Tor works by wrapping your traffic in three layers of encryption and routing it through three volunteer relays. The guard knows who you are but not your destination; the exit knows your destination but not you; the middle knows neither. Each relay peels one layer, so no single point can link you to your activity. Onion services go further, hiding the site's location too.
- Traffic is routed through three relays, encrypted in layers
- Guard knows you; exit knows your destination; neither knows both
- Each relay peels one layer — like an onion
- Onion services hide the site's location as well as yours
- Tor protects routing, not what you reveal
Tor's anonymity can seem like magic, but it rests on one clever idea: dividing knowledge so that no single party ever holds enough to identify you. Here's how the three-relay circuit actually works.
The three-relay circuit
When you use Tor, your traffic is wrapped in three layers of encryption and routed through three volunteer relays before reaching its destination:
- The guard (first relay) knows your real address but can only see the next relay, not your destination.
- The middle relay knows neither end — just two relays passing traffic.
- The exit (third relay) contacts the site and sees the destination, but has no idea who you are.
Each relay peels off one layer of encryption — like an onion. The result: no single point knows both who you are and what you're doing.
Onion services
For dark web sites, Tor goes further. You and the site meet at an agreed rendezvous point inside the network, each reaching it through your own three relays. Neither uses an exit, the traffic never leaves Tor, and neither side learns the other's location. This is why onion services hide the website as well as the visitor.
Divided trust
Anonymity here isn't one clever trick — it's knowledge deliberately divided so no one holds enough to identify you. To unmask you, someone would need to control multiple specific relays at once, which is why the network is run by thousands of independent volunteers.
What it doesn't do
Tor protects the routing of your traffic, not your behaviour. Logging into a personal account or downloading a file that phones home defeats it instantly. This is why almost everyone deanonymised on Tor was caught through their own mistake, not by anyone breaking the network.
Frequently asked questions
How does Tor work in simple terms?
Your traffic is encrypted in three layers and bounced through three volunteer relays. The guard knows who you are but not where you're going; the exit knows the destination but not you. No single relay can link you to your activity.
What are the three relays in Tor?
The guard (entry), which knows your address but not your destination; the middle, which knows neither end; and the exit, which contacts the site and knows the destination but not you. This division is what creates anonymity.
What is onion routing?
Wrapping traffic in multiple layers of encryption and passing it through a chain of relays, each removing one layer and learning only the next hop — like peeling an onion. It's what the ‘onion’ in Tor refers to.
Why can't Tor be easily traced?
Because no single relay knows both who you are and where you're going. Unmasking you would require controlling multiple specific relays at once, which is impractical against ordinary users given thousands of independent volunteer relays.
What does Tor not protect?
Your behaviour. Tor protects the routing of your traffic, not what you reveal. Logging into a personal account, running a download, or posting an identifying detail can undo the anonymity instantly.