Tor vs VPN vs proxy usually gets argued on speed and price. A better first question is which watcher you want out of the picture and which one you are willing to let in. The café Wi-Fi, your ISP and the site you open each see part of your connection by default, and each of the three tools removes some of them by adding another.
A VPN or a proxy hands one operator both your address and where you go. Tor is built so that no single relay holds both.
What a VPN provider can see
A VPN puts all of your device's traffic into one encrypted connection to the provider's server, which then opens the real connections for you. The Wi-Fi and the ISP now see one destination, the VPN server, plus how much you send and when. The provider sits where your ISP sat. It sees your real IP address, the address of every site you reach, the content of any plain HTTP page and, on HTTPS sites, the site name your browser announces at the start of the connection (the SNI field) unless the site uses Encrypted Client Hello, which encrypts it. Names looked up through the provider's DNS resolver, the server that turns site names into addresses, are readable too.
The tunnel doesn't hide that it exists. WireGuard, for one, doesn't disguise itself and leaves obfuscation to layers above it, so a filter can pick VPN traffic out without reading it.
What the provider stores is the open question, and a no-logs promise can't be checked from outside, because nobody can inspect what a server didn't write down. An independent audit narrows the doubt but describes one configuration at one moment. A VPN fits when the watcher you worry about is the network around you and you trust the company more than that network.
What a proxy operator can see
A proxy relays requests only for the apps configured to use it. The operator sees your IP address and the destination of everything those apps send, which is the VPN provider's position with less cover on the way there. How much cover depends on the type:
- HTTP proxy, plain HTTP site. The app hands over the whole URL, so the operator reads the request and the response.
- HTTP proxy, HTTPS site. The app sends a CONNECT request that names only a host and a port. After that the proxy forwards bytes in both directions without reading them, but it already knows the host.
- SOCKS5. In everyday use nothing is encrypted: the destination, an IP address or a hostname, crosses the network readable, and so does the password if the proxy requires a login.
- HTTPS proxy. The connection to the proxy is wrapped in TLS, the encryption behind HTTPS, so the Wi-Fi sees only the proxy. The operator's view doesn't change.
Two details decide who else learns where you browse. A proxy may pass your address on to the site in a Forwarded header, the standard way for a proxy to tell a site who the original client was. And a SOCKS5 client that looks up the site name itself sends that lookup to your own resolver, outside the proxy. Handing the name to the proxy moves the lookup, and the knowledge, to the operator. A proxy therefore fits a narrow job: giving one app another address.
What each Tor relay sees
Tor sends traffic through a circuit of three volunteer-run relays. Your client wraps the request in one layer of encryption per relay, and each relay can remove only the layer addressed to it.
- Guard, the entry. It sees your IP address and that you are connecting to Tor. It can't see the site.
- Middle. It sees the relay before it and the relay after it, and neither you nor the site.
- Exit. It sees the site you reach, resolves the name, and reads the content when the connection isn't HTTPS. It doesn't see who you are, and the site sees the exit's address instead of yours. Exits have been caught tampering with unencrypted connections.
Your ISP sees a connection to a Tor relay. Relay addresses are public, so a network can recognize or block them, and a website can challenge or block exit traffic, which many do. A bridge, a relay missing from the public list, makes the first hop harder to block.
The guard stays the same for months, on purpose. With a fresh entry and exit for every circuit, an attacker who watches a slice of the network would get a new chance to land on both ends each time. A fixed guard turns repeated chances into a single draw.
Tor vs VPN: which one is more secure
A VPN wins on speed and coverage: it carries a whole device's traffic rather than TCP streams alone, to a server you chose. Tor wins on how little any single party learns, and pays for it in speed, because traffic bounces through volunteers' servers around the world. Each also fails somewhere specific. A VPN fails at its operator: a compromised or careless company exposes your address next to your destinations in one spot. Tor fails when one party can watch both ends. An observer who sees you and also sees the site or the exit can line up the timing and volume of what goes in with what comes out, and Tor doesn't defend against that.
All three fail at the login form. Log in to an account through a VPN, a proxy or Tor and the site knows who you are, whatever address it sees. Tor keeps your location apart from your destination, and what you type is still up to you.
Stacking a VPN on Tor is an advanced setup rather than a free upgrade. Configured wrongly, it can weaken the protections Tor gives you, and the usual advice is to skip it unless you know how to configure both. The reason people reach for it, hiding Tor use from the network they are on, is what a bridge is for.
Which design fits which threat
| Threat | Fits | Who still sees what | Where it fails |
|---|---|---|---|
| Your ISP or the Wi-Fi owner | VPN, or Tor | VPN: the company sees your address and destinations. Tor: the guard knows your address, the exit knows the site | Both show that you use them, unless Tor goes through a bridge |
| The site seeing your IP | VPN, Tor or a proxy | The site sees a VPN, exit or proxy address | An account you log in to; the reputation of a shared address |
| Both at once | Tor Browser, or a VPN if one company may see everything | Tor: no relay holds both ends | Timing match when both ends are watched |
| A network that blocks Tor or VPNs | Tor with a bridge | The bridge sees your address, the network sees a connection to it | Some countries detect certain bridges |
| A single app that needs a different address | Proxy | The operator sees that app's traffic | Plain HTTP and SOCKS5 proxies leave the first leg readable |
Shadowsocks, SSH tunnels, iCloud Private Relay, multi-hop VPNs and the two orders of Tor plus VPN are compared in the full VPN vs proxy vs Tor guide.
See whose address a site gets
- Start with your normal connection and run the Privacy & Trust Index scan. The DNS Privacy card shows who answers your lookups. ISP DNS means your provider answers them and can read them.
- Turn on the VPN, set the proxy in your browser, or open Tor Browser, and scan again. The IP Reputation card names the kind of address the site now sees, with labels such as VPN / PROXY and TOR EXIT NODE when the address is on a known list. A shared address inherits the history of whoever used it before, which the IP reputation guide covers.
- Read DNS Privacy again. NO DNS LEAK means the VPN or proxy handles your lookups, DNS LEAK means they still escape to a regular provider, and DNS VIA TOR means the exit node resolves the names. Each result tells you who reads the site names you look up.
