What Tor and VPNs actually do

Ask ten people what a VPN does and you'll get ten versions of the same vague answer: it makes you anonymous, it hides you from hackers, it stops the government watching. Ask what Tor does and most people will say "dark web" in a slightly lowered voice.

Both tools are genuinely useful. Neither does what the marketing implies. The confusion isn't the public's fault. It's the predictable result of an industry that sells fear and a technical community that explains things in packet diagrams. So let's do this properly, without either.

Start with who can see you

Before you can understand what these tools fix, you need to know what's broken. When you visit a website, a short queue of parties learns something about it.

Your local network (the coffee shop router, the hotel wifi, your flatmate's Raspberry Pi) sees which sites you connect to. Your internet service provider sees the same thing, and it knows exactly who you are, because you pay them monthly. The website itself sees your IP address, your browser, and whatever you tell it by logging in.

Here's the part that gets left out of most VPN advertising: thanks to HTTPS, nearly all of these parties see only which site you visited, not what you did there. Your ISP knows you connected to a mental health charity. It doesn't know which page you read. That's a meaningful distinction, and it means the classic "hackers on public wifi are stealing your passwords" pitch describes a threat that was largely solved a decade ago by encryption you already have, for free, in every browser.

So a VPN isn't rescuing you from an open sea of plaintext. It's doing something narrower and more specific.

What a VPN actually does

A VPN encrypts your traffic between your device and a server run by the VPN company, then sends it onward from there. That's it. That's the whole mechanism.

The consequence is a swap. Your ISP and the coffee shop router now see one thing: an encrypted connection to a VPN provider. They lose your browsing history. The website, meanwhile, sees the VPN server's IP address rather than yours.

But someone still sees everything. The VPN company now occupies exactly the position your ISP used to hold. It can observe every site you visit, and it knows who you are, because you pay it monthly. You haven't eliminated the observer. You've changed which company it is.

That's not automatically a bad trade. Your ISP is legally identified, regionally regulated, sometimes commercially interested in your data, and in some countries obliged to retain it. Choosing a different custodian can be a real improvement. But it is a trust transfer, not a disappearance, and the honest question is never "should I use a VPN" but "do I trust this company more than my ISP, and why?"

The uncomfortable answer is that you largely can't verify it. "No-logs" is a promise about the internal configuration of servers you'll never see. Independent audits help, but an audit is a photograph, not a livestream. It says something about one moment, under conditions the company agreed to. The strongest evidence tends to come from accidents of the legal system: providers whose servers have been seized by police and who turned out to have nothing useful stored on them. That's real evidence. It's also rare, retrospective, and no guarantee about tomorrow.

And a VPN does nothing whatsoever about the website knowing who you are. If you log into your account, you have introduced yourself by name. No amount of tunnelling undoes a username.

What Tor actually does

Tor solves a different problem, and solves it in a genuinely clever way.

Instead of routing your traffic through one company's server, Tor bounces it through three volunteer-run relays, wrapped in layers of encryption. The design isn't about adding hops for their own sake but about splitting knowledge:

• The first relay knows who you are, but not where you're going.
• The middle relay knows neither. It just shuffles encrypted parcels between strangers.
• The exit relay knows where you're going, but not who you are.

No single participant holds both halves of the secret. Where a VPN asks you to trust one company completely, Tor is engineered so that no one needs to be trusted completely. That's the philosophical difference, and it's the whole ballgame.

It comes at a cost. Tor is slow, because your traffic is taking a scenic route through three volunteers' spare bandwidth. Many websites treat Tor traffic as suspicious and greet you with endless CAPTCHAs or outright blocks. And the exit relay, while it doesn't know who you are, can see your traffic as it leaves and so HTTPS still matters enormously.

There's also a threat Tor can't fully defeat: an adversary watching both ends of the network at once can correlate timing and volume patterns to link them. This requires enormous visibility, which puts it beyond most attackers and firmly within reach of a few.

The failure mode both tools share

Here's the part worth tattooing somewhere visible: the most common way people are identified while using these tools is that they identify themselves.

You can route through Tor and log into your everyday email account. You can pay for a VPN and then post a photo of your street. You can browse anonymously and still be recognised by browser fingerprinting. The unique combination of your screen size, fonts, timezone and graphics quirks which neither tool addresses. Malware on your machine doesn't care how your packets travel. Neither does a convincing phishing page.

These are network tools. They protect the wire. They do not protect you from you.

Matching tool to problem

The reason this matters is that using the wrong tool doesn't just fail but it fails while feeling like success. Someone in genuine danger who believes a consumer VPN makes them anonymous has bought confidence rather than protection, and confidence is the more dangerous product.

Tor distributes trust so that no one holds it all. A VPN concentrates trust in a company you chose from a review site. Both are legitimate designs. Only one of them is usually sold as magic.