Why using a VPN and Tor together can backfire on your privacy

Although Tor and VPNs both serve to protect privacy, they’re fundamentally different in the way they work. Tor encrypts your data multiple times and forwards it via three independent servers worldwide. It separates the user’s identity from their traffic path, helping protect against tracking. Tor also creates new connections every ten minutes to make it considerably more difficult to permanently allocate traffic. A VPN, on the other hand, protects your traffic through a single tunnel via a provider server that hides your IP address, but is able to know your identity.

Thomas Joos

Why using a VPN and Tor together can put your anonymity at risk

Many users hope to achieve double security by combining VPN and Tor, but this approach actually introduces new risks. The VPN provider can see your original IP address and knows you’re connecting to Tor. If the provider keeps logs or comes under pressure, your identity could be exposed.

This risk is especially significant when VPNs store personal data like email addresses or payment information, details often required during registration, which makes tracing you easier.

Also, using a VPN and Tor together can actually make you less safe. VPN servers are often targeted by hackers, and if the VPN app isn’t open source, it might have junk, trackers, or hidden backdoors that can put your security at risk.

Christoph Hoffmann

Why VPN over Tor and Tor over VPN can undermine your privacy

VPN over Tor and Tor over VPN are different setups, both with risks. VPN over Tor is complex and weakens Tor’s privacy. Tor over VPN means trusting the VPN. It’s usually better to just use one—Tor or a VPN, not both.

VPN connections to the Tor network are more conspicuous

Connections from VPN servers to the Tor network stand out from regular Internet traffic, drawing close attention from surveillance authorities. Even when VPN and Tor encryption are used together, these connections remain conspicuous. Advanced techniques like deep packet inspection can detect and classify VPN data streams despite encryption. Additionally, website fingerprinting attacks can analyze traffic patterns to infer which sites have been visited, meaning VPNs do not provide complete anonymity or camouflage.

Thomas Joos

Technical risks associated with simultaneous use

VPN connections can be interrupted or incorrectly configured. Without special protection mechanisms such as a VPN firewall, your real IP address would be transmitted immediately in this case. Complex configurations such as setting up transparent proxies are also prone to errors and difficult to control. The developers of the Tor project expressly warn against such setups because they create new vulnerabilities instead of security.

Paying for a VPN subscription poses a further risk. Anyone who enters personal data when registering or pays by credit card can be deanonymized by payment service providers. Only a few providers accept anonymous payment methods such as Monero.

Operating your own VPN server could theoretically minimize some risks, but does not protect you from being monitored by your internet provider.

Further reading: 14 VPN terms and features everyone should know

When VPN and Tor could be useful together

There are a few exceptional cases in which a combination can be useful. In countries with strong internet censorship in which the Tor network is blocked (like China or Iran), a VPN can help to establish a connection. However, in these cases, the VPN provider would have to be absolutely trustworthy and not keep any logs.

A better solution is Obfs4 bridges, which disguises Tor traffic so that it looks like regular internet traffic. This is useful in countries with strong censorship, as they hide the typical signature of Tor traffic.

Thomas Joos

Whistleblowers, who place particularly high demands on their anonymity, could also benefit from additional protection in individual cases. Nevertheless, the risk remains that VPNs can be exposed by traffic fingerprinting techniques.

Tor alone is often the better choice

Tor is designed to achieve anonymity through diversity and distribution. Every user benefits from the fact that their data traffic is lost in the flow of other connections. If you build additional tunnels, you are more likely to attract attention and thus weaken the actual advantage of the network. It would make more sense than an additional VPN service to invest resources in the operation of a dedicated Tor relay and thus strengthen the security of the entire network.

The Tor project points out that a large number of connections with standard-compliant patterns are crucial for individual users to be able to disappear into the masses. The more a connection stands out from this pattern, the easier it becomes to identify.

Analyzing real cases such as the arrest of the Silk Road operator also shows that the greatest dangers lie less in technical weaknesses than in human error. A clear separation of real names, personal accounts, and anonymous surfing therefore remains essential.

Rely on the strengths of Tor

The simultaneous use of VPN and Tor does not make sense in most cases. Not only does it make anonymity more difficult, it also makes your connection more conspicuous and potentially more vulnerable. If you’re looking for maximum privacy, you should use Tor directly, without additional tunnels, and ensure that your own activities are properly separated. Consciously using Tor bridges and supporting the Tor network with your own relays also contributes effectively to protecting your privacy.