We never list markets. Check the first and last six characters of every address before you sign in.

The Hidden Wiki

Tor News

Arti 2.7.0 – Tor’s Rust Rewrite Explained

By admin 14 min read
On this page
  1. September’s bugs make the case
  2. Which bugs Rust prevents, and which it doesn’t
    1. Why two out of ten still matters a lot
    2. What Rust doesn’t do
  3. What Arti is, and how it got here
    1. Why not just fix the C code?
    2. The road to 2.7.0
  4. What’s in Arti 2.7.0
    1. The security fixes
    2. Becoming a relay
    3. Directory authorities
    4. Configuration over RPC
  5. Where you’ll meet Arti today, and where you won’t
    1. The Tor VPN beta
    2. Developers and their apps
    3. Where you won’t find it yet
  6. What a full switch would take
  7. What it means for you
  8. Where to go next
  9. Sources

September’s bugs make the case#

In September 2026, the Tor Project issued two emergency security updates to its main software within fifteen days. The second, Tor 0.4.9.13, fixed ten numbered security problems. Here are two of them, in the plain-English version we gave in our guide to the September fixes.

  • Memory that’s used after being freed when a TLS connection fails to set up.
  • Possible memory corruption, double frees and crashes in certain setups that map DNS lookups to virtual addresses.

In a way, those two lines are the whole reason Arti exists. Tor has been written in C since the early 2000s. C gives programmers full control over memory, which is part of why it’s so fast, but it also makes it very easy to get wrong. Classic C mistakes include using memory after it’s been freed, freeing the same memory twice, or reading from a pointer that points to nothing. In a security tool, those errors can be the difference between a crash and an attacker running their own code.

Arti is the Tor Project’s answer, a complete reimplementation of Tor in the Rust programming language. Its own README gives the first reason plainly. Rust is more secure than C, because however hard people try, it’s all too easy to make mistakes in a language that doesn’t enforce memory safety.

On October 1, eight days after that emergency release, the Tor Project released Arti 2.7.0. This article uses that timing to explain what Arti really is. We’ll look honestly at which of September’s bugs Rust would and wouldn’t have prevented, how Arti came about, what’s new in 2.7.0, where it’s already in use, and what a complete switch from C to Rust would involve. The short version is that Rust removes one major category of bugs, not all of them, and Arti 2.7.0 itself proves it.

Which bugs Rust prevents, and which it doesn’t#

Rust’s central idea is that the compiler, the program that turns source code into software, checks how every piece of memory is used before the program ever runs. Each piece of memory has a single owner. When the owner is finished with it, it’s freed, and the compiler won’t build code that tries to use it afterwards, free it twice, or share it between threads in an unsafe way. Ordinary Rust code also has no null pointers. A value that might be missing has to be checked before it’s used. As a result, a whole range of common C errors never get past the compiler. The official Rust book explains these ownership rules in detail.

That sounds a bit abstract, so here’s how it maps onto the ten September fixes in Tor 0.4.9.13, using the descriptions from reporting on the release notes.

TROVE What it fixed Type of bug Would Rust’s rules catch it?
2026-056 Memory used after being freed when a TLS connection fails Memory safety Yes, in ordinary Rust code
2026-051 Memory corruption, double frees and null pointer crashes with virtual DNS addresses Memory safety Yes, in ordinary Rust code
2026-053 How onion service circuits keep activities separate Logic No
2026-058 A problem with rendezvous circuits Logic No
2026-012 Introduction points not rotating when their anti-replay memory fills Logic No
2026-050 Reverse DNS answers kept when caching is switched off Logic No
2026-052 Directory connections reattached when they shouldn’t be Logic No
2026-030, 038, 041 Guard relays wrongly blamed for failures Logic No

So, by count, Rust’s safety rules would have stopped two of the ten. That’s an honest figure, and it’s worth thinking about carefully before anyone claims Rust makes software secure.

Why two out of ten still matters a lot#

Counting bugs treats them all as equal, and they aren’t. Memory safety bugs are especially dangerous. A logic bug usually makes software behave wrongly in a limited way, such as keeping a DNS answer it should have dropped or blaming the wrong guard. A memory bug can let an attacker corrupt the program’s state and, in the worst cases, take control of it. Across the industry, memory safety problems make up a very large share of the most serious bugs. The Chromium project, for example, has reported that around 70% of its high-severity security bugs are memory safety problems.

There’s also a second advantage a table can’t show. The original Arti announcement explained that the same type system that stops memory errors also stops dangerous patterns of concurrent access, where two parts of a program change the same data at the same time. Bugs like that are notoriously hard to find in C, and Tor does a great deal of work in parallel.

What Rust doesn’t do#

The other eight September bugs are a reminder of the limits. Rust can’t tell you that onion service circuits should be kept separate in a particular way, or when an introduction point ought to rotate. Those are questions about what the program should do, and only careful design, review and testing can answer them. Tor’s protocols are complicated, and most of their difficulty lies in the logic.

Rust also lets programmers mark code as “unsafe”. In those sections, the programmer takes responsibility back from the compiler, usually to talk to the operating system or to C libraries. Well-run Rust projects keep this to a minimum and review it carefully, but it exists. And Rust doesn’t prevent mistakes in the libraries a project depends on.

Arti itself proves the point. Its 2.7.0 release, published a week after Tor’s emergency fixes, included fixes for security issues ranging from low to high severity, and the Tor Project urged users, especially onion service operators, to upgrade as soon as possible. Rust is a major step forward on one type of problem. It isn’t a guarantee.

What Arti is, and how it got here#

Arti is a completely new implementation of the Tor protocols, written from the ground up in Rust. It speaks the same protocols as the existing C program, usually just called “tor”, so it connects to the same network, uses the same relays and reaches the same onion services. The name is a loose acronym for “A Rust Tor Implementation”.

It’s worth being clear about what Arti isn’t. It isn’t a new network, a fork, or a competing project. It’s built by the Tor Project, and the aim is for it to replace the C code one day. Until then, both exist side by side.

Why not just fix the C code?#

The Tor Project did consider a more gradual approach. In the 2021 announcement, the team explained that it had once hoped to replace Tor’s C code with Rust one piece at a time. That proved harder than starting again, because the C code wasn’t designed to have parts swapped out. A complete rewrite let the team keep the C code stable, with only minor changes, while building a clean Rust foundation for the future.

The rewrite also removed a design limitation. C tor runs as a separate program that other software talks to. Arti was designed from the start to be embeddable, so an app can include it as a library and use Tor directly. That’s exactly what makes apps like the Tor Project’s own Android VPN possible.

The road to 2.7.0#

  • 2020. Arti starts as a personal project by Tor developer Nick Mathewson, partly to improve his Rust skills. In September 2020 it sends its first anonymised traffic.
  • 2021. The Tor Project announces Arti publicly. A grant from Zcash Open Major Grants funds major work on it through 2022.
  • March 2022. Version 0.1.0, considered ready for experimental embedding in other Rust programs.
  • September 2022. Arti 1.0.0, which the Tor Project described as ready for production use as a client.
  • 2022 to 2025. The 1.x series adds client features, including support for onion services.
  • February 2026. Arti 2.0.0. The team itself called it “fairly mundane”. It removed long-deprecated options, marked the main crate’s APIs as experimental, and laid groundwork for relay and directory authority support.
  • March 2026. Arti 2.1.0 reports that relay support is nearing the point where Arti developers can test it as a middle relay. A few weeks later, Arti 2.2.0 adds HTTP CONNECT alongside SOCKS as a way for apps to connect.
  • October 1, 2026. Arti 2.7.0.

Since 2.0, new versions have arrived roughly once a month. Most look modest on their own. Together they’re a steady march from “a Tor client in Rust” towards “all of Tor in Rust”.

What’s in Arti 2.7.0#

The release announcement is short, and most of the work it describes is groundwork rather than features you’d notice. Here’s what it covers, and who each part matters to.

Area What changed Who it matters to
Security fixes Fixes for low- to high-severity security issues Everyone using Arti, especially onion service operators
Relay and directory authority work Document parsing, directory mirror support and DNS stream handling The long-term goal of running the whole network on Arti
Configuration over RPC Apps can now inspect and change Arti’s configuration through its control interface Developers building apps on Arti
Everything else Testing, infrastructure, documentation and many smaller bug fixes Mostly invisible, but it’s what makes the rest dependable

The security fixes#

This is the part that matters now. The Tor Project said 2.7.0 fixes security issues ranging from low to high severity, and urged users of three Arti packages to upgrade as soon as possible, especially if they run onion services. The three packages are arti, the command-line program, arti-client, the library other Rust programs build on, and arti-ureq, which connects Arti to a popular Rust library for making web requests.

The announcement points to Arti’s changelog for the details. We weren’t able to read it at the time of writing, so we won’t guess at what each fix covers. The practical message is simple. If you use Arti directly, upgrade. If you use an app built on it, update the app.

Becoming a relay#

Most of the visible work in 2.7.0 is aimed at a goal Arti hasn’t reached yet, running as a relay and as a directory authority. A Tor client only has to use the network. A relay has to be part of it, accepting connections from strangers, passing their traffic on and, in some cases, serving copies of the network’s directory to clients. That’s a much bigger job.

The three areas named in 2.7.0 all fit that picture. Document parsing means reading the signed documents that describe the network, such as the list of relays and their keys. Directory mirror support means being able to serve those documents to others, which many relays do. DNS stream handling covers how name lookups travel through Tor, which exit relays in particular have to handle on behalf of users.

None of this means you can swap your C relay for Arti today. Earlier in 2026, the team said relay support was nearing the point where Arti developers themselves could test it as a middle relay. That’s a testing milestone, not a recommendation for operators. If you run a relay, keep using the C version and keep it updated, as described in Tor’s September 2026 Security Fixes and the Tor community’s relay guides.

Directory authorities#

Directory authorities are a small set of specially trusted servers that vote on which relays are part of the network and publish the result. They’re the most sensitive part of Tor’s infrastructure, and they’re run by a handful of trusted operators, not by ordinary volunteers. Arti being able to act as one is a long-term goal. When that happens, it will be a quiet but important milestone, because it will mean the very centre of the network can run on memory-safe code.

Configuration over RPC#

RPC, short for remote procedure call, is how other programs control Arti while it’s running. From 2.7.0, an app can view Arti’s configuration and change it through that interface, rather than editing files and restarting. It’s a developer feature, but it makes Arti easier to build into apps that ordinary people use.

Where you’ll meet Arti today, and where you won’t#

For most people, Arti is invisible. Here’s which Tor tools use which implementation, as of October 2026.

Tool Runs on What that means for updates
Tor VPN (beta) for Android Arti Arti’s fixes matter, the September C fixes don’t directly apply
Apps that embed arti-client Arti Update the app to get Arti’s fixes
The arti command-line proxy Arti Upgrade to 2.7.0 or later
Tor Browser, desktop and Android C tor Gets C tor fixes through Tor Browser releases
Tor Browser 16 alpha C tor No sign yet of a switch to Arti
Tails C tor Gets C tor fixes through Tails releases
Orbot and Onion Browser C tor Gets C tor fixes when the apps are rebuilt
Relays, bridges and directory authorities C tor Arti can’t run these in production yet

The Tor VPN beta#

The most visible place Arti runs today is the Tor Project’s own Android app, Tor VPN. It’s built on Arti together with a component called Onionmasq, which captures traffic from the apps you choose and sends it through Tor, each app on its own circuit. That’s exactly the kind of thing Arti’s embeddable design was meant to make possible. Doing it with C tor would mean running a separate program and wiring the two together.

It also explains a detail from September. The emergency fixes in Tor 0.4.9.13 were for the C code, so they didn’t automatically apply to Tor VPN. Arti’s own security fixes in 2.7.0 are the ones that matter for it. Either way, keep the app updated from Google Play or F-Droid. We cover it in detail in our Tor VPN beta overview.

Developers and their apps#

Because Arti is a library, Rust developers can build Tor directly into their own software, from messaging tools to wallets and network utilities. If an app says it has Tor built in, it may be using Arti or it may be bundling C tor. Either way, the advice is the same as for any app. Keep it updated, and prefer apps that say clearly which Tor implementation and version they include. Be wary of apps that make big anonymity claims without saying either, as we explain in Fake ‘Dark Web’ Apps in 2026.

Arti’s code lives on the Tor Project’s GitLab, which is itself reachable over onion, as listed in Tor Project’s Official Onion Sites. The arti program can also run on its own as a local proxy, the way tor does, for people comfortable with the command line. For everyday browsing, though, the Tor Project’s advice hasn’t changed. Use Tor Browser, which is designed to resist tracking and fingerprinting in ways a plain proxy can’t.

Where you won’t find it yet#

Tor Browser still uses C tor, as our Tor Browser 15.0.24 release notes show, and the Tor Browser 16 alpha changelogs show no move to Arti. Tails, Orbot and Onion Browser use C tor too, and so does every relay carrying real traffic today. So for now, when you hear about a Tor security release, it’s almost always the C one that affects you.

What a full switch would take#

Replacing C tor isn’t one event. It’s a series of separate jobs, each of which has to work before the next one makes sense. Roughly, in order:

  1. Clients everywhere. Arti already works as a client and powers at least one Tor Project app. The next step is getting it into the tools most people use, meaning Tor Browser, Tails and the mobile apps. All of those are built around C tor today and would need real work to switch.
  2. Relays. Middle relays first, then guards and exits. Exits are the hardest, because they handle traffic leaving the network, including the DNS lookups that 2.7.0 started working on.
  3. Onion services at full strength. Arti can already host onion services, which is why the 2.7.0 security fixes were aimed at onion service operators in particular. Matching every protection C tor gives onion services under sustained attack is a large job in itself.
  4. Directory authorities. The most sensitive role, run by a handful of trusted operators, and the last that would make sense to move.
  5. A long overlap. For years, both implementations will run side by side on the same network. They have to work together perfectly, and the Tor Project has to maintain both until the C code can be retired.

The Tor Project hasn’t given a date for finishing that list, and it would be unwise to guess one. What the release history shows is steady monthly progress, with relay support as the current focus.

What it means for you#

In the short term, very little changes, and that’s the point. Arti is being built so that, one day, the software underneath Tor can change without anyone noticing anything except fewer bad weeks like September’s.

  • If you use Tor Browser, Tails, Orbot or Onion Browser, you’re running C tor. Keep updating as normal, and see our September fixes guide for the current versions.
  • If you use the Tor VPN beta, you’re running Arti. Update the app whenever a new version appears.
  • If you run a relay or bridge, stay on C tor and keep it updated. Arti isn’t ready for production relays.
  • If you run an onion service on Arti, upgrade to 2.7.0 or later now, as the Tor Project urged.
  • If you’re a developer, Arti’s README is the place to start, and the Tor community portal explains how to get involved.

In the longer term, a Tor written in Rust should mean fewer emergency releases caused by memory bugs, the kind that let attackers crash or take over software. It won’t mean none at all. The logic bugs that made up most of September’s list can be written in any language, and Arti’s own security fixes in 2.7.0 show that a Rust project still needs them. But removing the most dangerous class of bug from software that millions of people rely on for their safety is worth years of patient work. That’s what Arti is doing.

If you’d like to see that work continue, the Tor Project funds Arti through grants, sponsors and individual donations. To understand the onion services that Arti and C tor both connect to, start with What Is an Onion Service?

Where to go next#

Sources#

Leave a comment

Your email address will not be published. Required fields are marked *

Onion addresses posted here are checked against our directory automatically. Never trust an address from a comment until you have verified it.