Think like the censor#
Most guides to Tor bridges read like a menu. Here’s obfs4, here’s Snowflake, here’s WebTunnel, here’s meek, try them in that order. That’s helpful if one of them works. It’s far less helpful when none of them do, because a menu doesn’t explain why something failed or what to try next.
There’s a better way to understand bridges, and it starts on the other side. Every type of bridge exists because censors found a way to block the one before it. Each is an answer to a specific move. Once you know the moves, you can usually work out which one your network is making, and which answer is most likely to get through.
Censors have three basic moves against Tor.
- Block the list. Tor publishes the addresses of its relays so that clients can find them. A censor can download that list and block every address on it.
- Spot the fingerprint. Even if the censor doesn’t know an address, ordinary Tor traffic has a recognisable pattern. A censor can inspect traffic and block anything that looks like Tor.
- Block anything unusual. The most aggressive censors stop trying to recognise Tor at all. They allow only traffic that looks like something they approve of, and block the rest.
Each move is harder and more expensive for the censor than the one before, and each also does more damage to ordinary internet use. That’s the lever Tor’s anti-censorship tools pull on. The aim is to make blocking Tor cost the censor more than they’re willing to pay.
This guide walks through those three moves and the answers to each, then turns them into a practical ladder you can climb when Tor won’t connect. It also covers where to get bridges safely, the honest limits of all this, and how people in uncensored countries can help.
One note before you start. In a few countries, using circumvention tools carries legal risk of its own. If you’re unsure where you stand, read Is Tor Legal? Using Onion Services Responsibly. If you’d like to see what’s being blocked where you are, the Open Observatory of Network Interference, OONI, publishes measurements from around the world.
Move one: block the list#
Tor has to tell clients where its relays are, or nobody could connect. So the addresses of the several thousand public relays are published, and anyone can download them, including a government. Blocking all of those addresses is cheap and easy, and it’s the first thing most censors do. When people say “Tor is blocked” in a country, this is usually what started it.
The answer: bridges#
A bridge is a Tor relay that isn’t on the public list. Its address is handed out quietly, a few at a time, so a censor can’t simply download them all. You connect to the bridge, and the bridge connects you to the rest of the network.
That shifts the contest from “find the addresses” to “collect the addresses”, and that’s where the real struggle happens. Censors don’t give up. They try to gather bridge addresses in bulk, then feed them into their blocking systems. The Tor Project’s review of the year, Staying ahead of censors in 2025, describes exactly this pattern in Iran.
So the Tor Project hands out bridges through several channels, each designed to make bulk collection harder.
| Where bridges come from | How it works | What to know |
|---|---|---|
| Built into Tor Browser | A small set ships with the browser | Easy, but censors know them too. In China, for example, the built-in obfs4 bridges mostly don’t work |
| The bridges website | bridges.torproject.org hands out a few at a time, behind a CAPTCHA | You may need to reach it from an uncensored connection |
| The Telegram bot | Message @GetBridgesBot on Telegram | The Tor Project says this has worked well in Russia, because it’s harder for the censor to extract every bridge from it |
| Request bridges from the Tor Project by email | Useful where websites and Telegram are blocked | |
| Private bridges | Bridges not given to the public at all | For the hardest cases, such as China, the Tor Project’s support pages describe how to request them |
The Tor Project keeps working on smarter ways to ration bridges. Its anti-censorship team has been developing a trust-based system, called Lox, that gives more bridges to users who have used the ones they got without getting them blocked. It has also deployed newer approaches such as Conjure, which, according to its 2025 review, uses short-lived, hard-to-predict addresses provided by cooperating internet providers, so there’s no fixed list for a censor to collect.
Why a plain bridge isn’t always enough#
An unlisted address solves the list problem, but not the next one. If the traffic to that bridge still looks exactly like Tor, a censor that inspects traffic can spot it without knowing the address in advance. That’s move two.
Move two: spot the fingerprint#
Every kind of network traffic has habits, such as the size of the first few messages, the order things happen in, and the details of how encryption is set up. Ordinary Tor traffic has habits too, and they’re distinctive enough that equipment built to inspect traffic, often called deep packet inspection, can recognise it. A censor doing this doesn’t need a list of addresses at all. It just watches for anything that looks like Tor and blocks it.
The answer: pluggable transports#
Tor’s response was to separate how a bridge is found from how its traffic looks. The Tor Project calls the second part pluggable transports, small programs that disguise Tor traffic before it leaves your computer and remove the disguise at the bridge. Different transports use different disguises, and you can swap one for another without changing anything else about Tor.
obfs4: look like nothing#
The most widely used transport is obfs4. It scrambles Tor’s traffic so that, to an observer, it looks like a stream of random bytes with no recognisable pattern. There’s no handshake to spot and no familiar shape to match.
obfs4 has a second defence that matters just as much. Some censors don’t stop at watching. When they see a connection they’re suspicious of, they connect to that address themselves to test whether it’s a Tor bridge. An obfs4 bridge won’t respond properly unless the connecting side already knows a secret, which is part of the bridge line you’re given. To a probing censor, it just looks like a server that doesn’t answer.
That’s why an obfs4 bridge line looks so long. Besides the address, it carries the information your Tor needs to prove it’s allowed to talk to that bridge.
meek: look like a big cloud service#
meek takes a different approach. It routes your connection through a large content delivery network, the kind of infrastructure that serves huge numbers of ordinary websites, so the traffic appears to be going to that service. Blocking it would mean blocking a large slice of the ordinary web. The catch is that meek is slow and expensive for the Tor Project to run, so it’s best kept as a fallback. It’s available from Tor Browser’s built-in bridge options.
Where obfs4 starts to fail#
obfs4’s weakness only shows up against the most determined censors. Looking like nothing at all is, itself, a pattern. Most normal traffic looks like something, such as a website, a video call or an app’s data. A censor that decides to block anything it can’t identify will block obfs4 along with it. The Tor Project’s WebTunnel announcement explained this with the image of a coin-sorting machine. Coins of a known shape go into their slots, and anything that matches no slot is rejected. That’s move three.
Move three: block anything unusual#
The third move is the bluntest. Instead of trying to recognise Tor, the censor decides which traffic is allowed and blocks everything else. This is often called allowlisting. Ordinary web traffic gets through, along with whatever services the authorities approve of. Anything else, including traffic deliberately disguised as random noise, does not.
Allowlisting is expensive for a censor. It breaks a lot of legitimate software, annoys businesses and makes the internet worse for everyone. But some governments are willing to pay that price, and in 2025 and 2026 the Tor Project reported Russia moving more and more in this direction. There are two main answers, and they work in opposite ways.
WebTunnel: look like an ordinary website#
If the censor allows ordinary web traffic, the answer is to look exactly like it. That’s what WebTunnel does. It wraps your Tor connection inside what looks to an observer like a normal encrypted connection to a website, the same kind of HTTPS traffic that makes up most of the web. A WebTunnel bridge can even sit on the same domain and server as a real website, so blocking the bridge would mean blocking the site too.
WebTunnel was first tested in late 2022 and officially launched on March 12, 2024, the World Day Against Cyber Censorship. At launch, the Tor Project said it worked in places including China and Russia, but not yet in some parts of Iran.
It hasn’t stayed easy. According to reporting on the Tor Project’s 2025 review, by mid-2025 most WebTunnel bridges had been identified and blocked in Russia. The Tor Project responded with changes designed to make WebTunnel harder to pick out, including better imitation of the details a website connection reveals and support for certificates that don’t depend on public certificate authorities. It’s a clear example of how this works in practice. No transport is ever finished. Each one is in a running contest.
WebTunnel works in Tor Browser on desktop and Android, in Tails, and in the Tor Project’s Tor VPN Beta for Android since version 1.4.0. You get WebTunnel bridges from the bridges website or the Telegram bot, not from the built-in list.
Snowflake: be too many to block#
Snowflake doesn’t hide what it is so much as make itself impossible to pin down. Instead of a fixed bridge with a fixed address, it uses a large and constantly changing pool of temporary proxies run by volunteers, many of them people who’ve simply installed a browser extension or a small app. Your connection passes through one of these short-lived proxies to a Snowflake bridge. The traffic uses WebRTC, the same technology browsers use for video calls.
Blocking Snowflake by address is hard, because the addresses keep changing and belong to ordinary people’s home connections. The Tor Project says Snowflake is the most used circumvention tool in Iran. Censors do still try to block it by its traffic patterns. Tor Metrics, for example, recorded Russia blocking Snowflake connections in November 2024, and the Snowflake team has shipped repeated fixes in response.
Snowflake is built into Tor Browser, so you don’t need to request anything. Choose it from the built-in bridges.
When nothing gets through#
There’s one situation no bridge can solve. When a government shuts the internet down completely, there’s nothing to tunnel through. Tor Metrics recorded nationwide shutdowns in Iran in early 2026, for example. In those periods, the problem isn’t Tor. It’s that there’s no connection at all.
The transports side by side#
| Transport | Disguise | Strongest against | Main weakness |
|---|---|---|---|
| Plain bridge | None, just an unlisted address | Blocking of the public relay list | Recognisable as Tor traffic |
| obfs4 | Looks like random noise, resists probing | Traffic inspection that looks for Tor | Allowlisting, and bulk collection of addresses |
| meek | Looks like traffic to a large cloud service | Most forms of blocking | Slow, and costly to run |
| WebTunnel | Looks like an ordinary website | Allowlisting that permits normal web traffic | Bridges can still be collected and blocked |
| Snowflake | Many short-lived volunteer proxies | Address blocking | Traffic-pattern blocking, and it can be slower |
Diagnose, then choose#
Now the practical part. You usually can’t see exactly what your network is doing, but you can make an educated guess from how Tor fails, then climb a ladder of options from simplest to most robust.
Step zero: get the real Tor Browser#
Even if the Tor Project’s website is blocked, you can still get Tor Browser through its GetTor service, including the Telegram bot @GetTor_bot, or from official mirrors. Our guide How to Download and Install Tor Browser Safely covers each route and how to check the download is genuine. In censored countries, fake “Tor” downloads are especially common, as we explain in Fake ‘Dark Web’ Apps in 2026, so don’t skip verification.
The ladder#
- Try connecting normally. Open Tor Browser and connect. If Tor is blocked, recent versions of Tor Browser include Connection Assist, which, according to the Tor Project’s support pages, tries to connect automatically using a bridge or Snowflake.
- Try Snowflake. It’s built in, needs no setup, and is hard to block by address. Choose it from Tor Browser’s built-in bridges.
- Request bridges. If the built-in options fail, get fresh obfs4 or WebTunnel bridges from @GetBridgesBot on Telegram, the bridges website or by email, and enter them as a bridge you already know.
- Switch disguises. If obfs4 bridges fail where Snowflake or ordinary websites work fine, your network may be blocking unusual traffic. Try WebTunnel.
- Fall back to meek. It’s slow, but it often gets through when others don’t. It’s in the built-in options.
- Ask for a private bridge. In the hardest cases, such as China, the Tor Project’s support pages explain how to request bridges that aren’t handed out publicly.
Reading the symptoms#
These are rough rules of thumb, not a diagnosis. Censorship can be patchy, and it can change from one week to the next.
| What you see | What the network may be doing | What to try |
|---|---|---|
| Tor never connects without bridges, but works with any bridge | Blocking the public relay list | Any bridge. Snowflake is easiest |
| Built-in bridges fail, fresh ones from the bot work for a while | Collecting and blocking known bridges | Fresh bridges, Telegram bot, then private bridges |
| obfs4 fails even with fresh bridges | Inspecting traffic, or allowing only known kinds | WebTunnel, Snowflake |
| Snowflake connects but is very slow or drops | Pattern-blocking or interfering with Snowflake | WebTunnel, or try at a different time |
| Nothing works, including ordinary websites | A wider shutdown | No bridge can help until the connection returns |
Where it works#
Bridges, including Snowflake and WebTunnel, work in Tor Browser on desktop and Android, in Tails, and in the Tor Project’s Tor VPN Beta for routing other apps. Orbot supports them on Android and iPhone too, as covered in Using Tor on Android and iPhone. You can save working bridges so you don’t have to enter them every time, in Tor Browser’s settings or in Tails’ Persistent Storage.
Check that it’s working#
Once connected, visit the Tor Project’s connection check in Tor Browser. If it says the browser is configured to use Tor, your bridge is doing its job.
Get bridges only from the Tor Project#
Bridges are only useful if they come from someone you can trust. Use the bridges website, the official Telegram bot, the Tor Project’s email service, or the built-in options. Once you’re connected, the Tor Project’s own sites, including the bridges site, are also reachable over onion, as listed in Tor Project’s Official Onion Sites.
Be wary of bridge lists posted on forums, social media or random websites. At best, they’re already blocked. At worst, a bridge run by someone hostile could help them see that you’re using Tor and when, even though it can’t see what you do. The same caution applies to link lists in general, as we explain in Why Most ‘Hidden Wiki’ Lists Are Full of Scams.
What bridges don’t do#
Bridges solve one problem, getting onto the Tor network when your network tries to stop you. They don’t change anything else, and it’s worth being clear about their limits.
- They don’t make Tor invisible to everyone. Disguises make Tor harder and more expensive to block. They don’t guarantee that a determined, well-resourced observer can never tell you’re using it.
- The first hop knows your address. A bridge, like any first relay, knows your IP address, and so does a Snowflake proxy. Neither can see what you’re doing, because your traffic is encrypted, but they do know someone at your address is using Tor. That’s another reason to get bridges only from the Tor Project’s own channels.
- They don’t hide who you are from websites. Once you’re connected, Tor protects you in exactly the same way it always does, no more and no less. Logging in to an account still tells that service who you are.
- They’re usually slower. Disguises add work, and some transports, especially meek and sometimes Snowflake, add noticeable delay.
- They don’t change the law. In a few countries, using circumvention tools can itself carry legal risk. Read Is Tor Legal? Using Onion Services Responsibly and, if the stakes are high, talk to a local digital rights group.
Keep your bridges to yourself#
If you find a bridge that works, don’t post it publicly. Anything shared on a public forum or channel is visible to censors too, and will be blocked soon after. Sharing privately with someone you trust is different, though they’d usually do better getting their own from the Tor Project.
Helping others connect#
If you live somewhere Tor isn’t blocked, you can help people who aren’t so lucky. Each of these makes blocking Tor more expensive for censors.
| How you can help | What it involves | Legal exposure for you |
|---|---|---|
| Run a Snowflake proxy | A browser extension, a small program, or the Tor Project’s Snowflake Volunteer app for Android, launched in August 2026 | Very low. Traffic doesn’t leave the Tor network from your address |
| Run an obfs4 bridge | A small server, following the Tor community’s guide | Low, similar to a middle relay |
| Run a WebTunnel bridge | A server, a domain name and a web server set up as a normal-looking website | Low, but more setup work |
| Donate | Supports the anti-censorship team that keeps the transports ahead of censors | None |
Running a Snowflake proxy is the easiest place to start. Visit the Snowflake website to install it. The proxy only works while your browser or the app is running, and you can turn it off at any time. For bridges, the Tor community’s relay and bridge guides explain the requirements. For donations, the Tor Project’s donation page is the official one. And to follow what’s happening, the Tor Project forum’s anti-censorship discussions are where operators and users compare notes.
The Tor Project’s 2025 review made the point plainly. Its anti-censorship work depends on volunteers, monitoring and fast feedback from people in censored countries. Every proxy and bridge adds to the pool a censor has to chase.
Where to go next#
- Can’t download Tor Browser? Follow How to Download and Install Tor Browser Safely, including GetTor and the official mirrors.
- Need Tor for other apps on your phone? Read our Tor VPN beta overview, or Using Tor on Android and iPhone.
- Need nothing left behind on the computer? See Tails 7.14.
- Worried about the law where you live? Read Is Tor Legal? Using Onion Services Responsibly.
- Once you’re connected, where to go? Start with the Official Onion Mirrors Directory and News Onion Sites.
- Curious about the software underneath? Read Arti 2.7.0: Tor’s Rust Rewrite Explained.
- Keeping Tor Browser current? See Tor’s September 2026 Security Fixes.
Sources#
- Staying ahead of censors in 2025: What we’ve learned from fighting censorship in Iran and Russia, Tor Project blog
- Hiding in plain sight: Introducing WebTunnel, Tor Project, March 12, 2024
- Tor highlights evolving censorship evasion tactics during its most challenging year, CyberInsider
- Connecting from censored regions, Tor Project support
- Tor Metrics news and events, Tor Project
- Tor bridges, Tor Project
- Snowflake, Tor Project
- Tor’s new WebTunnel bridges mimic HTTPS traffic to evade censorship, BleepingComputer, March 2024