The majority of Tor glossaries are arranged alphabetically, which is the most useless ordering possible. You have to read the entry for “Bridge” before that for “Relay”, even though a bridge is nothing more than a relay with an unlisted address. Nothing is connected to anything else.
This one works differently. Each of the terms below refers to a different aspect of a single event — that is, the few seconds which elapse between you pressing Connect in Tor Browser and a page appearing on your screen. If you read the list from top to bottom, you get the story of one connection, starting with the network forming below you, continuing through reaching a .onion site, and ending with what occurs when your country blocks the front door. Every term is given a simple English explanation and, in the cases where people are likely to get it wrong, the common mistake is also included.
It is also up to date. As of mid-October 2026, the latest stable version of Tor Browser is 15.0.25 (released on 12 October and running Tor 0.4.9.14), Arti has reached version 2.7.0, and Tails 7.15 was released the day after the browser. Where a term has recently changed, this has been mentioned.
If the definition doesn’t satisfy your curiosity, click on the link. For the majority of the terms on this page, detailed guides can be found elsewhere on the site, and this page is intended to be your starting point, not your final destination.
How it’s grouped:
- The network itself (terms 1–10)
- Onion services (terms 11–20)
- Getting around censorship (terms 21–27)
- The software you actually run (terms 28–35)
- Threats and habits (terms 36–40)
Part 1: The network forms under you#
On pressing Connect your computer does not communicate directly with the website; instead it communicates with one stranger, who in turn communicates with another stranger, who then communicates with a third. These ten terms explain how this chain is put together and who is responsible for deciding which of the strangers are trustworthy.
1. Tor (onion routing)#
Tor is a network made up of computers that are run by volunteers, and it sends your traffic through three of these computers before it gets to its final destination. The name is derived from ‘The Onion Router’; your data is placed within three layers of encryption and each of the computers removes one layer. No one in the chain is able to see both your identity and the place you’re going to. Tor conceals who is communicating with whom, but by itself it does not hide what you say after you have logged into a site. The software and network are maintained by the nonprofit Tor Project.
2. Relay#
A relay (it is also known as a node) is one of the volunteer computers. There are several thousand of them, and they are operated by universities, privacy groups, companies and individuals. Anyone is able to run one, and this is what makes the network so strong, as well as the reason why Tor’s design takes into account the possibility that some relays might be hostile. If you want to become one of those volunteers, see how to help the Tor network or the Tor Project’s relay operator guide.
3. Circuit#
A circuit is the exact route that your traffic follows: it is made up of three relays which are selected by your Tor client and connected together. For each website domain that you visit, Tor Browser sets up a new circuit and changes them around over time. You can view your current circuit by clicking on the icon in the padlock area of the address bar. Whenever someone says “my circuit is slow”, they generally mean that one of the three relays making it up is slow.
4. Guard relay#
The guard is the first relay in your circuit and is the only one that knows your actual IP address. Here is the point most people find counterintuitive: Tor intentionally continues to use the same guard for months. If the guards were constantly rotated then, at some point or another, you would end up with a malicious one. By sticking with one reliable guard the risk is reduced. It is also known as the entry relay.
5. Middle relay#
The middle relay is positioned between the guard and the exit. It is unaware of your IP address or of your destination, knowing only the two relays that are on either side of it. It is the dullest position in the network and at the same time the safest to volunteer for, since it never contacts the open internet on anyone’s behalf.
6. Exit relay#
The exit is the final relay, the one which actually links to the website; the site will see the IP address of the exit, not yours. The exit itself can see where the traffic is directed and, in the case of a website that does not use HTTPS, what content it contains. This is the reason why HTTPS remains important on Tor and also the reason why Tor Browser now defaults to trying HTTPS first.
7. Cell#
The classic Tor protocol transfers data in fixed-size packets known as cells, each cell being 514 bytes in size. The fact that they have a uniform size means it is more difficult for an observer to work out what is inside them simply by looking at their size. You never interact with a cell directly, but the term is frequently mentioned in release notes and bug reports, so it’s worth being aware of it.
8. Directory authority#
Directory authorities are a small, fixed number of servers operated by trusted individuals in various countries, and these servers keep a record of which relays there are and whether or not they are behaving properly. They are not involved in routing your traffic. You can consider them to be like the network’s notaries, in that they vote and it is their signatures which give the relay list its trustworthiness.
9. Consensus#
The consensus is the document which the directory authorities agree upon each hour: a signed list containing the address, bandwidth and flags (such as Guard, Exit, Stable, etc.) of each relay that is currently running. Your Tor client downloads this list when it starts up, and when the progress bar in Tor Browser is at the stage of “loading relay information”, it is retrieving this list. If the system clock is incorrect, the consensus appears to have expired, and this is one of the most frequent reasons why Tor will not connect.
10. Conflux#
Conflux is a more recent feature which divides a single connection between two circuits that have the same exit and then sends the data through the path that is currently the faster one. It was introduced in the 0.4.8 series and is turned on by default. Although you won’t notice it, this is one of the reasons why Tor now feels less sluggish than it did a few years ago. Security patches have since been required for the Conflux code, serving as a reminder that speed enhancements increase the attack surface.
Part 2: Arriving somewhere that isn’t on the map#
All the points made in Part 1 are true whenever you visit a normal website; but when you type in a .onion address, something entirely different and more unusual takes place: two parties who have no knowledge of each other’s locations agree to meet at a midpoint. These ten terms constitute the vocabulary for that meeting.
11. Onion service#
An onion service is a website or application which can only be accessed via Tor and has an address ending in .onion. Although the term ‘hidden service’ is still used all over the place, the Tor Project has dropped it, since hiding isn’t actually the main objective. What matters is that the connection is end-to-end encrypted and verified by the address itself, with no exit relay involved. That is the reason why the BBC, The Guardian and Amnesty International operate such services. For a more detailed explanation, see our article on what an onion service is, or the Tor Project’s own onion services overview.
12. v3 onion address#
The current address format is 56 characters followed by .onion. Those characters are not meaningless nonsense but rather the service’s public key expressed in full. This means the address is self-authenticating: if you go to that precise address, you will be speaking directly to whoever holds the corresponding private key. On the other hand, altering just one character results in a completely different website. The earlier 16-character v2 addresses ceased to function in 2021, so any address given in that format today must be either dead or fraudulent. Current, checked addresses are in our official onion mirrors directory. For more information on checking one yourself: how to verify an onion address.
13. Descriptor#
A descriptor is essentially the onion service’s signed business card, and it amounts to saying “if you want to get in touch with me, go through these introduction points”. It is encrypted in such a way that only a person who already has the .onion address can read it. Services regularly republish their descriptor, and one of the reasons a site ‘can’t be found’ is a missing or out-of-date descriptor.
14. HSDir#
A shortened form of hidden service directory: an HSDir is a normal relay which has obtained the HSDir flag and agrees to store descriptors. The set of HSDirs that hold a particular service’s descriptor changes each day, the list being determined by the address and the date; this rotation ensures that no single relay can monitor one service for an extended period of time.
15. Introduction point#
An introduction point is a relay to which the onion service maintains a permanent circuit, so that the service can be reached without having to reveal its location. When your Tor client sends a request to the introduction point, the point forwards it on. The introduction point does not find out what the service really is apart from that, and it never carries the conversation itself.
16. Rendezvous point#
The place where the meeting takes place. Before you hit the introduction point, your client selects a random relay and sets up a circuit to it. You instruct the service to “meet me at that relay”. In response, the service creates its own circuit to the same relay and the two circuits are connected. Neither side finds out the other’s IP address. If you count the number of hops, you will find that there are about six relays between you and the onion service, which is the reason why .onion sites tend to feel slower than they should.
17. Onion-Location#
A small header or HTML tag which a typical website includes in order to indicate “we also have an onion version, here”. It causes Tor Browser to display a purple “.onion available” button in the address bar. This is the most secure method of discovering a large organisation’s actual onion address, since the announcement originates from their own clearnet domain rather than from a list compiled by somebody else. Site owners can follow the Tor Project’s Onion-Location setup guide.
18. Proof-of-work defence (PoW)#
For years onion services have been taken down by large numbers of fake connection requests. Since the 0.4.8 release, it has been possible for a service which is under attack to ask visitors to solve a small computational puzzle before allowing them in. The puzzle gets harder as the attack grows, and it drops back to nothing when there is no attack going on. If an onion site takes a little longer to open during a busy week, your browser might be solving that puzzle. Operators can find setup instructions in our onion service security checklist, and the full design is in the proof-of-work specification.
19. Vanguards#
A defence for the onion service side. When attackers are unable to locate a service directly, they sometimes attempt to work backwards in order to identify its guard relay. By fixing the second and third hops of the circuits used by the service to a small number of relays that change slowly, vanguards make it much more difficult to discover the guard relay. Arti, the Rust version of Tor (term 32), also includes this feature.
20. Restricted discovery (client authorisation)#
A method of making an onion service invisible to everybody except those who possess a particular key. In the absence of that key it is impossible to decrypt the descriptor, so the service might as well not be there at all. The term “client authorization” can be found in earlier guides; the Arti project changed it to “restricted discovery”, a name which reflects what the feature actually does. It is often used for private dashboards, home servers and admin interfaces similar to those behind SecureDrop.
Part 3: When the front door is locked#
The fact that the consensus (term 9) is public is intentional. It’s good for building trust but bad in countries such as Iran, Russia, Turkmenistan or China, since a censor there could download the same list and block all the addresses on it. All the content in this section is designed to get you to the first relay when the direct route is blocked. For a full walkthrough see bridges, Snowflake and WebTunnel. Readers in those countries may also want our list of news onion sites in their own language.
21. Connection Assist#
The Connection Assist feature of Tor Browser detects that you are unable to connect, works out the reason and then offers a solution, typically by recommending a bridge appropriate for your location. If you have never changed any settings and Tor suddenly begins to work on the second attempt, it was very likely Connection Assist that did it for you. It is a worthwhile first step, even if it does not guarantee success.
22. Bridge#
A bridge is a guard relay that is not part of the public consensus. Since its address is not made public, a censor cannot just download a list and block it. You can obtain bridges from within Tor Browser, via the Tor Project’s Telegram bot or bridges website, or from a friend. However, a bridge by itself only conceals the fact that you are connecting to Tor if it also makes use of a pluggable transport (the next term). A simple, unobfuscated bridge can still be identified by its traffic. The Tor Browser manual shows how to add one.
23. Pluggable transport#
A way of hiding Tor traffic. Censors do not merely block addresses; many of them examine the traffic and are able to recognise Tor’s patterns. A pluggable transport alters the traffic between you and your bridge so that it appears to be something different, or as if it doesn’t exist at all. The term ‘pluggable’ indicates that these are interchangeable modules, so even when a censor learns to detect one of them, the others still function. The following four terms refer to the transports you will actually come across.
24. obfs4#
It’s a reliable tool: obfs4 scrambles your traffic so that it appears as random bytes with no identifiable signature. It’s quick, it has been available for many years, and it still functions in a great many places. Its only weakness is this very randomness: a censor who is prepared to block “anything that doesn’t look like something else” will be able to catch it, and some already do.
25. Snowflake#
Snowflake guides you via proxies that are operated by volunteers in ordinary browsers and which make use of WebRTC, the same technology that is used in video calls. Since there are so many of these proxies and they change so frequently, it is impossible to block them all. This is the default recommendation in a number of countries where the internet is censored. You can set up a proxy by installing the Snowflake browser extension or the Snowflake Volunteer app on an Android device, and it is one of the easiest ways of assisting strangers that you will never meet. More ways to contribute are in how to help the Tor network.
26. WebTunnel#
The most recent of the four. WebTunnel makes your connection appear as if you’re carrying out a normal visit to a typical HTTPS website, because in fact you are: the bridge is hidden behind a genuine-looking website and tunnels Tor through it. It is designed for use in places where unusual traffic is blocked, and it is more difficult to distinguish from ordinary browsing than obfs4.
27. meek#
The veteran, and the final option. meek keeps your connection hidden by making requests through a major cloud provider, since blocking it would mean blocking a part of the web that the censor’s own economy depends on. It is effective when all the other methods fail, but it is slow and costly for the Tor Project to operate. Use it to get connected once, then try a lighter alternative.
Part 4: The software you actually run#
“Tor” can refer to a network, a protocol, a piece of software and also a nonprofit organisation, often in the same sentence. This part deals with the programs.
28. Tor Browser#
This is a version of Firefox ESR with Tor included and a long series of privacy changes incorporated. The latest stable version is 15.0.25, which was released on 12 October 2026 and is based on Firefox ESR 140. It includes Tor 0.4.9.14, an updated version of NoScript, OpenSSL 3.5.9 and security patches that have been backported from Firefox 158 (full details in our Tor Browser 15.0.25 release notes and the Tor Project’s announcement). You should only obtain it from the official download page or an official mirror, since fake ‘Tor Browser’ installers are one of the oldest scams. Here is a step-by-step guide: how to safely install Tor Browser.
29. Security levels#
In the toolbar of Tor Browser there is a shield icon with three settings: Standard, Safer and Safest. Going to the next level switches off more of the features which have in the past been used in attacks, primarily JavaScript and some fonts and media. Sites will not function properly when choosing Safest; that is the compromise. The level you select should be based on who might be targeting you, not on how scared you are today. For more information: Tor Browser security levels explained, or the Tor Browser manual’s page on security settings.
30. NoScript#
The extension responsible for carrying out the work related to the security settings, by determining which scripts are allowed to run. It is included in and managed by Tor Browser. Unless you know why, don’t alter its settings on a per-site basis; having a custom NoScript configuration is one additional feature that makes your browser stand out (see term 36).
31. New Identity#
The broom icon shuts down all tabs, erases the cookies and browsing history, and provides you with fresh circuits, just as though you had restarted the browser. Its smaller counterpart, New Tor circuit for this site, merely replaces the relays for the current tab. You should use the first option when you are switching contexts (for example, from personal reading to research that you don’t want to be linked). Use the second one when a single site is merely slow. Both are described in the Tor Browser manual.
32. Arti#
Arti is Tor rewritten in Rust, a language that eliminates entire categories of memory bugs. Version 2.7.0 was released on 1 October 2026, and the aim now is to have Arti function not only as a client but also as a relay and as a directory authority. The timing is significant since, in September 2026, the older C version of Tor issued a number of urgent security updates, many of which addressed precisely the type of memory bugs that Rust is designed to prevent. Arti 2.7.0 included security fixes of its own as well, so the fact that it has been written in Rust does not mean that it is free from bugs. For a deeper look, see Arti 2.7 explained.
33. Tails#
An entire operating system which boots from a USB stick, routes all traffic through Tor, and erases all the data when you turn the computer off; that’s what they call “amnesic”. While Tor Browser safeguards just one application, Tails secures the entire computer session. Tails 7.15 was released on 13 October 2026 and includes Tor Browser 15.0.25. Further information: Tails, the amnesic OS.
34. Tor VPN (beta)#
The Android application developed by the Tor Project which routes other apps’ traffic through Tor, not just the browser’s. Each app can have its own circuit and exit node, which prevents your apps from being linked to one another by their IP address. The app is based on Arti, includes obfs4 and Snowflake bridges, and can be obtained from Google Play, F-Droid or as an APK. In reality, most people use it to bypass blocks. The Tor Project makes it clear that the software is still in beta and should not be used by people under serious surveillance. Background: the Tor VPN beta for Android, and if you are deciding between it and a commercial service, see Tor Browser vs VPN.
35. Alpha release#
Tor Browser has two release tracks. You should use the Stable one (15.0.x). The Alpha version is used for testing new features before they are ready; the current alpha version is 16.0a13, released on 30 September 2026. Alphas receive the same security updates but also introduce new bugs. Use the Alpha version only if you want to take part in testing, not in order to increase your safety. Preview: Tor Browser 16 alpha.
Part 5: The words for what can still go wrong#
Tor does a very good job in a narrow area. Most real-world deanonymisation doesn’t defeat that protection; it goes around it. The last five terms describe how.
36. Browser fingerprinting (and letterboxing)#
Without using cookies, websites can identify your browser by checking things such as screen size, fonts, time zone and graphics behaviour. In response to this, Tor Browser ensures that all users appear identical. One element of this is letterboxing, which refers to the grey margins that appear around the page when you resize the window; it adjusts your window to standard sizes so that your exact screen resolution doesn’t become noticeable. The practical takeaway is that any customisation you make, whether it’s adding extensions or having your window maximised, makes you stand out from the rest of the users. This is the first mistake in our list of Tor mistakes that break anonymity.
37. Traffic correlation#
This is the attack that Tor itself admits it cannot completely prevent. If a watcher is able to see the traffic as it enters the network near you and as it leaves the network near your destination, they can match the timing and volume of the two flows and connect them, all without having to break the encryption. Since it requires a great deal of visibility to carry out, it is mainly a worry for those facing off against very powerful adversaries. Guard relays (term 4) and vanguards (term 19) are primarily intended to make it more difficult for an observer to get into that position.
38. Phishing mirror#
A fake copy of a real onion site, at a different address that looks similar at a glance, built to steal logins or cryptocurrency. Because v3 addresses are long and unreadable (term 12), people tend to check the first and last few characters and skip the middle. Scammers generate addresses that match exactly those bits. This is the single biggest everyday risk on onion services, and the reason this site publishes verified addresses only. More in onion phishing and fake mirrors and hidden wiki scams explained, and see which official mirrors we’ve pulled in the monthly status report.
39. Stream isolation#
The rule that different activities should use separate circuits, so that one cannot be linked to another through a common exit point. Tor Browser applies it automatically on a per-website basis, and Tor VPN on a per-app basis. However, there is a risk when you manually run various programs over a single Tor connection, for instance a chat client and a torrent application at the same time, since one leaky program can expose the other’s identity. (And don’t torrent over Tor at all. It’s slow for everybody and leaks your real IP address more often than you might think.)
40. TROVE#
TROVE is the Tor Project’s vulnerability identification system, its equivalent of a CVE number; you will see labels such as TROVE-2026-056 in its release notes. These have become more noticeable of late: Tor 0.4.9.13, released on 23 September 2026, addressed approximately ten tracked issues affecting relays, clients and onion services, many of them reported with the help of AI code analysis. If a release note refers to a TROVE, take it to mean ‘update this week’, not ‘update eventually’. A summary of the most recent batch can be found in Tor security fixes, September 2026.
Where to go from here#
If you read the text in sequence, you have now followed one connection from the point at which you press Connect to the point at which someone might attempt to trick you on the other end. Most people never require any more vocabulary than this. All they need is the habit behind three of the words: keeping Tor Browser up to date (term 28), checking addresses carefully (term 12), and keeping your browser looking like everyone else’s (term 36).
When something here doesn’t work the way it’s described, start with Tor Browser not connecting? 9 fixes. And if you think we’ve defined something badly, tell us. A glossary is only useful if it stays accurate, and we update this one whenever Tor changes.
Sources#
- Tor Project blog: New Release: Tor Browser 15.0.25 (12 October 2026)
- Tor Project blog: Arti 2.7.0 released (1 October 2026)
- Tor Project blog: Tor VPN Beta: what we’ve learned
- Tor Project: Proof of work for onion service introduction (specification)
- tor-announce mailing list: Tor 0.4.9.13 and Tor Browser 16.0a13 changelogs
- Tor Project forum: Stable release 0.4.8.4 (Conflux and proof-of-work)
- Linuxcompatible: Tails 7.15 released (13 October 2026)