How long the session stays open

A network observer cannot read what moved, but it can always read when. Duration and rhythm survive encryption completely, because they are properties of the connection rather than of its contents.

Time is the part of the record that no encryption touches. If a connection was open from one moment to another, that fact is simply true and is visible to anything sitting on the wire, including every observer named under opening Tor at home. The same applies to the gaps, to the reconnections, and to the pattern across days and weeks.

Most readers accept this in the abstract and then underestimate it in practice, because they think of a session as an event rather than as a shape. A single forty minute connection tells an observer almost nothing beyond its own existence. Forty minutes on most weekday evenings, ending at a consistent hour, is a routine, and a routine is something you can plan around, compare against and notice the absence of.

What the timing record contains

• A start time, accurate to whatever resolution the observer records.
• An end time, or a series of them if the connection dropped and resumed.
• The duration that follows from the two.
• Idle gaps inside the session, visible as periods with little or no data moving.
• The frequency across days, which is the strongest part and the cheapest to store.
• Overlap with other things happening on the same line at the same moment.

That last item is the one worth pausing on. A household line is not a single stream. If a Tor session runs at the same time as a video call and a streaming service, the observer sees a busy line with several patterns in it. If it runs at three in the morning on an otherwise quiet connection, it is the only thing there. The same session is more or less conspicuous depending on what surrounds it, and you do not control that by choosing settings.

What duration does not support

A long session does not mean a large action, and a short one does not mean a small one. Reading for an hour and buying nothing produces a longer record than a two minute visit that ends in an order. The record measures presence, not outcome.

Duration does not identify a site. It does not distinguish reading from writing, browsing from messaging, or a market from a mail service. It does not reveal whether an account exists. It carries no information about what was in the traffic, only about when the traffic was there.

It also does not prove attention. This is the misreading that matters most, and it deserves its own section.

An open browser is not an active session

Leaving Tor Browser open all day changes the record substantially, and not in the direction people assume. From the network's point of view the connection is present for many hours. There will be low level traffic while it is idle, because the circuit maintains itself. The observer therefore sees a very long session with quiet stretches, rather than four short sessions with clean gaps.

Whether that is better or worse depends on what you care about. A long session hides the boundaries of when you were actually doing something, which is the argument in its favour. It also produces a much larger and more distinctive block on a line that is otherwise ordinary, and it extends the window in which anything else that happens on the machine coincides with an open circuit. There is no general answer here. What there is, is a difference, and readers routinely assume the browser being open costs nothing.

The related question, whether idle time is distinguishable from active use by volume alone, belongs to the shape of the traffic. The general point is that a low rate is not zero, and a record of continuous presence is still a record.

Where timing goes further than this section

Timing has a second life outside the network observer. Anything with a clock keeps one: the market records when a session was active on its own side, a vendor sees when a message arrived, a postal system stamps events with dates. When several parties each hold a timestamped record of the same underlying activity, the comparison is far more informative than any single one of them.

This site does not speculate about who compares what. It only notes that the network holds one of those clocks, that signing in creates another on a completely different party's server, and that the two describe the same hour from opposite ends.

What changes the answer

5 things change how much this action gives away. None of them takes it to zero, and none of them is a promise.

1. Close the browser when you finishEnding the session ends the record of presence, and stops a short piece of activity being wrapped in eight hours of connection. It does nothing about the sessions you did have, and nothing about repetition.
2. Do not make the rhythm exactA pattern is stronger than an event, and an exact pattern is stronger than an approximate one. Varying when you connect weakens the routine reading. It has no effect on the individual session record.
3. Notice what else is on the lineA session inside a busy evening is less distinctive than the same session on an otherwise silent connection. This is contextual and is not something a setting controls.
4. Separate long reading from short actionsIf most of a session is reading, that is what the duration reflects. Understanding that duration measures presence rather than outcome stops you drawing the wrong conclusion about your own record.
5. Remember the other clocksShortening what the line sees does not shorten what the other side recorded. The market's session log is a separate artifact held by a separate party.

What this card is not

This card is not a claim that timing identifies anybody on its own. It describes a signal that survives encryption and is commonly assumed not to exist.

Questions that come up

Does a very short session look suspicious?

A short connection is a short connection. The record is smaller, not stranger. Length is not evidence in either direction.

Is idle Tor traffic the same as no traffic?

No. An idle circuit still exchanges small amounts of data to stay alive, so the connection remains visible as present.