu (≡) and look for a sign that an update is waiting. When one appears, the Tor Project describes an “Update available – restart now” option.

One verified install is worth more than three quick ones: you now know what the genuine route looks like.

Already covered in the Online Security course

Download Security: Deciding Before You Install
It covers the general habit of checking where any software comes from and what an installer agrees to; this resource adds a way to prove, with a signature, that one particular anonymity tool is the genuine one.

E. Videos, articles and further resources

The Tor Project’s own instructions first, then the background and the checking tool. All in English.

Official Tor Project pages

The Tor Project — Download Tor Browser for Desktop
The official download page for Windows, macOS and Linux, with a signature file next to each download.
https://download.torproject.org/tor-browser-for-desktop/

The Tor Project — Downloading
Why the official site is the safest source, and the official mirrors and GetTor service to use if it is blocked.
https://support.torproject.org/tor-browser/getting-started/downloading/

The Tor Project — Verify Tor Browser’s signature
The step-by-step verification for Windows, macOS and Linux, the signing key fingerprint and the expected result.
https://support.torproject.org/tor-browser/getting-started/verifying-tor-browser/

The Tor Project — Installing
The install steps for each desktop system, plus what the Tor Project says about Android and iOS.
https://support.torproject.org/tor-browser/getting-started/installing/

The Tor Project — First launch
What the Connect to Tor window offers and what to do if Tor is blocked where you are.
https://support.torproject.org/tor-browser/getting-started/first-launch/

The Tor Project — Updating
How Tor Browser tells you an update is ready, and why staying up to date matters for anonymity.
https://support.torproject.org/tor-browser/getting-started/updating/

Background and tools

Electronic Frontier Foundation — Phony HTTPS Everywhere Extension Used in Fake Tor Browser
A 2019 account of a trojanised Tor Browser spread through fake update warnings and look-alike sites.
https://www.eff.org/deeplinks/2019/10/phony-https-everywhere-extension-used-fake-tor-browser

Gpg4win — About Gpg4win
What the free Windows package for checking signatures contains, and its origins with support from Germany’s BSI.
https://gpg4win.de/about.html

Links checked in November 2026. If an address changes, searching for the title on the organisation’s site usually finds it.

F. The Cyber Welfare Framework: Skills, Awareness, Secure Behaviour

This resource sits on the Skills pillar at level FL3 – Autonomous: getting an anonymity tool from the right place and confirming, by yourself, that it is genuine.

Skills

• Finding the official download page and the official alternatives if it is blocked.
• Checking a file’s signature against the developers’ key with GnuPG on your own system.
• Installing Tor Browser on Windows, macOS or Linux and reading the Connect to Tor window.

Awareness

• Understanding that a modified copy of an anonymity tool can create the links it claims to remove.
• Knowing what a good signature proves, and what it does not.
• Recognising paid, “faster” or “pro” editions of a free tool as a warning sign.

Secure Behaviour

• Downloading security and anonymity tools only from their developers or official mirrors.
• Stopping, rather than installing anyway, when a check fails.
• Letting the browser update itself promptly instead of hunting for new versions elsewhere.

G. Questions to sit with

• Where did the last few programs you installed actually come from, and could you have checked any of them?
• If a friend sent you a download link for a privacy tool, how would you reply without making them feel foolish?
• Which other software you rely on publishes a signature or a checksum that you have never looked at?

H. What to do now

The recommendations (R) and security measures (MS) from the Cyber Welfare database that apply most directly here.

1. Get the genuine browser

• R25 — Check an app is genuine: for Tor Browser, that means the official download page or its official mirrors, and a signature that checks out against the developers’ key.
• Ignore paid editions, adverts and shared download links. On a phone, the Tor Project points to Google Play, F-Droid or its own site for Android, and says there is no Tor Browser for iOS.

Minimum commitment: before your next install, open the Tor Project’s verification page and read it once, start to finish.

2. Keep it genuine over time

• R6 — Keep your software up to date: the Tor Project warns that “using an outdated Tor Browser puts you at risk of serious vulnerabilities and deanonymization.” Accept its update prompt from the main menu (≡) when it appears.
• Treat any update request that arrives by pop-up, advert or message, outside the browser itself, as a reason to stop and go back to the official site.

Minimum commitment: the next time Tor Browser shows that an update is available, install it the same day.

In short

• To install Tor Browser safely, start from the Tor Project’s download page, its official mirrors or GetTor, and nothing else.
• The .asc signature lets you confirm that your copy is the one the developers published and has not been altered.
• A good signature proves the file is genuine; it does not make you anonymous on its own.
• Updating through the browser itself keeps it genuine and current, with no new search for a download.

Discover more companion resources from the online courses of the Protect Your Digital Privacy programme.