🧅 Tor Browser Setup

To begin using Tor Browser, visit the Tor Project website at torproject.org — the only source worth trusting, since third-party mirrors and app-store listings are a common way tampered installers get distributed. Select the build for your operating system: Windows, macOS, Linux, or Android. There's no official iOS build; the closest alternative is Onion Browser, which runs a different network stack and is worth treating as a fallback, not an equivalent. The desktop packages run 80-100MB. If GPG is available to you, verify the file's signature against the Tor Project's published signing key before running anything — a tampered installer looks identical to a real one until you actually check.

Run the downloaded installer and choose an installation directory you control. On Windows, extract the Tor Browser folder to your preferred location — no administrator privileges are required, which is itself a security property: Tor Browser doesn't need elevated access or registry changes to run. On macOS, drag the app into Applications the same way you would any other app. On Linux, extract the tarball and run ./start-tor-browser.desktop; some distributions also package it through their own repositories, but the tarball from torproject.org gets security patches fastest. On any platform, Tor Browser is self-contained — it doesn't register itself as your default browser and can be removed by deleting the folder, no uninstaller involved.

On first launch you'll be asked to connect to the Tor network. In most countries, clicking Connect gets you online in a few seconds. If your connection is in a country that actively censors Tor, click Configure instead and add a bridge — the built-in obfs4 bridges work on most censored networks without extra setup. Once connected, go to Settings → Privacy & Security and set the security level to Safest. This disables JavaScript site-wide along with most video/audio codecs and some fonts, which means a plainer-looking page in exchange for closing off the single largest attack surface that's actually been used in real deanonymization exploits against Tor users. Standard and Safer both leave JavaScript enabled for some or all sites — a meaningfully bigger risk on a page you don't control.

Before doing anything else, confirm you're actually routed through Tor by visiting check.torproject.org; it should report that you're using Tor and show an exit-node IP address that isn't your real one. If it doesn't, close the browser and start over — a proxy, a VPN forcing its own route, or a misconfigured bridge is interfering, and it's worth fixing before you go anywhere near a market link. You can sanity-check Safest mode the same way: open any page with embedded video and confirm it doesn't autoplay. From here, treat every onion address the same way every time — paste it in by hand from a bookmark you created yourself, never from a search result or a link someone sent you, and cross-check it character-by-character against our verified mirrors page before entering any credentials.