VPN vs Tor: Which One Fits Your Threat Model?
Neither is simply more private. Each hides different things from different observers.
People often ask which is more private as if there were one answer. There is not. The two tools protect against different observers, and each has weak spots. Security researchers call this your threat model: who might watch you, what they could learn, and what happens if they do. This guide walks through both tools in plain language and ends with a simple way to choose.
How a VPN works
A VPN sends all your device's traffic through an encrypted tunnel to one server run by the provider. Websites see the provider's address, and your ISP or Wi-Fi operator sees only that you are connected to the VPN. The weak point is concentration of trust: the provider sits in the middle and can, in principle, see where your traffic goes. That is why audits, ownership and policies matter, and why we cover them in our no-logs policy explainer and our guide to who owns your VPN.
How Tor works
Tor (short for "The Onion Router") sends your traffic through a chain of relays run by volunteers. By default a connection passes through three of them, and each layer of encryption is peeled off one hop at a time. The first relay knows who you are but not where you are going. The last relay (the exit) knows where you are going but not who you are. No single relay is supposed to know both. The Tor Browser is the usual way to use it, and it adds protections against browser tracking.
That design spreads trust instead of concentrating it, which is why Tor is the standard tool in high-risk situations.
What each tool hides
| Observer | Plain connection | VPN | Tor Browser |
|---|---|---|---|
| Wi-Fi operator or ISP | Sees destinations and timing | Sees a connection to the VPN server | Sees a connection to Tor (unless bridges are used) |
| Websites you visit | See your IP address | See the VPN server's address | See an exit relay's address |
| The service in the middle | Not applicable | The provider can see where your traffic goes | No single relay sees both ends, by design |
| Apps outside the tool | Unprotected | Covered by default | Only the Tor Browser is covered unless you configure more |
Trade-offs that matter in real life
- Speed. Tor routes through several volunteer relays, so pages are slower and video can be impractical. A VPN is usually much closer to your normal speed, though results vary by provider and server.
- Website friction. Some sites show extra challenges or block traffic from Tor exit addresses, and some also treat VPN addresses with suspicion.
- Coverage. A VPN protects your whole device. Tor Browser protects only itself.
- Exit visibility. At the exit, traffic that is not protected by HTTPS can be read by whoever runs that relay. Always use HTTPS sites in Tor.
- Visibility of the tool itself. Your network operator can often see that you are using Tor, which can matter in places where it is restricted. A VPN is visible too, which is why stealth options exist. See VPN obfuscation explained.
Match the tool to the threat
- Shared Wi-Fi, snooping neighbors, your ISP's view of your browsing. A reputable VPN covers this well. See our ISP visibility guide and the public Wi-Fi guide.
- Streaming and everyday region access. A VPN, since Tor is too slow and is not designed for it.
- Researching sensitive topics with a real risk of being targeted. Tor Browser used carefully is built for this, ideally with guidance from a digital security trainer.
- Journalists, activists and people in hostile environments. Layered tools and operational discipline matter more than any one app. Read our journalist guide and seek expert advice for high-stakes work.
- Avoiding advertisers and trackers. Neither tool does this alone. Browser tracking depends on cookies and fingerprinting. Tor Browser helps with that, a VPN does not.
Mistakes that undo the protection
- Logging into personal accounts in Tor Browser and then expecting the session to be anonymous. The site knows who you are.
- Installing extra browser add-ons in Tor Browser, which can make your browser fingerprint more unusual.
- Maximizing the window or changing defaults without understanding why they exist. The browser's defaults are chosen to make users look alike.
- Trusting a VPN with no track record. The provider sits in the middle of your traffic, so a careless or dishonest one is the main risk. Our audit report card explains how to read audit claims.
- Believing a tool replaces habits. Strong passwords, two-factor login and caution with downloads matter regardless of which tool you use.
What about using both?
Some providers advertise a feature that routes VPN traffic through Tor, and you can also run Tor Browser while connected to a VPN. This can hide the use of Tor from your ISP and add a layer, but it also adds complexity and a new party to trust, and it can introduce configuration mistakes. For most people a single tool used properly is better than two used badly. Our explainer on double VPN covers a related idea. If you are weighing multi-layer setups, get advice from someone who understands your specific risk.
Legal and ethical note
Both tools are legal in many countries, but not everywhere, and neither makes an illegal activity lawful. Rules can differ for Tor and for VPNs. Check an official source for your location. Our guide to VPN laws by country is a place to start for VPNs.
Where this leaves you
If your concern is Wi-Fi snooping, your ISP and general privacy, a trustworthy VPN is the better fit. If your concern is a powerful adversary and you can accept the slowdown, Tor Browser is designed for it. If you need both, learn each tool properly before combining them. For help choosing a VPN, start with our buying checklist.
Choosing a VPN for everyday privacy?
Both links below are affiliate links; see the disclosure at the top, and use the refund window to test any provider.