VPNs and Tor are separate technologies and neither needs the other. They overlap on two levels: both encrypt your traffic and both hide your IP address.
You can use Tor by itself and stay anonymous, and putting a VPN in front of it isn’t automatically an improvement, particularly if you connect them in the wrong order.
Even the Tor Project warns against combining them.
Having said that, I believe a Tor over VPN setup is a wise move for maximum privacy. A VPN brings a kill switch, and in a censored country it may be the only way to download Tor at all.
This all depends on how the Tor network works, so I’ll cover that first.
How Tor Works
The Tor browser encrypts your traffic and bounces it through a random chain of servers, called nodes. Each node knows only the ones either side of it.
How your data passes through the Tor network.
The guard node, first in the chain, sees your real IP address but not your traffic. The exit node, last in the chain, sees your traffic but not your IP address.
The two ways of combining Tor with a VPN come down entirely to those two nodes.
1. Tor over VPN (or Onion over VPN)
If you connect to a VPN and then use the Tor Browser, it’s known as Tor (or Onion) over VPN. It’s the easiest way to combine the two technologies.
Your traffic reaches the VPN server before Tor, so your ISP can’t see you’re on the Tor network. The guard node sees the VPN’s IP address instead of yours. Your VPN can’t see what you do inside Tor.
What this approach doesn’t do is hide your traffic from the exit node.
In short, your VPN knows you’re using Tor and knows your IP address, but not what you’re doing. Your ISP knows neither.
Let me clarify something: Tor over VPN is a method, not a product. It’s a different thing from the “Onion over VPN servers” some providers offer, which route .onion traffic through an ordinary browser.
2. VPN Over Tor
VPN over Tor is when you connect through Tor first, then to a VPN.
Your VPN traffic travels through the Tor network. Exit nodes can’t see your activity, but the guard node sees your real IP address.
Your ISP sees you’re using Tor, though not what for, and your VPN can technically see what you’re doing. This is why I don’t recommend using VPN over Tor.
Which Method Should I Use?
What a VPN adds depends on what you’re trying to avoid.
For most people the concern is their ISP noticing Tor traffic, and Tor over VPN protects you from that. It’s quicker to set up, faster to use, and gives you more back than VPN over Tor does.
VPN over Tor is only worth considering if malicious exit nodes are your specific worry, and even then I’d think hard about what that approach exposes.
EXPERT ADVICE: Avoid the “Onion over VPN” servers some VPN services provide. They open .onion sites in browsers like Chrome or Firefox, which are far less hardened than Tor. Connect to a standard server and use the Tor browser.
The Downsides of Using a VPN with Tor
Despite the potential benefits, using a VPN and Tor at the same time can actually decrease your anonymity.
A VPN service that won’t take cash or crypto leaves a payment trail with your name on it. A bad one logs IP addresses, activity and timestamps, which is the exact data trail you didn’t want to leave behind.
Adding a VPN means adding someone else you have to trust. Trust the wrong VPN company and you’re worse off than with Tor alone.
Also, Tor already encrypts your traffic three times over, and the VPN’s encryption isn’t strengthening that. What a VPN does is keep your Tor use concealed from your ISP, and that’s the reason to run one.
You’ll lose speed as well, so if hiding your Tor use isn’t something you need, you’re paying for nothing.
If you do decide to run a VPN with Tor, make sure you use a strict no-logs VPN and run anti-malware with it.
