Privacy tooling
What is Tor?
Tor routes traffic through three volunteer-operated relays chosen so that no single relay knows both the origin and the destination. It provides anonymity from the destination at the cost of latency. Middle relays and bridges are permitted on any OnionVPS instance; exit relays are permitted in approved jurisdictions.
Why Tor matters
It provides anonymity from the destination at the cost of latency. Middle relays and bridges are permitted on any OnionVPS instance; exit relays are permitted in approved jurisdictions.
Tor in practice
Operationally, Tor means watching what exits your instance. Middle relays and bridges are permitted everywhere, so run those without concern. Exit relays are the decision point: only approved jurisdictions allow them. When you set one up, check the legal footing first, then confirm the IP's reputation — abused exit IPs get blocked widely. Get it wrong and your traffic is flagged as hostile, your mail lands in spam, and automated scans treat you as a threat actor.
What people get wrong about Tor
People assume that running a Tor relay is the same as running an exit node, so they either avoid relays entirely or run exits in unapproved places. The correction: middle relays and bridges pass no traffic to the public internet and are permitted on any OnionVPS instance; only exit relays need an approved jurisdiction.
Tor — common questions
What is a Tor exit node?
An exit node is the final relay that sends Tor traffic out to the destination website. The destination sees the exit node's IP address, not yours. Because of this, exit nodes attract abuse complaints and are legally sensitive, so OnionVPS permits them only in approved jurisdictions.
Are Tor relays allowed on OnionVPS?
Yes. Middle relays and bridges are permitted on any OnionVPS instance in every region. Exit relays are allowed only in approved jurisdictions. You can run relays without worry, but check the exit-node policy before putting one up.
Where Tor comes up
- How do I host a website anonymously? Combine four things: a no-KYC host paid in Monero, a domain registered with privacy protection or an anonymous registrar, a CDN or reverse proxy so the ori…
- What is the cheapest VPS that is actually usable? About $4 a month buys 1 vCPU, 1 GB of RAM and 20 GB of NVMe on real KVM virtualisation. That is genuinely enough for a WireGuard VPN, a DNS resolver, a Tor…
- Can a VPS be traced back to me? It depends entirely on the links you create, not on the hosting itself. A no-KYC server paid for in Monero and administered over Tor has no provider-side l…
- Can I run a Tor exit node? Middle relays and bridges are permitted on any OnionVPS instance, without restriction. Exit relays are permitted in approved jurisdictions only, and requir…
- Tor vs VPN: different tools, different threat models Tor routes through three volunteer relays chosen so that no single one knows both who you are and where you are going. A VPN routes through one server that…
- How do I buy a VPS anonymously? Use a provider that requires no identity verification, sign up from a network that is not your home connection, use an email alias created for the purpose,…
More from privacy tooling
- WireGuard
- WireGuard is a VPN protocol implemented in about 4,000 lines of kernel code with a fixed modern cipher suite.
- OpenVPN
- OpenVPN is a mature userspace VPN protocol with configurable ciphers that can run over TCP or UDP.
- Tor exit node
- A Tor exit node is the final relay in a circuit, which connects to the destination and therefore appears to be the source of the traffic.
- Onion service
- An onion service is a service reachable only through Tor, whose address is derived from its public key rather than registered with any authority.
- SOCKS5
- SOCKS5 is a proxy protocol that forwards arbitrary TCP and UDP traffic, with optional authentication.
- Shadowsocks
- Shadowsocks is an encrypted proxy protocol designed to be difficult to identify by traffic analysis.
- No-logs policy
- A no-logs policy is a commitment not to retain records of user activity such as connection metadata, netflow or DNS queries.