Tor hides where you are, not who you are. It stops the onion site from learning your IP address and stops your ISP or office network from seeing what you fetch Tor Project: protections (checked 10 Oct 2026). It does nothing about the account you log into, the file you open in another program, or a browser exploit that runs on your machine. The Tor Project says plainly that perfect anonymity is "impossible", and that Tor protects only applications configured to use it Tor Browser best practices (checked 10 Oct 2026). For onion research that means: an up-to-date Tor Browser at the Safest level, which turns JavaScript off everywhere Tor Browser security levels (checked 10 Oct 2026); an isolated system (Whonix, Tails or Qubes-Whonix), not your everyday desktop; no add-ons; no downloaded file opened while online; no login to anything of yours; one persona per case; and every onion address checked against a trusted source.

The same mistakes identified real operators: the AlphaBay administrator's personal Hotmail address was allegedly in the header of the market's welcome email E.D. Cal., Findings and Recommendations, No. 1:17-cv-00967 (7 Aug 2018), and in 2015 the FBI used a court-authorised exploit to get Playpen users' IP addresses US DOJ press release (1 May 2017). When a subject slips, that is your lead. Look, record, and never transact or interact.

At a glance: what leaks over Tor, and what stops it

RiskWhat leaksDefenceSection
Your IP addressYour real IP, seen by the onion or clearnet siteTor Browser, or a system that forces every app through Tor (Whonix, Tails)1, 4
Tor use on your networkThe fact that you use Tor, seen by your ISP, employer or venue Wi-FiA bridge (obfs4, WebTunnel, Snowflake), with permission where policy applies3
Browser exploitIP address, hostname or MAC address, through malicious JavaScriptSafest level, keep Tor Browser updated, Whonix gateway isolation2, 8
FingerprintA unique browser profile, created by add-ons or odd settingsNo add-ons, default window size, stock settings2
Downloaded filesYour real IP, when a document fetches a resource outside TorOpen only in an offline, disposable VM, or convert with Dangerzone5
Logins and reuseYour identity, through accounts, usernames, PGP keys and writing styleOne persona per case, never personal accounts, New Identity between tasks6
Phishing cloneYour actions and money, sent to a lookalike onionCheck all 56 characters against a trusted, authenticated source7
Bad evidenceA finding you cannot defend laterTime in UTC, a verified address, screenshots and SHA-256 hashes9

What does Tor protect, and what doesn't it?

Tor protects location and network metadata. It relays your traffic through several volunteer-run servers in layers of encryption, "so that no single point can reveal both who you are and what you're doing online". Websites cannot learn your location, your ISP or Wi-Fi operator cannot see what you fetch, and no single relay knows both ends Tor Project: protections (checked 10 Oct 2026). Onion services also hide the service's own IP address and are end-to-end encrypted Tor Browser: onion services (checked 10 Oct 2026).

The Tor Project is just as clear about what Tor does not protect:

  • Your identity once you give it away. If you sign in to a site over Tor, "they still don't know your location but they know who you are". Typing a name, email address or phone number into a form ends your anonymity for that site Tor Browser best practices (checked 10 Oct 2026).
  • Other applications. Tor Browser protects only its own traffic. Other programs on the same computer, including other browsers, connect directly unless they are configured separately Tor Browser: managing identities (checked 10 Oct 2026).
  • Observers who can see both ends. An adversary watching both your connection and the destination, or your exit relay, can match the timing of the traffic, and "Tor does not defend against such a threat model". Because circuits are reused for several connections, an exit relay may also be able to link your anonymous traffic to non-anonymous traffic sent at the same time Tor Project: remaining attacks (checked 10 Oct 2026).
  • Clearnet content in transit. Tor encrypts traffic up to and inside the network. On the final hop to an ordinary website, though, encryption "depends on that website" Tor Browser best practices (checked 10 Oct 2026). Tor Browser's HTTPS-Only Mode upgrades connections where possible and warns you before an unencrypted HTTP page loads Tor Browser: secure connections (checked 10 Oct 2026). Onion services do not have this exit hop.
  • Fingerprinting beyond what Tor Browser normalises. Tor Browser tries to put users into a small number of identical groups. It does not claim to make everyone identical, which it calls "practically impossible" Tor Browser fingerprinting protections (checked 10 Oct 2026).
  • A compromised machine. Malware, a hostile document or a browser exploit runs on your computer, before Tor's encryption is applied. Section 8 covers two real cases in which this happened.

In the four-layer model of the OSINT OpSec guide (identity, machine, network, behaviour), Tor covers only the network layer. To see what your connection reveals, run Connection Fingerprint.

Which Tor Browser security level should investigators use?

Use Safest for onion research. Lower the level only for a specific page you trust, and only for as long as you need it. Tor Browser offers three levels Tor Browser security levels (checked 10 Oct 2026):

LevelWhat it changes (Tor Project wording)What breaks
Standard (default)"All Tor Browser and website features are enabled."Nothing. This level also has the largest attack surface.
SaferJavaScript is disabled on all non-HTTPS sites. Some fonts and math symbols are disabled. Audio and video (HTML5 media) are click-to-play.Scripts on HTTP pages. Many onion sites are plain HTTP, so their scripts stop too.
Safest"Javascript is disabled by default on all sites." Some fonts, icons, math symbols and images are disabled. Audio and video are click-to-play.Many interactive sites. The Tor Project warns that disabling JavaScript "will prevent many websites from displaying correctly".

Why Safest is the right default. The August 2013 attack on hidden-service visitors (section 8) abused a Firefox JavaScript flaw, and the Tor Project's advice was to update and consider disabling JavaScript Tor security advisory, tor-announce (5 Aug 2013). JavaScript stays on by default only because most users "would give up on Tor entirely" without it Tor Browser: plugins and add-ons (checked 10 Oct 2026). Investigators visiting hostile sites mostly need static content to document. If a page will not render without scripts, decide deliberately, switch to Safer for that task only, and use New Identity afterwards.

Keep it current. "Using an outdated Tor Browser puts you at risk of serious vulnerabilities and deanonymization" Tor Browser: updating (checked 10 Oct 2026). The current stable release is Tor Browser 15.0.24, which includes "important security updates to Firefox" Tor Blog: Tor Browser 15.0.24 (29 Sep 2026). Check the release list before each case Tor Blog releases (checked 10 Oct 2026), and verify the signature of any fresh download, which shows it "has not been tampered with" Tor Project: verify the signature (checked 10 Oct 2026). On Windows, an expired code-signing certificate made some September 2026 builds show warnings; the release notes explain how to verify them Tor Blog: Tor Browser 15.0.24 (29 Sep 2026).

Don't fight the fingerprinting defences.

When do you need bridges, Snowflake, obfs4 or WebTunnel?

You need a bridge in two situations: when the network you are on blocks Tor, or when you need to hide the fact that you use Tor from that network. By default, Tor "does not prevent somebody watching your Internet traffic from learning that you're using Tor", and the Tor Project's suggested fix is a bridge Tor Browser best practices (checked 10 Oct 2026).

A bridge is an entry relay that is "not listed in the public Tor directory", so it is harder for an ISP or government to recognise and block Tor Project: types of relays (checked 10 Oct 2026). Pluggable transports disguise the connection itself. Tor Browser currently ships four Tor Project: unblocking Tor (checked 10 Oct 2026):

  • obfs4 makes the traffic look random and resists bridge discovery by internet scanning.
  • WebTunnel makes the connection look like ordinary HTTPS browsing.
  • Snowflake routes through volunteer-run proxies, so the traffic looks like a video call.
  • meek makes it look as if you are using a site hosted on a large CDN or cloud provider.

The Tor Project notes that some countries, including China and Iran, have found ways to detect bridges, which is why transports add another layer of disguise Tor Project: types of relays (checked 10 Oct 2026).

Know what a bridge does not do. With a bridge, the route is you, then the bridge, then a middle relay, then an exit relay, then the destination. The destination still sees the exit relay's address Tor Project: types of relays (checked 10 Oct 2026). A bridge hides Tor use from your local network. It does not hide who you are from the sites you visit, and it changes nothing about logins, fingerprints or documents.

  • Use Snowflake only when you need it. Its proxies are volunteer capacity for people in censored places Tor Project: Snowflake (checked 10 Oct 2026). If a direct connection, obfs4 or WebTunnel works, use that.
  • Workplace networks. If your organisation blocks or flags Tor, get onion research approved, ideally on a separate connection. Disguising Tor from your own security team is a policy problem, and it weakens your methodology if it is ever challenged.

Tor Browser, Tails, Whonix or Qubes: which setup should you use?

Tor Browser on your everyday desktop is the weakest option, because "only Tor Browser's traffic will be routed over the Tor network" and everything else on that computer is not Tor Browser: managing identities (checked 10 Oct 2026). Add isolation, so one bad page or file cannot reach your real IP address or files. The common setups, as their own projects describe them:

SetupWhat goes through TorPersistenceWhat it defends againstLimits
Tor Browser on your normal OSTor Browser onlyPersistent: your OS keeps logs, downloads and swap filesSites learning your IP when you browse with Tor Browser itselfAny other app, opened document or exploit reaches your real network and files
Tor Browser in a dedicated VM (our baseline)Tor Browser only, but inside a guest you can snapshotYou choose: revert to a clean snapshot after each sessionCross-contamination with your personal profile and filesOther programs in the VM can still connect directly. A VM escape or host malware defeats it.
Tails"Everything you do on the Internet from Tails goes through the Tor network" Tails: how Tails works (checked 10 Oct 2026)Amnesic: "always starts empty and leaves no trace", with optional encrypted Persistent Storage Tails: how Tails works (checked 10 Oct 2026)Leftover traces on the computer. Non-Tor connections by other apps.Tails "cannot always protect you" if it was installed from an infected computer, or on hardware with keyloggers Tails: how Tails works (checked 10 Oct 2026)
Whonix"All connections are forced through Tor or otherwise blocked", through a separate Gateway VM Whonix: about (checked 10 Oct 2026)A persistent Workstation VM, so you can keep case notes and snapshotsIP leaks even if the Workstation is compromised: "Malware with root privileges cannot discover the user's real IP address" Whonix: about (checked 10 Oct 2026)Whonix says it is not "a one-click anonymization solution", and that onion-routing designs "fail when the attacker can see both ends" Whonix: about (checked 10 Oct 2026)
Qubes-WhonixWhonix-Gateway runs as the sys-whonix qube, Workstation as anon-whonix Whonix: Qubes-Whonix (checked 10 Oct 2026)Per-qube, with disposables that "self-destruct when shut down" Qubes OS: introduction (checked 10 Oct 2026)Compromise of one activity spreading to others: Qubes aims to "confine, control, and contain the damage" Qubes OS: introduction (checked 10 Oct 2026)Needs compatible hardware and more skill to run

How to choose (our assessment). Tails suits one-off or field work where leaving no trace matters most; Tails 7.14 (30 September 2026) ships Tor Browser 15.0.24 Tor Blog: Tails 7.14 (30 Sep 2026). Whonix suits cases that run for weeks, with snapshots and a Gateway that protects your IP even if the browser is exploited. Qubes-Whonix is strongest, with a fresh disposable for each downloaded file. Whatever you pick, use it for research only.

A VPN on top? The Tor Project's guidance is that combining a VPN with Tor "can reduce anonymity or break Tor's protections if not configured correctly", and it does not recommend the combination "unless you're an advanced user" Tor Project: Tor Browser with VPN (checked 10 Oct 2026). If you need to hide Tor use from a network, the Tor Project's answer is a bridge (section 3), not a VPN.

Why are downloaded files the classic Tor leak?

Because the program that opens a file is not Tor Browser. Tor Browser warns you before it hands a document to an external application, and the Tor Project's own advice is "DO NOT IGNORE THIS WARNING". Documents, "especially DOC and PDF files", can contain internet resources that the opening application downloads outside Tor, and that "will reveal your non-Tor IP address". Its recommendation is to work with such files on "a disconnected computer", or to convert them with Dangerzone first Tor Browser best practices (checked 10 Oct 2026). The same logic covers any outside program, including office suites and media players. Tor Browser's built-in PDF viewer is the named exception Tor Browser best practices (checked 10 Oct 2026). Dangerzone, from the Freedom of the Press Foundation, opens untrusted documents in a sandbox with no network access, turns them into pixels and rebuilds a clean PDF. It supports more than 20 file types Dangerzone, Freedom of the Press Foundation (checked 10 Oct 2026).

A workflow that protects you and the evidence:

  1. Download only what you must, and only inside the Tor environment, never to the host.
  2. Hash it first. Log the SHA-256 hash, name, size, source address and UTC time in the Evidence Logger before opening anything, so you can show later that the file was not changed.
  3. Move it to an offline, disposable environment, such as a Qubes disposable or a VM with networking removed, or convert it with Dangerzone. Never open it on a system that is online.
  4. Read the metadata. Authors, software, edit times and GPS tags are some of the best pivots you will get. Max Intel's PDF Metadata, EXIF Viewer and Photo Forensics tools process files in your browser without uploading them.
  5. Destroy the environment afterwards: revert the snapshot or close the disposable.

If a download might contain illegal material, don't download it at all. Section 10 explains what to do instead.

How do you keep research identities separate?

Half the cases in section 8 turned on linkage, not hacking. Tor Browser already gives each site its own circuit, so a shared tracker cannot join your visits Tor Browser: managing identities (checked 10 Oct 2026). Your habits can undo that. Five rules:

1. Never log into anything that is yours. One sign-in to a personal account ties the whole research session to you. Tor reuses circuits for connections made within "the same ten minutes or so" Tor Project: overview (checked 10 Oct 2026), and an exit can associate anonymous and non-anonymous traffic that travels at the same time Tor Project: remaining attacks (checked 10 Oct 2026).

2. Know the two reset buttons.

  • New Identity closes all tabs and windows, clears cookies and history, and uses new circuits for every connection. It is meant to stop your next activity being "linkable to what you were doing before".
  • New Tor Circuit for this Site only reloads the current site over a different circuit. It "does not clear any private information or unlink your activity" Tor Browser: managing identities (checked 10 Oct 2026).

Use New Identity between tasks and between personas. New Circuit is only a fix for a slow or broken exit.

3. Use one persona per case. Each persona gets its own username, email address and, if needed, PGP key, never reused across cases or borrowed from your real life. A PGP key's fingerprint, user IDs and creation date link everything it signs; read a subject's key with the PGP Key Inspector and assume others can read yours. In the Silk Road case, prosecutors recovered the operator persona's private PGP key from Ross Ulbricht's laptop United States v. Ulbricht, 2d Cir. opinion, 31 May 2017 (in Supreme Court application appendix).

4. Watch your writing. Spelling, punctuation, pet phrases and posting hours carry across identities; the Stylometry tool shows how investigators compare them. Better still, don't post.

5. Don't transact. Bitcoin is a public ledger. In 2019 the DOJ described tracing payments to a darknet site "by following the flow of funds on the blockchain" to find its server and administrator US DOJ press release (16 Oct 2019). A wallet funded from an exchange account in your name is linked to you, and investigators normally have no lawful reason to pay an onion service at all (section 10 and the dark web guide's legal guardrails). Tor Browser also warns if you copy a crypto address from an HTTP page, because it "could have been modified" Tor Browser: secure connections (checked 10 Oct 2026). For clearnet sock puppets, see the OpSec guide's identity layer.

How do you verify you are on the real onion site?

Get the address from an authenticated source, check all 56 characters, and remember that the onion icon does not prove you have the right site.

What the address guarantees. A current (v3) onion address is "56 letters and numbers, followed by '.onion'". The old 16-character v2 format no longer works Tor Browser: onion services (checked 10 Oct 2026). The address encodes the service's ed25519 public key, a two-byte checksum and a version byte: onion_address = base32(PUBKEY | CHECKSUM | VERSION) + ".onion" Tor rend-spec: encoding onion addresses (checked 10 Oct 2026). So the address is the key. Tor can confirm that it reached whoever holds that key and that the connection was not tampered with Tor Browser: onion services (checked 10 Oct 2026). The checksum also catches most typos, which Tor Browser reports as an invalid address.

What it doesn't guarantee. A phishing clone is not a typo. It is a different, perfectly valid address, often chosen so that the first few characters match the real one. Tor Browser's onion icon looks the same for any onion served over HTTP. For a site with a domain-validated certificate, the icon "does not provide the information that you're on the 'right site'" Tor Browser: onion services (checked 10 Oct 2026). Search engines warn about clones of themselves: the dark web guide covers Ahmia's own clone warning.

Trusted ways to get an address:

When you collect addresses from saved pages, the Onion Pivot Extractor pulls out v3 addresses and checks their checksums offline, along with any PGP keys, wallets and analytics IDs on the page. Record each address with how you verified it.

How were real onion operators identified?

Each case below comes from a court record or official statement. Each slip is a mistake to avoid and a kind of lead worth checking. Allegations in civil or charging documents remain allegations.

Silk Road (arrest 2013): the persona's life matched the person's

Silk Road ran as a Tor hidden service and used Bitcoin to hide users' identities US Attorney SDNY, verdict press release (5 Feb 2015). In upholding Ross Ulbricht's conviction, the Second Circuit described how investigators matched the "Dread Pirate Roberts" persona to him United States v. Ulbricht, 2d Cir. opinion, 31 May 2017 (in Supreme Court application appendix):

  • Agents got court orders to collect IP-address data for traffic to and from his home wireless router.
  • His Gmail account, whose address "incorporates his full name", held a CheapAir travel itinerary. A Facebook album titled "Thailand" also matched trips that DPR mentioned in chats.
  • Handwritten notes in his bedroom bin matched a site-rating change that DPR had just announced in the site's forum.
  • He was arrested on 1 October 2013 in a San Francisco public library. Agents seized his laptop with a DPR chat open on the screen, and later recovered DPR's private PGP key from it.

Lesson: a persona that talks about its real travel, plans or schedule can be matched against the real person's records. Keys and persona material kept on a personal device link the two. Pivot: for the subjects you research, list every life detail the persona has revealed and look for matches in public records.

AlphaBay (shut down 2017): a personal email in the site's mail

The DOJ announced AlphaBay's shutdown on 20 July 2017; its alleged founder, Alexandre Cazes, was arrested in Thailand on 5 July and died in custody on 12 July US DOJ, AlphaBay press release (20 Jul 2017). In the forfeiture case, the government alleged the following E.D. Cal., Findings and Recommendations, No. 1:17-cv-00967 (7 Aug 2018):

  • The address "[email protected]" appeared in the header of AlphaBay's December 2014 welcome email to new users, and in the forum's password-recovery email.
  • Law enforcement linked that address to Cazes.
  • At his arrest, his laptop was found "open and in an unencrypted state" and logged in to the site as "Admin".

Lesson: infrastructure leaks. Mail headers, server banners and configuration can carry an operator's identity even when every page is clean. Pivot: keep and read the full headers, error pages and banners of any service you are lawfully studying. The Onion Pivot Extractor picks out emails, server banners and analytics IDs from pages you have saved.

August 2013 hidden-service attack: JavaScript and an old browser

On 5 August 2013 the Tor Project warned that an attack exploiting a Firefox JavaScript flaw "appears to have been injected into (or by) various Tor hidden services" Tor security advisory, tor-announce (5 Aug 2013):

  • The payload targeted Windows users. It collected "the hostname and MAC address of the victim computer" and sent them to a server outside Tor.
  • The flaw had already been fixed in Tor Browser Bundle builds released in June and July 2013 Tor Blog advisory (5 Aug 2013).
  • The advisory's advice: update, consider disabling JavaScript, and consider Tails or a VM-based setup such as Whonix Tor security advisory, tor-announce (5 Aug 2013).

Lesson (our assessment): an updated browser, the Safest level or gateway isolation would each have blunted this attack.

Playpen, 2015: a court-authorised exploit

Playpen ran as a Tor hidden service with more than 150,000 members. After its administrator's arrest in February 2015, the FBI obtained court approval to deploy a "Network Investigative Technique" to "pierce through the anonymity provided by the Tor network". The technique recovered visitors' IP addresses and other basic computer information US DOJ press release (1 May 2017).

Lesson: code that runs in your browser runs on your machine. Treat every onion site as able to attack the browser. An updated Tor Browser at Safest, inside Whonix or Qubes-Whonix, is the defence, because Whonix is built so that even root-level malware cannot discover your real IP address Whonix: about (checked 10 Oct 2026).

Left out: other often-repeated stories, such as the 2013 Harvard bomb hoax and LulzSec's "Sabu", because we could not read a primary court or government source for the specific slip.

What should you check before every Tor session?

Twelve checks, in order.

  1. Write down your authorisation, scope and legal basis (see Is OSINT legal?).
  2. Start a clean, research-only environment: a Whonix snapshot, a fresh Tails boot or a Qubes-Whonix qube, with no personal accounts or files.
  3. Check that Tor Browser (or Tails) is the current stable release. If you downloaded a new copy, verify its signature.
  4. Set the security level to Safest. Check that no extra add-ons are installed and that the window is at its starting size.
  5. Decide whether you need a bridge (Tor blocked, or Tor use must not show on this network) and that you may use one.
  6. Check your connection: Connection Fingerprint should report Tor, and Tor Relay Lookup should list the exit IP as a relay.
  7. Load the case persona, and only that persona. Never sign in to anything that is yours.
  8. Get each onion address from an authenticated source, compare all 56 characters, and note where it came from.
  9. Open a case log in the Evidence Logger, clock in UTC, screenshot tools ready.
  10. Plan where downloads will go: an offline disposable environment or Dangerzone, never the host.
  11. Agree your stop rule for illegal content: stop, save nothing, report (section 10).
  12. Afterwards, use New Identity or shut down Tails, revert the VM snapshot, and export and hash your log.

What to log for evidence. Onion services move, go down and get cloned, so a finding is only as good as its record. For every page you rely on, log:

  • the time in UTC;
  • the full onion address, and how you verified it;
  • the page title;
  • a full-page screenshot, plus a saved copy of the HTML if your environment allows it;
  • the SHA-256 hash of each file you capture;
  • the Tor Browser version and the security level in use;
  • the persona, if any, that was signed in.

Log what you did, not just what you found: as the dark web guide notes, dark-web evidence is often challenged on procedure. The Evidence Logger timestamps and hashes each entry in your browser and exports Markdown, CSV or JSON.

Using Tor is lawful for ordinary purposes in most countries (our assessment). The Tor Project describes journalists, NGOs and companies among its everyday users Tor Project: overview (checked 10 Oct 2026). Some states block Tor or detect bridges Tor Project: types of relays (checked 10 Oct 2026), and laws differ, so check your own jurisdiction before you rely on that. What you do over Tor is what matters legally. The legal and ethical guardrails in the dark web guide and Is OSINT legal? cover the general rules. For onion work specifically:

  • Observe, don't participate. Never buy, sell, order, register for a market, message vendors or join a forum's illegal activity, whatever your reason. Undercover work is for authorised law enforcement operating under its own legal rules.
  • Don't collect what you may not possess. Some material is illegal to hold whatever your purpose. When in doubt, record the address and a text description, not the file, and talk to counsel.
  • Keep the authorisation and the log. Your methodology will matter as much as your findings.

If you come across child sexual abuse material:

  1. Stop. Close the page. Don't scroll, download, screenshot or forward anything "for the file".
  2. Report the address to the right hotline:
  3. Tell your organisation's legal counsel, and record in your case log that you reported it and when, without describing the content.
  4. Look after yourself. Exposure to this material is harmful. Use whatever support your organisation provides.

For other illegal content, such as weapons, threats or stolen data, the usual route is your organisation's counsel and the relevant law-enforcement reporting channel. Don't engage with the people behind it.

Frequently Asked Questions

Is a VPN plus Tor safer?

Usually not. The Tor Project says that combining a VPN with Tor can reduce anonymity or break Tor's protections if it is not configured correctly, and it does not recommend the combination unless you are an advanced user. If you need to hide Tor use from your local network, the Tor Project's answer is a bridge such as obfs4 or WebTunnel. If you need protection from leaks, use isolation such as Whonix or Tails.

Should I use Tor Browser's Safest security level?

For onion research, yes. Safest turns JavaScript off on every site and disables some fonts, icons, math symbols and images, which removes the attack surface used by the best-known exploits against Tor users. Some interactive sites will break. If a page you trust needs scripts, switch to Safer for that task only, then use New Identity afterwards.

Can websites tell I'm using Tor?

Yes. The list of Tor relays is public, and the Tor Project says websites can always detect when connections come from Tor. That is why some sites block Tor or show CAPTCHAs. You can check whether an IP address is a Tor relay or exit with Max Intel's Tor Relay Lookup. A bridge hides Tor use from your own network, not from the sites you visit.

Is it legal to use Tor?

In most countries, using Tor for ordinary purposes is lawful, and the Tor Project lists journalists, NGOs and companies among its users. Some governments block Tor or detect bridges, and laws differ, so check your own jurisdiction. What you do over Tor is what matters legally: viewing public pages for authorised research is very different from buying, downloading illegal material or joining criminal activity.

Can my employer or ISP see that I use Tor?

By default they can see that you connect to Tor, but not which sites you visit through it. A bridge with a pluggable transport such as obfs4 or WebTunnel makes that harder to spot. On a work network, get onion research approved rather than disguising it, because hiding it from your own security team can cause problems later.

What is the difference between New Identity and New Tor Circuit?

New Identity closes all tabs and windows, clears cookies and history, and uses new circuits for everything, so that later activity cannot be linked to earlier activity. New Tor Circuit for this Site only reloads the current site over a different route and does not clear anything or unlink your activity. Use New Identity between tasks and personas.

Is it safe to open files downloaded over Tor?

Not while you are online. The Tor Project warns that documents such as DOC and PDF files can fetch internet resources outside Tor when another program opens them, which reveals your real IP address. Hash the file first, then open it only in an offline, disposable environment or convert it with Dangerzone. Tor Browser's built-in PDF viewer is the safer exception.

Should I use Tails or Whonix for onion research?

Both route all traffic through Tor. Tails is amnesic and leaves no trace on the computer, which suits one-off or field work. Whonix keeps a persistent workstation behind a separate Tor gateway, so even malware with root access in the workstation cannot learn your real IP address, which suits longer cases. Qubes-Whonix adds disposable virtual machines for opening risky files.

How do I know an onion address is the real one?

Get it from an authenticated source, such as the operator's HTTPS website and its Onion-Location header, an official list, a SecureDrop onion name, or a PGP-signed mirror list checked against a key you already trust. Then compare all 56 characters. The checksum catches typos, but phishing clones are different valid addresses, and the onion icon does not prove you are on the right site.

What should I do if I see child sexual abuse material on an onion site?

Stop and close the page. Do not download, screenshot or forward anything. Report the address to the right hotline: the NCMEC CyberTipline in the US, the Internet Watch Foundation in the UK, or your national hotline listed by INHOPE elsewhere. Then tell your organisation's legal counsel. Record that you reported it, without describing the content.

Tor Relay Lookup Onion Pivot Extractor PGP Key Inspector Evidence Logger Connection Fingerprint Stylometry Dark Web OSINT OSINT OpSec