The riskiest moment is before Tor is even running#
Consider the kind of people who search for “download Tor Browser”. They are journalists, activists, and individuals in countries where the news can be censored. There are also those who have just been advised by a friend to be more careful when using the internet. Almost all of them are about to install software meant to protect them, and almost none of them currently have any protection at all.
Hence the download becomes one of the most tempting targets on the internet. An attacker need not break Tor at all. It is enough for them to get you to trust the wrong Tor Browser for about thirty seconds. Everything that Tor does afterwards, including the relays and the encryption, is based on the assumption that the browser in front of you is the genuine one.
This guide does not present installation as something you should rush through. Instead, it treats it as a short chain of trust, with four links which you can verify yourself.
- The place you download from. Is the site actually the Tor Project?
- The file you get. Is it the one the Tor Project built, without any changes?
- The key that signed it. Is that key actually the Tor Project’s?
- The updates that follow. Will the browser stay up to date without you having to do anything risky?
As long as all four hold, you’ll be fine. Most people only have to get the first one right. We’ll look at all four, and also at something that is currently catching people out. In September 2026 the certificate that Tor uses to sign its Windows installers expired, and many new Windows users are now seeing a frightening warning, even though this time the explanation is harmless.
Where fake Tor Browsers actually come from#
It’s useful to know what you’re avoiding. Fake Tor installers seldom arrive looking suspicious. Instead, they appear to be helpful.
Search ads. The top result when searching for ‘Tor Browser download’ may be an advertisement rather than the official Tor Project page. Advertisements can direct users to any website, and fake download pages with a purple onion logo are easy and cheap to produce. The solution is straightforward. Don’t click on ads for software, and enter the website address yourself instead.
App stores. If you search for “Tor” or “dark web browser” on Google Play or the App Store, you’ll come across dozens of applications with onion icons. A few of these are genuine, but many are adware and some collect the text that you type. There is no Tor Browser for the iPhone at all, which means that any app in the App Store calling itself “Tor Browser” is not made by the Tor Project. We maintain a current list in Fake ‘Dark Web’ Apps in 2026: What to Avoid.
Software download sites. Large freeware portals often bundle Tor Browser inside their own installer, which may add toolbars, ‘offers’ or worse. Even if the Tor component is not altered, there is no way for you to know, and their copy is often several versions behind.
“Portable” and “pre-configured” builds. Forum posts and file-sharing sites sometimes offer a Tor Browser that has been “set up for you” with extensions or settings already altered. These modifications are precisely the kind you should avoid, since they make your browser differ from everyone else’s. Moreover, some of them are simply malware.
Links in dark web lists. Ironically, among the worst offenders are old ‘hidden wiki’ pages that link to their own ‘Tor download’. We explain why these lists should not be trusted in Why Most ‘Hidden Wiki’ Lists Are Full of Scams.
Notice the pattern. None of these attacks affect the Tor network. They all take place before you even connect, at the stage when you’re choosing which file to trust.
The only sources that count#
The number of places where you can safely get Tor Browser is small, and that is a good thing, since it’s easy to remember.
The Tor Project’s own website. The download page is at download.torproject.org and is accessed over HTTPS. Type that address directly into your browser’s address bar rather than clicking on a link. This is the right option for nearly everyone.
Official mirrors. If the Tor Project’s website is blocked where you are, the organisation provides two official mirrors, one run by the Electronic Frontier Foundation at tor.eff.org and the other known as La Cebolla at lacebolla.net. These mirrors host the same signed files.
GetTor. In regions where all Tor-related websites are blocked, GetTor is the Tor Project’s way of getting the browser to you through channels that are difficult to block. You can send a message to @GetTor_Bot on Telegram, or email [email protected] with just the word windows, osx, linux or android in the body of the message. GetTor then replies with download links hosted on large services such as GitHub or Google Drive, together with the signature file, so that you can still verify what you have received.
On Android. Tor Browser for Android is published by The Tor Project on Google Play, and the APK can also be downloaded from the official download page. Check the developer name before you tap install.
On iPhone and iPad. There is no Tor Browser for iOS. The app the Tor Project recommends is Onion Browser, which is a separate project. Our guide to using Tor on Android and iPhone outlines the differences and shows how to identify the genuine listings.
That is the entire list. If a website you’re unfamiliar with offers you Tor Browser, the answer is no, even if it looks entirely legitimate. And if you got the browser some other way in the past, the best course of action is to delete it and start again from one of the sources above.
Installing it, platform by platform#
The latest stable version is Tor Browser 15.0.24, which was released on September 29, 2026. It is based on Firefox 140.17.0esr and includes Tor 0.4.9.13, the emergency security release from September 23. For a full account of what changed, see our Tor Browser 15.0.24 release notes. Here is how to get the browser running on each system.
Windows, and the certificate warning#
Windows also checks a type of signature that other systems do not. Software publishers sign their installers using a code-signing certificate, and Windows warns you when that certificate is not valid. The DigiCert certificate that the Tor Project uses for this purpose expired on September 1, 2026, and the renewal has been delayed. Consequently, people installing versions 15.0.21 or later from scratch on Windows receive a ‘bad signature’ style warning.
The Tor Project’s workaround is a bit unusual, so it’s worth explaining.
- The download page currently offers Tor Browser 15.0.20 for Windows. That is the last version signed before the certificate expired, so it installs without any warning.
- Tor Browser then updates itself. Once it has been installed and connected, it upgrades to the latest version. Updates are signed with a different key that has nothing to do with the expired certificate, which is why this works normally.
- You can also install 15.0.24 directly. The Tor Project says that if you prefer, you can download it from its distribution directory at dist.torproject.org/torbrowser/15.0.24/ and accept the expiry warning. In that case, verify the PGP signature as explained in the next section, since that is now the check doing the real work.
To install, run the file you downloaded, select a language and choose a folder. By default, it is placed on your Desktop as a self-contained folder rather than in Program Files. Then open ‘Tor Browser’ from that folder.
This situation is only temporary. Once the certificate has been renewed, the download page should go back to offering the latest version for Windows. For further updates, see our release notes post.
macOS#
Download the .dmg file, open it, and drag Tor Browser into your Applications folder. The first time you launch it, macOS will ask if you are sure you want to open an application downloaded from the internet. This is entirely normal. A warning that the application is damaged or comes from an unidentified developer is not normal, however, and in that case you should delete the file and download it again.
Linux#
Download the .tar.xz file and extract it somewhere in your home folder. You will then find a file called start-tor-browser.desktop, which you can run directly. If you run it once with the –register-app option, Tor Browser will be added to your applications menu. Avoid running it as root, since it doesn’t need to run that way and shouldn’t.
Several distributions also include torbrowser-launcher, a small program that downloads Tor Browser from the Tor Project and verifies its signature for you. It is a sensible choice if you prefer not to do the verification by hand. One final point for older machines. The changelog for version 15.0.24 indicates that 32-bit Linux support ends with the 15.0 series, so if you are using 32-bit hardware, this is a good moment to start planning your move.
Android#
Get Tor Browser from Google Play, making sure the developer is listed as The Tor Project, or download the APK from the official download page. Be careful, as there are many apps that look like it. Orbot, which is developed by the Guardian Project, is a separate app that routes other apps through Tor. It is not a browser. The Tor Project is also testing its own Android VPN, which we cover in our Tor VPN beta overview.
Checking the signature, and what it actually proves#
Next to every file on the Tor Project’s download page there is a matching signature file with the .asc extension. Verifying it takes around five minutes the first time and less after that. It isn’t necessary for most people who downloaded directly from download.torproject.org, but it becomes important if you used a mirror, GetTor, or the Windows workaround above.
It is important to understand what the check tells you. A good signature shows that the file was signed by whoever holds the Tor Browser Developers private key, and that not a single byte has changed since. By itself, however, it does not prove that the key belongs to the Tor Project. That depends on the fingerprint, which is why you should compare it with the one the Tor Project publishes on its own support site.
The Tor Browser Developers signing key fingerprint is
EF6E 286D DA85 EA2A 4BA7 DE68 4E2C 6E87 9329 8290
The steps#
- Install GnuPG. On Windows use Gpg4win, on macOS use GPG Suite, and on Linux it is very likely already installed.
- Get the key. In a terminal or command prompt, run the following.
gpg --auto-key-locate nodefault,wkd --locate-keys [email protected]- Check the fingerprint in the output against the one above, all 40 characters.
- Save the key to a file so the next command only trusts this key.
gpg --output ./tor.keyring --export 0xEF6E286DDA85EA2A4BA7DE684E2C6E8793298290- Verify the download, swapping in your real file names.
gpgv --keyring ./tor.keyring tor-browser-FILE.asc tor-browser-FILEIf you see a line saying Good signature from “Tor Browser Developers (signing key)”, you can proceed. If you see anything else, stop. Delete the file and download it again from one of the official sources. Do not run it to find out what happens.
The new subkey in 15.0.24#
From 15.0.24 onwards, releases are signed with a new subkey under the same main key. If you have verified Tor Browser downloads before and find that your check now fails, this is most likely the reason. Refresh the key you already have, and the new subkey will come with it.
gpg --refresh-keys EF6E286DDA85EA2A4BA7DE684E2C6E8793298290The fingerprint you compare stays the same. It’s the main key’s fingerprint, and that hasn’t changed.
Two signatures, two different jobs#
The Windows situation shows that this check matters more than it might first appear. The Windows certificate warning and the PGP signature are entirely separate systems. Since the certificate has expired, Windows gives a warning. The PGP signature, on the other hand, is not affected, so a file that triggers the Windows warning can still pass the PGP check perfectly. When the two disagree, as they do now, trust the PGP check, provided you have confirmed the fingerprint yourself. The same habit of checking the entire identifier against the owner’s own published value is exactly what we ask you to do with onion addresses in How to Verify an Onion Address Is Official.
First launch#
When you first open Tor Browser, you will see a “Connect to Tor” screen instead of a web page. In most cases all you have to do is click Connect. A progress bar then appears, and after anything from a few seconds to a minute you will be on the Tor network.
There is a toggle called Always connect automatically. Turning it on saves a step every time and suits most people. However, if you are somewhere that using Tor might attract attention, you may prefer to leave it off, so that the browser does not try to connect to the network as soon as it opens.
If it won’t connect#
If the progress bar stalls, Tor may be blocked on your network. Tor Browser includes a feature called Connection Assist, which can choose a bridge for you based on your location. If it can’t work out where you are, you can select your region from a list and click Try a Bridge.
Bridges are unlisted entry points into the Tor network, and some of them disguise Tor traffic as something else. If Connection Assist can’t get you through, you can set one up manually under Configure Connection. Our guide to bridges, Snowflake and WebTunnel explains which type tends to work where, and how to get bridge addresses when the usual methods are blocked.
Pick a security level before you browse#
Once you’re connected, click the shield icon in the toolbar. Tor Browser offers three security levels, Standard, Safer and Safest. Standard keeps every feature working. Safer disables JavaScript on websites that don’t use HTTPS and blocks certain fonts and media features. Safest turns off JavaScript on all websites and breaks many modern sites in exchange for a much smaller attack surface.
There’s no wrong answer, but there is a wrong time to decide, and that’s after you’ve already visited a risky site. Our guide Tor Browser Security Levels: Standard vs Safer vs Safest explains exactly what each level disables and which websites break at each step, so that you can choose before you begin.
Staying updated, and why September 2026 matters#
The fourth link in the chain is the one people tend to overlook. Once a perfectly verified Tor Browser falls out of date, it becomes a risk.
September 2026 showed just how quickly that can happen. Tor Browser 15.0.22 was released on September 9, 15.0.23 on September 15, and 15.0.24 on September 29. Underneath these releases, the Tor Project issued two emergency versions of Tor itself, 0.4.9.12 on September 8 and 0.4.9.13 on September 23, the latter fixing ten tracked vulnerabilities across relays, clients and onion services. Someone who installed carefully in August and then ignored updates would have been three versions behind within a month. Our article on Tor’s September 2026 security fixes explains what those bugs could do. In the longer run, the Tor Project’s Rust rewrite should make releases like these rarer, as we explain in Arti 2.7.0: Tor’s Rust Rewrite Explained.
The good news is that there’s very little you have to do. Tor Browser checks for updates automatically, downloads them over Tor, and verifies them with its own signing key before installing them. When an update is ready, you’ll see a prompt asking you to restart. Do it.
A few habits help.
- Restart when asked. The update isn’t applied until you restart Tor Browser.
- Check the version occasionally. Open the menu and select About Tor Browser. That screen shows your version and checks for a newer one.
- Never update from a new source. Don’t update by downloading a fresh copy from somewhere else. If an update seems stuck, go back to download.torproject.org, not to a search result.
- Stay on stable. The Tor Project also releases alpha versions, currently the 16.0 series, for testers. Testers get new features first, and new bugs first. You’re welcome to read about what’s coming in Tor Browser 16, but don’t use the alpha if your safety depends on it.
If your needs go beyond what a browser can provide, for instance you want nothing to remain on the computer once you’ve finished, consider Tails. It is a complete operating system that routes all your activity through Tor and erases everything when you switch it off. We cover the latest version in Tails 7.14: The Amnesic OS That Routes Everything Through Tor.
Mistakes people make after installing#
Even a genuine, up-to-date Tor Browser can be undermined by how it is used. These are the mistakes we see most often.
Adding extensions. Tor Browser comes with everything it actually needs. Any extension you install, even a well-known ad blocker, makes your browser look different from everybody else’s, and looking the same as other Tor users is a major part of how it protects you. Some extensions also leak information directly.
Changing hidden settings. Editing the about:config page or following a forum tutorial to ‘optimise’ Tor Browser has the same effect as adding an extension. You end up with a custom configuration, which is the very thing you were trying to avoid.
Logging in to your everyday accounts. Tor conceals your location, but it can’t hide who you are once you’ve logged in to your personal email or social media. That’s fine if it’s what you intend, but combining your real identity with anonymous browsing in the same session links the two. If you do use webmail over Tor, our guide to secure email over Tor covers sensible account habits.
Opening downloaded files while online. Documents such as PDFs and Word files can contain links or embedded content that your computer fetches outside Tor when you open them. If you need to open a file you downloaded through Tor, disconnect from the internet first, or open it inside Tails.
Using Tor for torrents. BitTorrent clients don’t send all their traffic through Tor and often expose your real IP address to other peers. They also slow the network down for everybody else.
Trusting the first onion link you find. Installing Tor Browser correctly is only half the task. The other half is getting the right addresses. Fake mirrors of genuine websites are common, and we explain how they work in Onion Phishing: How Fake Mirrors Clone Real Addresses. The safest starting point is our Official Onion Mirrors Directory, where each address is linked to its owner’s own proof page.
Finally, using Tor is legal in most countries, though not in all of them, and what you do on it is still covered by the law. If you’re not sure where you stand, read Is Tor Legal? Using Onion Services Responsibly before you begin.
Where to go next#
- Just installed it? Choose your setting in Tor Browser Security Levels: Standard vs Safer vs Safest.
- Curious what you’ve actually connected to? Read What Is an Onion Service? .onion Addresses Explained.
- Ready to visit some real onion sites? Start with the Official Onion Mirrors Directory, including the Tor Project’s own official onion sites.
- Want private search or news? See our pages on search engines with official onion sites and news onion sites.
- Want to know who we are? See About thehidden.wiki, or browse the rest of Getting Started.
Sources#
- New Release: Tor Browser 15.0.24, Tor Project blog, September 29, 2026
- How to verify Tor Browser’s signature, Tor Project support
- How to download Tor Browser, Tor Project support
- Running Tor Browser for the first time, Tor Project support
- Tor Blog, release posts for Tor Browser 15.0.22, 15.0.23 and 16.0a13, September and October 2026
- Massive security flaws affect entire Tor network, Cybernews, September 2026
3 comments