What Tor Actually Does
When you open a website in a normal browser, your computer sends a request straight to that site's server. The server sees your real IP address — essentially, where you are connecting from. Your ISP sees which site you asked for. Both sides of that connection can be logged.
Tor changes the path. Instead of going direct, your traffic passes through three randomly selected relays run by volunteers around the world. The first relay knows your IP but not where you are going. The middle relay knows neither. The last relay knows the destination but not who sent the request. No single point in the chain sees both ends.
Tor Browser is a modified Firefox that sends all its traffic through that relay chain automatically. You do not configure relays yourself — you install the browser, connect, and browse. The network layer is handled for you.
Why Normal Browsers Cannot Open .onion Addresses
A .onion address — the long string ending in .onion that every market review
lists — is not a regular domain name. It does not exist on the public internet. It only
resolves inside the Tor network, through hidden-service routing that keeps the server's
location private too.
Chrome, Firefox, Safari and Edge have no idea how to reach a .onion host. Paste one into a normal browser and you get an error, or worse, a clearnet phishing page pretending to be the site you wanted. The address only works when your traffic is already inside Tor — which is exactly what Tor Browser does.
That is why we repeat the same instruction on every review page: copy the onion address into Tor Browser only, never a clearnet browser. It is not caution for its own sake — it is how the technology works.
What Tor Is For — and What It Is Not
Tor was built for privacy. Journalists use it to contact sources without exposing either side. Activists in censored countries use it to reach blocked news sites. Researchers use it to study the web without leaving a personal trail. Millions of ordinary people use it because they do not want their ISP building a profile of every site they visit.
Onion services — sites hosted entirely inside Tor — add another layer. The server hides its location the same way the client hides theirs. That is why darknet markets run on .onion addresses: both the buyer and the platform stay off the clearnet map.
What Tor is not: a guarantee of invisibility. It hides your IP from the sites you visit, but it does not stop you from logging into your personal Gmail, downloading a file that reports back to its maker, or typing your real name into a form. Tor handles the network. Everything above that layer is still on you.
Why Darknet Markets Require Tor
Two separate reasons, and people often conflate them.
First, connectivity. A market's .onion address simply does not resolve outside Tor. There is no clearnet URL to type — the site exists only on the Tor network. Without Tor Browser, you cannot reach it at all.
Second, the anonymity layer. Even if a market had a clearnet front (most do not, and the ones that claim to are usually scams), connecting from your home IP ties your identity to the visit. Tor removes that link. When we review platforms like TorZon or Nexus, we assume you are browsing over Tor — because that is the only way those addresses work, and because the privacy properties matter for everything that happens after you land on the login page.
Using Tor does not make a market legal or illegal. It is the transport. What you do after you connect is a separate question — but you cannot do any of it without the transport in the first place.
Where to Get Tor Browser — and Why the Source Matters
Download Tor Browser only from torproject.org. That is the official site run by the Tor Project, the nonprofit that maintains the software. Verify the download signature if you know how; at minimum, confirm the URL in your address bar before you click anything.
Third-party builds are a serious risk. Fake Tor installers have been used to distribute malware, steal cryptocurrency wallets and log onion addresses before the user ever reaches a real site. A repackaged "privacy browser" from a download mirror or a YouTube tutorial link is exactly the kind of thing that gets people phished before they open a single market page.
We checked this again in September 2026: the official download page is still torproject.org, and it is still the only source we recommend. If a site offers a "faster Tor" or a "pre-configured darknet browser," treat it as hostile until proven otherwise.
The Three Security Levels in Tor Browser
Click the shield icon in the toolbar to see Tor Browser's security settings. There are three levels, and the right one depends on what you are doing.
Standard
The default. All browser features work normally — JavaScript, images, fonts, the lot. Fine for general privacy browsing on clearnet sites over Tor. Not what you want for a market login.
Safer
Disables some website features that are commonly exploited: autoplay media, remote fonts, and certain JavaScript APIs that fingerprint your browser. Most market pages still work at this level. It is a reasonable middle ground if a site breaks on Safest but you still want more protection than Standard.
Safest
The strictest setting. JavaScript is blocked on most sites unless you manually allow it per site. This stops a large class of browser exploits and fingerprinting scripts cold. Many market interfaces need JavaScript to function, so you may have to temporarily allow it for specific pages — but start at Safest and loosen only when a site genuinely requires it.
Our TorZon review recommends Safest for that platform specifically, because it is the most cloned market on the network and the extra script blocking reduces the attack surface on a login page that phishers copy constantly. Pair the security level with the link-verification habits in our safe access guide — Tor hides your IP, but it does not stop you from pasting a phishing address.
Before You Open a Market Link
The short version: install Tor Browser from torproject.org, set the security level to Safest (or Safer if a page breaks), connect to the Tor network, and only then paste a verified onion address. Cross-check the address against a PGP-signed announcement before you type it — our verification method walks through that check.
Once you are on a market, the next skills are payment and escrow — covered in our anonymous cryptocurrency guide and the upcoming escrow guide. Tor gets you to the door. What you do inside is a different set of problems.
Tor Browser FAQ
Is Tor legal?
In most countries, yes. Tor is privacy software maintained by a nonprofit, and millions of people use it for journalism, research and everyday browsing. Some governments restrict or monitor Tor traffic, so check your local laws. Using Tor to commit a crime is illegal — the tool itself generally is not.
Do I need a VPN with Tor?
Usually no. Tor already routes through three relays, so your ISP cannot see which sites you visit. A VPN on top can help if your ISP blocks Tor, but a logging VPN that sees your real IP before Tor starts can make things worse. For most people, Tor Browser alone is the right starting point.
Why is Tor slow?
Your traffic bounces through three volunteer relays instead of going direct. Onion sites are often on modest hardware too. Pages load — just not at broadband speed. That is the trade-off for routing through strangers' computers.
Can I open .onion sites in Chrome or Firefox?
No. .onion addresses only resolve inside the Tor network. A normal browser shows an error or sends you to a phishing page. If it ends in .onion, you need Tor Browser.
Is Tor Browser enough to stay anonymous?
It handles the network layer — hiding your IP from sites. It does not fix logging into personal accounts, downloading tracked files, or typing your real name into a form. Necessary, not sufficient.
What is the difference between Tor and a VPN?
A VPN sends traffic through one company's server, which can see your real IP. Tor routes through three independent relays, none knowing both ends. VPNs are faster; Tor is harder to trace end to end.