The shape and size of the traffic

Encryption hides what the bytes say. It does not hide that there were bytes, how many, in which direction, or when they arrived. That residue has a name, and it is routinely described far too confidently in both directions.

Two claims circulate about traffic shape and both are wrong. The first is that encrypted traffic is featureless, so nothing can be read from it at all. The second is that the pattern of a page load is a fingerprint that names the site you visited. The truthful position is between them, and it is less dramatic than either.

What is definitely true is mechanical. A network observer counts bytes. It knows how many went out, how many came back, and when each group arrived. It can tell a small exchange from a large one and a steady flow from a burst followed by silence. None of that requires breaking anything, because none of it is inside the encryption.

What traffic analysis means, in general terms

Traffic analysis is the study of the metadata of communication: who is talking to whom, when, how often and how much, without reference to what is being said. It predates computer networks by a long way. Applied to encrypted web traffic, the research question is roughly whether the size and timing profile of a page load is distinctive enough to be recognised again.

This site is not going to describe how that is done, what improves it, or what defeats it. The reason is stated in the site rules and is worth repeating here: describing what an observer sees is a legitimate subject, and writing a manual for either side of that contest is not. What follows is the shape of the conclusion, not the method.

The honest summary is that the shape of a page load is a weak signal. It is statistical rather than definite. It is heavily affected by anything else happening at the same time, by the way the software batches data, by the size of what you actually loaded and by ordinary network variation. It produces likelihoods under laboratory conditions, and laboratory conditions are not a household line carrying four other things. Most importantly, it never produces a name. A shape is a shape. Attaching a person or a site to it requires information from somewhere else entirely.

What a volume record shows and does not

The right hand column is the part to carry away. Every entry in the left column is a measurement. Every entry in the right column requires an inference that the measurement cannot support by itself. The gap between the two columns is where overconfident claims live. Timing, which is a different residue and a much steadier one, is handled separately in how long the session runs.

The one asymmetry worth knowing

Direction is the property that occasionally says something a reader would not expect. Ordinary browsing is lopsided: you send small requests and receive larger responses. A session where a lot of data goes outward is doing something else, because sending is what uploading looks like.

That does not identify the content and it does not identify the recipient. It distinguishes reading from sending in aggregate, and only in aggregate. A single large outbound transfer inside an otherwise inbound session is visible as a bump in a byte count and nothing more. If it matters to you what leaves the machine, the question is better asked at the device and at the form you filled in, because those observers hold the content rather than the size.

What this site declines to say

This site takes no position on what any particular party is capable of. No agency is named, no capability is asserted or ruled out, and no figure is published for how well any technique performs. Anyone claiming a precise number for this in either direction is telling you about their confidence, not about your traffic.

What can be said without guessing is structural. A network observer at your end sees one end of the circuit. Seeing both ends is a different position, which belongs to the Tor network section rather than this one. Nothing on this page describes a way to change either fact.

What changes the answer

4 things change how much this action gives away. None of them takes it to zero, and none of them is a promise.

1. Keep the session doing one thingA session that mixes reading, large downloads and uploads produces a more varied volume profile than one that does not. This affects the aggregate only, and the aggregate was never a name to begin with.
2. Do not move large files unnecessarilyLarge transfers are the most visible thing in a volume record because they are the largest number in it. Avoiding them keeps the record flat. It does not make the session invisible.
3. Let the browser do its own thingTor Browser already applies its own handling to traffic. Adding homemade layers on top commonly makes a session more distinctive rather than less, and this site does not recommend or describe any such technique.
4. Judge claims by whether they name a mechanismA confident statement about what shape analysis can achieve, with no mechanism and no limits attached, is not a finding. Treat both the alarming version and the reassuring version the same way.

What this card is not

This card is not a guide to defeating traffic analysis and does not describe any technique for doing so. It states what a byte count contains and refuses to guess beyond it.

Questions that come up

Can my provider tell which page I loaded from the size?

Not from a byte count. Research on shape recognition is statistical, laboratory bound and contested, and it never produces a name on its own. This site publishes no figure for it.

Does a big download give me away?

It shows a large amount of data moved in one direction at a time. It does not show what the data was or where it came from beyond the first hop.