The shield isn’t a privacy dial#
In the toolbar of Tor Browser there is a small shield icon, and most people think it works like a privacy slider. The higher you set it, the more anonymous you become, and the lower you set it, the less anonymous you are.
It doesn’t do exactly that, and the difference matters when you are deciding where to set it.
The anonymity Tor Browser offers comes mainly from two things the shield does not touch. The Tor network masks the location you are connecting from, and the browser is built so that every copy looks as identical as possible to the websites you visit. These protections are active at every level, including the lowest.
The shield controls something different. It decides how much of the modern web your browser is prepared to run. That includes JavaScript, certain fonts, media players, and the engine features that make complex sites load quickly. All of these are code that a website can send to your computer, and each of them has at some point had bugs that let a malicious website escape from the browser.
It’s more useful to think of the shield as an exploit dial. When you turn it up, the amount of code an attacker can target goes down. When you turn it down, you get back a working web. The right question isn’t “How private do I want to be?” but rather “How likely is it that someone will try to break into my browser, and how much of the web am I willing to give up to make that harder?”
This guide answers that question based on the situation in October 2026. It covers exactly what each level switches off, what breaks, a cost that most guides leave out, and how to choose. If you haven’t installed Tor Browser yet, begin with How to Download and Install Tor Browser Safely, since none of what follows helps unless the browser itself is genuine.
What attackers actually go after#
It is very difficult to attack the Tor network directly. Doing so generally means monitoring vast sections of the internet at the same time, which is beyond almost everybody. Attacking a single browser, on the other hand, is a far simpler task. If someone can run code on your computer, they don’t need to overcome Tor’s routing at all. They can simply ask your machine for its real IP address and send it home directly.
This isn’t just theory. The two best-known attacks on Tor users both worked this way.
In 2013, a number of onion sites hosted by a company called Freedom Hosting started serving a JavaScript exploit to their visitors. The exploit targeted a flaw in the version of Firefox that Tor Browser was based on at the time, and it sent visitors’ real addresses to a server outside the Tor network. The FBI later admitted it was behind the operation. In 2015, during another investigation, a similar method was used against visitors to a single onion site, and this became public the following year. Separately, in November 2016, a Firefox bug exploited through JavaScript was found being aimed at Tor Browser users.
What all of these attacks had in common is that they needed the browser to run code the website sent it. In most cases that code was JavaScript. Visitors whose browsers refused to run it were not affected.
It is worth being clear about what this means for you. Most people who use Tor will never be the target of anything like this. Such attacks are costly, and they have in the past been aimed at particular websites rather than at Tor users as a whole. Nevertheless, the risk is not evenly spread. It is concentrated on people visiting websites that someone powerful is interested in, and on people who are of personal interest to someone powerful. If either applies to you, the protection the shield offers is very significant.
Where the bugs live#
Although modern browsers are very large, the bugs that can be exploited cluster in only a few areas.
- The JavaScript engine. It is the most complex part of any browser, and the parts that make JavaScript fast, known as just-in-time compilers, are often the source of serious flaws.
- Font and graphics handling. Browsers have to parse the fonts, SVG images and mathematical notation that websites supply, and parsing untrusted files is a common cause of memory bugs.
- Media decoders. Audio and video formats are complex, and the code that plays them has needed a long series of security patches over the years.
Now look at the list of things the security levels switch off. It’s no accident that it’s mostly this list.
What each level switches off#
This is what the Tor Project says each level does, according to its current support documentation.
| Feature | Standard | Safer | Safest |
|---|---|---|---|
| JavaScript on HTTPS sites | On | On | Off |
| JavaScript on plain HTTP sites | On | Off | Off |
| Some fonts and math symbols | On | Off | Off |
| Some icons and images | On | On | Off |
| Audio and video (HTML5 media) | Plays normally | Click to play | Click to play |
| What the Tor Project says it’s for | Every feature enabled | Disables features that are often dangerous | Only what static sites and basic services need |
A few details aren’t obvious from the table.
Standard is still Tor Browser. At the lowest level you keep all the protection that Tor provides, together with the browser’s anti-fingerprinting features. You just don’t reduce the attack surface any further.
Safer is mainly about plain HTTP. On a website served without encryption, someone between you and the site, such as a malicious Tor exit relay, could inject JavaScript into the page. Safer prevents this by refusing to run JavaScript on unencrypted sites. On HTTPS sites, where that kind of injection is much harder, JavaScript is still allowed to run. Safer has also, in the past, disabled some of the JavaScript engine’s speed optimisations, which is where many of the most serious bugs have been found.
Onion sites count as secure. Tor Browser treats a connection to a .onion address as encrypted end to end, even if the address begins with http rather than https. That is correct, since onion connections are encrypted by design, as we explain in What Is an Onion Service? It also means that JavaScript usually keeps running on onion sites at Safer. If you want JavaScript switched off on onion sites as well, Safest is the setting that does it.
Safest is close to a document reader. With JavaScript disabled everywhere and some images and fonts blocked, the web turns back into something like pages of text and pictures. That’s the idea. A page that cannot run code has far fewer ways of attacking you.
Click to play is a real decision. At Safer and Safest, audio and video won’t start unless you click. Every click is you agreeing to run a media decoder on whatever that site has sent you. Don’t click on media you didn’t expect.
The cost nobody mentions: you join a smaller crowd#
Here is the part most guides omit. Tor Browser provides some of its protection by making all users look identical. Websites can measure a large number of small things about your browser, such as the screen size, the fonts, the way it renders graphics and the features it supports, and combine them into a fingerprint. Tor Browser works hard to give everyone the same fingerprint, so that you become part of a crowd of millions.
The security level is one of the very few things that divides that crowd. A website can generally tell which level you’re on. With Safest it’s clear, since JavaScript doesn’t run. With Safer it’s less obvious, but missing fonts and disabled features can also be measured.
Choosing a setting is effectively choosing which group to stand in. Most Tor users keep the shield at Standard, which makes it the largest group. Safer and Safest are smaller groups. You will still be one of a very large number of people, and this is nowhere near as identifying as installing an extension or altering hidden settings. Yet it is a real compromise, and it’s the honest reason the Tor Project does not simply set Safest as the default for everyone.
There’s a second, more practical point. Switching between levels during a single session makes you more distinctive than staying at the same level. A website that sees you arrive at Safest and then sees the same session reload at Standard has learned something about you. So if you need to change level, do it before you begin, or use New Identity afterwards to start a fresh session.
None of this is a reason to avoid Safer or Safest. For someone who might be a target, a smaller attack surface is worth far more than a slightly larger crowd. It is, however, a reason to choose a level carefully and stay with it rather than switching back and forth.
What breaks in practice#
The short answer is that Standard breaks nothing, Safer breaks very little, and Safest breaks a lot. However, the pattern of what breaks is more useful than the summary.
At Safer#
Most of the modern web keeps working, since nearly all of it now uses HTTPS. You may come across a missing icon, or a maths formula drawn incorrectly where a site depended on a blocked font. Videos and audio stay inactive until you click on them. The pages most likely to fail completely are old ones still served over plain HTTP that need JavaScript to display anything, and those are becoming rarer.
At Safest#
This is where you notice it. Any service that acts more like an application than a document is likely to fail. Examples include webmail, chat, online banking, maps, search results that load as you scroll, and most login forms that depend on JavaScript. Some websites will show a blank page or a message asking you to turn JavaScript on.
What tends to survive is text. News articles, blogs, documentation, forums with simple designs and Wikipedia-style reference pages are usually just as readable, if not more so, without the scripts. Some services anticipate this. DuckDuckGo, for instance, provides a basic HTML version of its search that does not require JavaScript.
On onion sites#
The websites in our Official Onion Mirrors Directory follow the same pattern. The news onion sites, such as the BBC and Deutsche Welle, mainly consist of articles and are therefore good candidates for Safest. Webmail services such as Proton Mail need JavaScript to work, so you will need Standard or Safer to use them, as we explain in our guide to secure email over Tor. Search engines with official onion sites fall somewhere in between. The Tor Project’s own official onion sites are a good place to test how each level feels.
Remember that at Safer, JavaScript is still allowed to run on onion sites, because Tor Browser treats them as secure connections. If you are visiting an onion site you are not sure about, that is a good reason to choose Safest over Safer.
A security level won’t save you from a fake site#
One point is worth making clear. The shield guards your browser against malicious code, but it offers no protection against you typing your password into a convincing copy of a genuine website. A phishing clone of a webmail login page will work perfectly well at Safest if it is built from plain HTML, and it will happily collect whatever you type. For an explanation of how such clones work, see our guide to onion phishing and fake mirrors, and to check that you are actually on the official site before logging in, see How to Verify an Onion Address Is Official. Many of these clones are spread through old link lists, which is why we explain why most ‘hidden wiki’ lists are full of scams.
Choosing a level for your situation#
Rather than trying to work out which level is the best, ask two questions. How likely is it that someone would go to the trouble of attacking your browser in particular? And what do you need the web to do for you today? Below is how those answers apply in some typical situations.
You’re curious, or you just want more privacy than a normal browser. You are not likely to be anyone’s target. Standard is adequate, and it keeps you in the largest group. If you don’t mind the occasional broken icon, Safer costs very little and removes the risk of plain-HTTP injection, so it is a reasonable upgrade.
You read the news from a country that censors it. You’ll mostly be looking at articles, which is why Safer works well day to day. The onion sites run by news organisations themselves are mainly text, so they are very usable at Safest and worth trying. If you also use Tor to get around blocks, our guide to bridges, Snowflake and WebTunnel covers the connection side.
You use webmail or other accounts over Tor. You’ll need JavaScript, which means choosing Standard or Safer. Prefer Safer. Keep these sessions separate from any browsing you want to stay anonymous, since as soon as you log in, the website knows who you are, whatever the shield is set to.
You visit onion sites you don’t already know and trust. Use Safest. You don’t know who runs an unfamiliar site or what it might serve you, and remember that Safer still runs JavaScript on onion addresses. Only step down to a lower level if a site you have verified needs it.
You’re a journalist, an activist or a source, or someone powerful might take an interest in you. Make Safest your default. Lower the level only for a particular task on a website you trust, and afterwards use New Identity or restart the browser. At this level of risk, it’s also worth looking beyond the browser. Tails runs the entire computer through Tor and erases everything when you turn it off, which protects you even if something does get through. Our overview of Tails 7.14 explains what it adds and when it is the better option. It’s also worth knowing where you stand legally, which we cover in Is Tor Legal? Using Onion Services Responsibly.
If you’re still not sure, we recommend Safer as your everyday setting and Safest whenever you visit unfamiliar sites. It is a sensible compromise for most people, and easier to remember than a long list of rules.
Changing it safely, and what changed in 2026#
How to change the level#
On the desktop, click the shield icon in the toolbar and select Settings, or open the browser settings and look for Security Level. Click Change, select Standard, Safer or Safest, and then click Save and restart. In current versions the browser restarts to apply the new level, which also gives you a fresh session.
On Android, tap the three-dot menu, scroll down to Privacy and security, select Security Level, pick a level and tap Save and restart. The three levels are the same as on the desktop. If you haven’t set up Tor on your phone yet, our guide to using Tor on Android and iPhone lists the genuine apps, and our Tor VPN beta overview covers the Tor Project’s device-wide option.
Don’t fine-tune it by hand#
Tor Browser enforces part of the security level through NoScript, the script-blocking extension that comes with it. NoScript has its own settings, including per-site permissions and an option to override the security level preset. It is tempting to use these to allow scripts on one website and block them on another.
Don’t do it. Each custom permission makes your browser differ from every other browser at that level, which undoes the crowd protection described above. Custom settings have also caused bugs. Tor’s issue tracker records cases where NoScript’s behaviour did not match the level shown on the shield after users had changed settings by hand, so the icon said one thing while scripts did another. If you need a site to work, change the whole level, use the site, and then start a new identity. That way you stay in a known state.
What changed in 2026#
According to the Tor Project’s current documentation, the three levels still work as described above, but the code behind them is constantly being updated. Tor Browser 15.0.24, released on September 29, 2026, upgraded NoScript to version 13.6.35.1984 and corrected the way NoScript handles onion site aliases when deciding which rules apply. The browser has also been rebased on Firefox 140.17.0esr and includes security fixes backported from more recent versions of Firefox. The full list is in our Tor Browser 15.0.24 release notes.
That is a good reminder of how the pieces fit together. The security level limits how much code an attacker can reach, and updates fix the bugs in the code that’s left. You need both. Even a well-chosen security level on an out-of-date browser is still a risk, particularly after a month like September 2026, which we cover in Tor’s September 2026 security fixes. The next major version is already in testing, and you can read about it in Tor Browser 16 Alpha: What’s Coming, although alphas are not meant for people who rely on Tor for their safety.
Where to go next#
- Not installed it yet, or unsure your copy is genuine? See How to Download and Install Tor Browser Safely.
- Want to know what you’re connecting to? Read What Is an Onion Service? .onion Addresses Explained.
- Worried about fake websites? See Onion Phishing: How Fake Mirrors Clone Real Addresses and Fake ‘Dark Web’ Apps in 2026.
- Need more than a browser can give? Have a look at Tails 7.14.
- Ready to browse? Start with the Official Onion Mirrors Directory, or find out how we decide what goes on it in About thehidden.wiki. More beginner guides are in Getting Started.
Sources#
- Adjusting security levels in Tor Browser, Tor Project support
- New Release: Tor Browser 15.0.24, Tor Project blog, September 29, 2026
- Unexpected NoScript behavior when security level is pinned, Tor Project issue tracker
- Understanding Tor Browser and NoScript, Tor Project forum
8 comments