Opening Tor Browser on your home line

You open Tor Browser on the connection you pay for. Nothing has been searched for yet, no site has been opened, no account exists. This card is about that moment alone.

The moment Tor Browser starts, your machine opens a connection to a relay. That connection is ordinary in every mechanical sense. It uses the same protocols as the rest of your traffic and it travels down the same line. What makes it distinguishable is the address it goes to, because the list of public Tor relays is published openly and anyone can compare against it.

So the record that gets created at this instant is short. A device on your line opened a connection to a machine that appears on a public list of relays, at a particular time, and moved some amount of data. That is the whole of it. Everything else people imagine being in that record is somewhere else, held by somebody else.

The router in the flat sees a slightly different slice. It knows which device on the local network did this, by its local address and often by a hardware identifier and a device name. If three people live in the household, the provider sees one line while the router can tell the laptop from the phone. People forget that distinction exists because they do not think of the router as an observer at all.

What they learn, concretely

Put the record in the form it actually takes rather than in the form people fear.

• That the subscriber line was in use at a given time, which the provider knows anyway because you pay for it.
• That a connection was opened to an address that is publicly listed as a Tor relay.
• The start time, the end time, and therefore the duration.
• The approximate byte counts in each direction.
• On the router: which device in the building did it, and what that device calls itself.
• That the pattern repeated, if it repeats. Regularity is visible without any content being visible.

The last item deserves attention because it is cheap to collect and easy to underrate. One connection is one connection. The same connection at roughly the same hour on many days is a habit, and a habit is a stronger observation than any single session. That belongs properly to how long the session runs, which treats timing as a subject in its own right.

What they do not learn, concretely

This half of the card is not a reassurance, it is a list of specific facts that are absent from the record.

The provider does not learn which onion address you opened. It does not learn which pages you loaded or in what order. It does not learn what you typed into a search box or a form. It does not learn whether you registered anywhere, whether you signed in, whether you are a returning visitor or a first time one. It does not learn whether any money moved.

It also does not learn the addresses at the top of this page, because you never sent them to it in a readable form. An onion address is resolved inside the Tor network, not by an ordinary name lookup on your line. That mechanism is described under finding the onion address. It is one of the few places where the usual mental model of how the web works simply does not apply.

And it does not learn intent. A connection to a relay is produced by journalists, by people in censored countries, by researchers, by people reading medical forums they would rather not have on a household record, and by people doing nothing more unusual than preferring not to be profiled by advertisers. The record cannot tell those apart, because the distinguishing information is not in the record.

The visible fact is that you use Tor

It is worth stating without softening: on a normal connection to a public relay, the fact that Tor is being used is visible to the network. That is the one thing this action genuinely discloses.

Using Tor is lawful in most jurisdictions and this site does not offer legal advice about any particular one. It is used at very large scale for reasons that have nothing to do with any market. Treating the mere presence of Tor as an accusation would sweep in an enormous ordinary population, which is exactly the point made on downloading Tor Browser.

Context matters. On a corporate network an administrator may treat it as a policy violation regardless of legality, and on a network belonging to somebody else the operator may simply notice. Both are covered on borrowed or public wifi.

What changes the answer

5 things change how much this action gives away. None of them takes it to zero, and none of them is a promise.

1. Use a bridge instead of a public relayA bridge is a relay that is not on the published list, which removes the easy comparison the network observer would otherwise make. It does not hide that traffic exists, it does not change volume or timing, and it introduces the bridge operator as a new party. See turning on a bridge.
2. Know what your own router keepsRouter logs are the observer inside your own building, and they are the one you have any control over. Knowing whether yours logs connections, and for how long, changes what a person with physical access to the flat could read. It changes nothing at the provider.
3. Give the device a name that says nothingDevices announce a name on the local network, and the default is often a personal name or a model number. Changing it affects who can tell which household member is which on the router. It has no effect at all beyond the router.
4. Separate the machine from the rest of the householdA device used for one purpose produces a cleaner record than a device that does everything. This affects correlation on the local network only. The line itself still shows the same aggregate.
5. Accept the visible fact rather than working around it badlyLayering unfamiliar tools to hide Tor use commonly makes the record stranger, not quieter, and it adds operators who now see you. Adding a VPN to Tor covers the specific version of this trade.

What this card is not

This card is not a claim that opening Tor at home is private in general. It describes one observer at one moment, and that observer is only the first of seven.

Questions that come up

Can my provider see the market name in a lookup?

An onion address is not resolved by the ordinary name system on your connection, so there is no lookup on the line to read. What travels is a connection to a relay.

Does using my phone instead of a laptop change this?

It changes who the network observer is, from a fixed line provider to a mobile carrier, and it adds an approximate location from the cell the handset used. The content picture is unchanged.