Tor Browser is safe for ordinary use, and using it is legal in the United States. Those are the two anxieties behind this search, so let's settle them first — and then be honest about the caveats, because Tor's safety depends on what you're protecting yourself from and on a few behaviors that can quietly defeat it. For most people asking this question, the fuller answer turns out to be: yes it's safe, and you may not actually need it.
What Tor Browser actually is
Tor Browser is a free, open-source browser (built on Firefox) that routes your traffic through the Tor network: at least three volunteer-run relays, each adding its own layer of encryption. The design goal is that no single point in the chain knows both who you are and what you're looking at. In the Tor Project's own words, the first relay can see encrypted traffic coming from your computer but "still doesn't know who you are and what you are doing," and a bad exit relay can see the traffic you sent "but if you're using encryption, it will only know the destination."
The practical effect: websites you visit don't see your IP address, your internet provider doesn't see which sites you visit, and your browsing can't easily be tied together into one profile. The cost is speed — three encrypted hops make everything noticeably slower — and occasional friction, since some sites block or CAPTCHA-wall Tor traffic.
Is Tor legal?
In the US, yes. Tor is developed by a nonprofit, was originally sponsored by the US government, and remains partly government-funded. The EFF's Tor legal FAQ states it is "not aware of an individual being sued, prosecuted, or convicted" even for running a Tor relay — and merely browsing with Tor is far less legally interesting than running the infrastructure. Illegal activity is equally illegal over Tor; the tool itself is lawful.
The related worry — "does downloading Tor put me on a list?" — deserves a straight answer. In 2014, leaked NSA XKeyscore rules showed that connections to Tor's directory servers and website were flagged for retention. That's a documented fact, and also a twelve-year-old one; no comparable evidence has surfaced since. The practical counterweight is scale: millions of people use Tor daily for mundane reasons, and as one Tor researcher put it in the Hacker News discussion of Tor's safety, "Tor usage should be normalized so it is common and not notable."
Is Tor safe? The honest risk list
Malicious relays are real, documented, and mostly aimed at cryptocurrency theft. In 2020, a single actor controlled roughly a quarter of Tor's exit capacity at peak and used it to strip HTTPS from cryptocurrency sites and swap Bitcoin addresses; the Tor Project confirmed and removed the relays. A separate actor ran hundreds of relays from 2017–2021 before being purged. The takeaway isn't "Tor is compromised" — it's that the exit relay can see unencrypted traffic, so HTTPS (which Tor Browser enforces where possible) is what protects the content of what you send.
When law enforcement has deanonymized Tor users, it has broken the browser or the user's software — not the Tor protocol. The FBI's best-known operation (2015's Playpen case) worked by exploiting a Tor Browser vulnerability to make targets' computers phone home. A German case disclosed in 2024 used timing analysis against a chat app that had been retired years earlier and lacked protections modern Tor software has; the Tor Project's response, "Is Tor still safe to use?", is the primary source, and its answer — for Tor Browser users on current versions — is yes. The lesson for you is unglamorous: keep Tor Browser updated.
The biggest risk is your own behavior. The Tor Project's staying-anonymous guidance is blunt: log into your Google or Facebook account over Tor and the site "still doesn't know your location, but they know who you are." Don't torrent over Tor — torrent clients commonly leak your real IP address. And don't open downloaded documents while online; they can fetch resources outside Tor and reveal your IP, a warning the Tor Project marks "DO NOT IGNORE."
Tor Browser also ships three security levels — Standard, Safer, and Safest — that progressively disable JavaScript and other risky website features. If your situation is serious enough to need Tor, "Safer" is a sensible floor.
When Tor is overkill — and what to use instead
Here's the part most "is Tor safe" articles skip: if your goal is to stop advertisers, trackers, and profile-builders — rather than to hide your IP address from the sites you visit — Tor is more tool than you need, and the speed cost buys you little.
- Mullvad Browser is the direct off-ramp: built by the Tor Project itself in partnership with Mullvad, it's "a Tor Browser without the Tor network" — the same anti-fingerprinting engineering at normal browsing speeds. It doesn't hide your IP on its own (pair it with a VPN if that matters to you).
Use Tor when the network matters: you need your IP hidden from the destination, you're on a network that censors what you can reach, or you're researching something where being identified carries real risk. For everyday browsing, our guide to the best private browsers maps the full field.
Frequently asked questions
Is Tor illegal? No — using Tor is legal in the US and most democracies. What you do over it is judged exactly as it would be on any browser.
Can I be tracked on Tor? Not easily, and not by ordinary websites or advertisers. Documented deanonymization required either malware exploiting browser bugs or logging into an account that identifies you. Keeping the browser updated and staying logged out is most of the defense.
Do I need a VPN with Tor? The Tor Project doesn't recommend layering one for most users — it changes who can see what rather than adding straightforward safety. If you want VPN-plus-privacy-browser, Mullvad Browser with a VPN is the cleaner design.
Is the dark web the same as Tor? No. Tor can reach onion sites, but most Tor usage is ordinary web browsing with the identity layer stripped off. Installing Tor doesn't expose you to anything by itself.
What Tor can't do for you
Tor hides where your traffic comes from. It does nothing about the fact that your name, home address, phone number, and relatives are already published on people-search sites — profiles built from public records and data brokers, not from your browsing. Anyone who searches your name finds them regardless of how carefully you browse. Removing those listings is a separate, site-by-site process, mapped in our full removal guide.
That's the layer DelistMyData automates — filing the opt-outs across people-search sites and re-filing when your data reappears. We're in pre-launch now; join the waitlist for founding-member access as we bring it online.