VPN vs Proxy vs Tor: What Each One Actually Protects

Why "VPN vs proxy vs Tor" is actually three different questions

People search "VPN vs proxy vs Tor" expecting a single winner, but the three tools were built to solve different problems, and comparing them on a single scale hides more than it reveals. A proxy server was originally built for routing and caching efficiency, not privacy. A VPN was built to let remote devices join a private network securely over the public internet, and consumer VPN apps repurposed that plumbing for privacy and geographic flexibility. Tor was built specifically for anonymity — resisting the very question "who sent this traffic?" — by a research project that later became a nonprofit. Once you know what each tool was actually designed to do, the "which is better" question mostly answers itself once you know what you're trying to protect against.

This guide walks through what each tool technically does to your traffic, what it hides from which party, where each one breaks down, and how to actually decide between them for a given situation — including the situations where the honest answer is "use more than one, for different purposes."

What a proxy server actually does

A proxy server sits between your device and the internet and forwards your requests on your behalf. The website you're visiting sees the proxy's IP address instead of yours, which is the entire basis of a proxy's privacy pitch. That's a real effect — it can be enough to get around a simple IP-based geographic block or to keep a single website from directly logging your home IP address — but it's also close to the full extent of what a proxy does.

Critically, most consumer proxy setups (HTTP or SOCKS proxies configured in a browser, or a browser extension marketed as a "free proxy") do not encrypt your traffic by default. HTTP proxies in particular pass your requests in plain text unless the underlying connection to the destination site is itself HTTPS — and even then, the proxy operator can typically see which sites you're connecting to, and can see the full content of any traffic that isn't already HTTPS-encrypted end to end. A SOCKS proxy is a bit more general-purpose (it can carry non-web traffic) but has the same lack of built-in encryption. Whatever privacy a proxy provides is about IP masking, not about securing the connection.

Another practical limitation: a proxy is usually configured per-application, not system-wide. Point your browser at a proxy and your browser traffic routes through it — but your operating system's other network traffic (other apps, background services, DNS lookups that don't respect the proxy setting) often doesn't. That partial coverage is easy to forget about and easy to misconfigure, which is part of why proxies aren't treated as a serious privacy tool by people who study this closely — they're a routing tool that happens to have a privacy side effect, not a privacy tool with routing as a side effect.

What a VPN actually does

A VPN app on your device establishes an encrypted tunnel to a server operated by the VPN provider, and — unlike a typical proxy configuration — it routes your device's traffic through that tunnel at the operating-system level, not just inside one browser. Every app on the device, and DNS lookups too (assuming the VPN app is configured correctly), goes through the encrypted tunnel to the VPN server, which then forwards your requests to their real destination on the open internet.

Two effects follow from that. First, anyone positioned on the network path between your device and the VPN server — your ISP, the operator of a public Wi-Fi network, someone else on that same Wi-Fi network — sees encrypted traffic going to the VPN server's IP address, and nothing about the sites you're actually visiting or the content of your traffic. That's the main reason "use a VPN on public Wi-Fi" became common advice: it addresses a genuine risk (a local network snooping on unencrypted traffic) with a genuine fix. Second, the website or service you connect to sees the VPN server's IP address rather than yours, which is what enables the geographic-access and IP-masking use cases VPNs are marketed around.

What a VPN does not do is remove the VPN provider itself from the trust equation. The provider's server is the point where your encrypted tunnel ends and your traffic continues on to its real destination — which means the provider is technically capable of seeing which sites you connect to, in the same way an ISP could without a VPN. This is exactly why a VPN provider's logging policy and jurisdiction matter as much as the encryption technology itself: you're not eliminating a party that can see your traffic, you're choosing to trust a different party than your default ISP. See our guide to evaluating VPNs for privacy for how to actually assess that trust question rather than taking a "no-logs" claim at face value.

What Tor actually does

Tor (The Onion Router) takes a structurally different approach: instead of routing your traffic through one server you have to trust, it routes it through three relays run by different, independent volunteer operators around the world, with a separate layer of encryption for each hop — hence "onion" routing. Your traffic is encrypted in layers before it leaves your device; each relay in the circuit peels off one layer, learns only the address of the next hop, and passes the still-encrypted remainder along.

The practical consequence is the property Tor is actually designed around: no single relay in the circuit knows both who you are (your real IP, from the entry relay's point of view) and what you're doing (the destination site, from the exit relay's point of view). The entry relay sees your real IP address but not your destination. The exit relay sees your destination but not your real IP. A VPN, by contrast, has both pieces of information sitting on the same server unless the provider has specifically engineered around that (which is a separate, provider-specific claim worth verifying rather than assuming).

That design comes with real costs. Bouncing traffic through three volunteer-run relays scattered across different countries is inherently slower and higher-latency than a direct connection or a single VPN hop, and Tor's network capacity is far smaller than the infrastructure a commercial VPN operates, so the slowdown is often noticeable — streaming video or large downloads over Tor is a rough experience by design, not by accident. Tor is also actively blocked or throttled by some websites and services, partly because Tor exit-node IP addresses are public and get used disproportionately for abuse, which means some sites treat all Tor traffic with suspicion (CAPTCHA walls, outright blocks) regardless of the individual user's intent. And using the Tor Browser is itself sometimes a visible signal in places where Tor usage draws attention — worth thinking about if the threat model includes "don't look like I'm doing anything unusual."

What happens to your DNS requests with each one?

DNS — the system that translates a domain name like "example.com" into an IP address — is one of the most commonly overlooked leak points in this whole comparison, and it's worth walking through separately because "I'm using a VPN/proxy/Tor" doesn't automatically mean your DNS requests are covered.

With a typical unencrypted proxy, DNS resolution often happens outside the proxy entirely: your device asks your regular DNS resolver (frequently your ISP's) to look up a domain before the request is even routed to the proxy, depending on the proxy type and how the application handles it. That means your ISP can potentially see which domains you're looking up even while your actual traffic is going through a proxy that changes the destination site's view of your IP address — a mismatch that undercuts the privacy value of using a proxy in the first place.

A properly functioning VPN, by contrast, is generally built to route DNS requests through the encrypted tunnel along with everything else, resolving them using the VPN provider's own DNS servers rather than your ISP's. This is the intended behavior, but it isn't automatic in every situation — a misconfigured app, an operating system that doesn't fully respect the VPN's routing, or IPv6 traffic that the VPN app doesn't handle can all produce a "DNS leak," where DNS requests slip outside the tunnel even though the rest of your traffic is protected. Reputable VPN apps include DNS-leak protection and IPv6 handling specifically to close this gap, and independent DNS-leak test tools exist to check whether a given setup is actually working as intended — worth running once after setting up a new VPN connection rather than assuming it's covered.

Tor handles DNS differently again: rather than your device performing a separate DNS lookup, domain resolution for onion-routed traffic is generally handled by the exit relay as part of the circuit, so a correctly configured Tor client (like Tor Browser, used as intended) doesn't leak DNS requests to your local network or ISP the way a misconfigured proxy might. The caveat, as with everything else about Tor, is that this protection applies to traffic that's actually routed through Tor — a separate application on the same device that isn't Tor-aware will still resolve DNS the normal way, outside any of Tor's protections.

Is it legal to use a VPN, a proxy, or Tor?

In most countries, yes, using any of the three is legal in itself — they're general-purpose networking tools, not tools built around a specific illegal act, and using one doesn't change the legality of what you do with it. What you do over the connection remains subject to the same laws it would be without one; none of these tools make an otherwise illegal act legal, and none of them make a legal act illegal.

That said, the legal picture does vary meaningfully by country, and this is an area where it's worth checking current, country-specific guidance rather than relying on a general rule, since laws change and enforcement varies. A small number of countries restrict or heavily regulate VPN use, sometimes requiring VPN providers to register with the government or blocking VPN protocols at the network level; Tor is blocked or restricted in some countries specifically because its anonymity properties are seen as a threat by governments that want to monitor citizens' internet use. Using a VPN or Tor in a place where it's restricted can carry consequences that have nothing to do with what you're actually doing online — it's the use of the tool itself that's regulated in that context, which is a different risk category from "is what I'm doing online illegal."

One more distinction worth making: a workplace, school, or other network you don't own may have its own rules against VPN, proxy, or Tor use that are separate from the law — a rule enforced by an acceptable-use policy rather than a government. Violating a network owner's policy isn't a legal matter in the same sense, but it can still have real consequences (account suspension, employment consequences) worth being aware of before connecting through a network you don't control.

Common misconceptions worth correcting

"A VPN makes me completely anonymous online"

Covered in more detail above, but worth restating plainly: a VPN hides your IP address and encrypts your traffic in transit — it doesn't stop a site you're logged into from knowing who you are, and it doesn't defeat browser fingerprinting techniques that don't rely on IP address at all.

"A proxy and a VPN are basically the same thing"

They're both IP-masking tools, which is where the similarity ends. The default assumption for a proxy should be "no encryption, single-app coverage" unless a specific proxy service states otherwise, while a VPN's core value proposition is system-wide encryption. Some services marketed as "proxies" do add encryption or broader coverage, which is really just reinventing a VPN under a different name — the label alone doesn't tell you what you're getting, so it's worth checking what a specific service actually does rather than assuming based on what it's called.

"Tor is only for illegal activity"

Tor's user base includes journalists communicating with sources, activists and human rights workers operating in hostile environments, people in countries with heavy internet censorship simply trying to reach ordinary blocked websites, researchers and law enforcement conducting investigations that require anonymity, and plenty of privacy-conscious people using it for entirely ordinary browsing. Like any general-purpose privacy tool, it can be misused, but that's true of encryption, cash, and plenty of other neutral tools — the tool itself isn't evidence of intent.

"If I use a VPN, my internet activity can't be tracked at all"

A VPN changes what your ISP and the destination site can see about your network-level traffic. It does nothing about tracking that happens above the network layer: account logins, first-party and third-party cookies (subject to a browser's own cookie settings, unrelated to the VPN), and browser or device fingerprinting are all still fully in play regardless of whether a VPN is active.

Side-by-side: what each tool hides, and from whom

The clearest way to compare the three is to ask, separately, what each one hides from your ISP/local network, what it hides from the destination website, and what it hides from the tool's own operator.

From your ISP or local network: a VPN hides both the destination and the content of your traffic (it sees only encrypted traffic to the VPN server). Tor also hides both, for the same structural reason. A standard unencrypted proxy hides neither reliably — your ISP can typically see that you're connecting to the proxy and, depending on setup, may still see what you're doing through it.

From the destination website: all three can hide your real IP address, which is the one thing they have in common. A VPN and a proxy both substitute their server's IP for yours; Tor substitutes the exit relay's IP. Site-level identification through cookies, account logins, browser fingerprinting, or behavioral tracking works the same regardless of which of the three you're using — none of them touch that layer.

From the tool's own operator: this is where the three diverge most. A proxy operator can typically see your traffic in full, often without even the baseline of encryption a VPN provides. A VPN provider can see which sites you connect to (though not what happens inside an HTTPS-encrypted page, since that encryption is separate from and additional to the VPN tunnel), which is why the provider's own trustworthiness and logging practices matter so much. Tor's relay-splitting design means no single party in the default configuration holds both your identity and your destination — which is the specific property that makes Tor's anonymity model different in kind, not just in degree, from trusting a single VPN provider.

Does a VPN make you anonymous?

No, and providers that imply otherwise are overselling what the technology does. A VPN hides your IP address from the destination site and hides your traffic from your local network, but it doesn't erase the other ways sites identify you: logging into an account, accepting cookies, browser fingerprinting techniques that don't depend on IP address at all, or simply giving a site your name and email address in a form. A VPN is a tool for controlling who can see your IP address and traffic contents at the network level — it's not a general anonymity system, and it was never built to be one. If genuine anonymity against a sophisticated adversary is the actual goal, that's specifically the problem Tor's design is aimed at, and even Tor comes with caveats covered below.

Is Tor actually anonymous, or just anonymous-ish?

Tor's relay design is a genuinely stronger anonymity architecture than a single VPN hop for the specific threat of "can one party link my identity to my destination," but "genuinely stronger" isn't the same as "perfect," and treating it as a magic anonymity switch is its own kind of mistake. A well-resourced adversary that can observe traffic entering and leaving the Tor network at scale — a capability associated with nation-state-level actors, not an average website — can in principle attempt traffic-correlation analysis to de-anonymize a connection, by matching the timing and volume patterns of traffic at the entry point against traffic at the exit point. This is a resource-intensive attack against a narrow threat model, not something to worry about for everyday browsing, but it's a meaningful caveat for anyone whose threat model genuinely includes state-level surveillance.

More practically, Tor's anonymity guarantees stop at the network layer, same as a VPN's. Logging into a personal account over Tor identifies you to that service just as surely as it would without Tor. Downloading a file that contains your name in the metadata identifies you. Using Tor Browser but also running other, non-Tor-routed applications on the same device can leak your real IP through those other channels. Anonymity tools protect the specific layer they operate at; they don't protect against a user's own actions undoing that protection at a different layer.

Can you use a VPN and Tor together?

Yes, in two different configurations, each with different tradeoffs, and it's worth understanding which one you're actually getting before assuming "combining them" automatically means "combining their benefits."

VPN, then Tor ("Tor over VPN"): your device connects to the VPN first, and Tor traffic then enters the Tor network through that VPN connection. In this setup, your ISP sees only encrypted VPN traffic, not that you're using Tor at all — useful in contexts where using Tor is itself something you'd rather not reveal to a local network operator or ISP. The Tor entry relay sees the VPN server's IP address rather than your real one, adding a layer of separation. The tradeoff: your VPN provider can see that you're connecting to the Tor network (even if not what you do inside it), which reintroduces a degree of trust in the VPN provider that Tor alone doesn't require.

Tor, then VPN ("VPN over Tor"): a less common and more technically involved setup where Tor traffic exits and then connects to a VPN server before reaching the destination. This is harder to configure correctly, not natively supported by most consumer VPN apps, and has its own set of tradeoffs around trusting the VPN provider with your exit traffic and potentially undermining some of Tor's own protections — it's generally a setup for users with a specific, well-understood reason for wanting it rather than a default recommendation.

For most people considering combining the two, "VPN, then Tor" is the more commonly recommended direction, and even then it's worth being honest that it's solving a fairly specific problem (concealing Tor usage itself from a local observer) rather than making Tor "more anonymous" in general.

Which one is fastest?

In practical terms, a proxy is typically the fastest of the three for the single application it's configured for, mainly because it does no encryption and adds only one hop — though that speed comes precisely from skipping the protections that make the other two worth using in the first place. A VPN adds one encrypted hop through a provider-run server, which is real overhead but usually modest on a well-run provider's infrastructure, and often barely noticeable for everyday browsing. Tor routes through three separate relays with layered encryption, run by volunteers on infrastructure of widely varying capacity, and is consistently and noticeably slower than either a VPN or a proxy — a structural consequence of its design, not a fixable performance bug. None of these speed differences should be treated as a stat you can pin an exact number on, since actual throughput depends heavily on the specific server, relay, network conditions, and time of day; the ordering (proxy fastest, Tor slowest) is the reliable part, not any specific number.

Which one should you actually use? A practical decision guide

Everyday privacy and security on public or untrusted networks: a VPN is the practical choice for most people. It covers the realistic threat (someone on your local network or your ISP seeing your traffic) with reasonable speed and minimal setup friction, through apps designed for non-technical users.

Getting around a simple IP-based geo-restriction on a single, low-stakes task: a proxy can be enough on its own for the narrow job of changing the IP a single website sees, but be clear-eyed that it's not adding meaningful security, and a free or unfamiliar proxy operator is itself a party you're trusting with your unencrypted traffic — often a worse trust tradeoff than just using a VPN for the same task.

Strong anonymity needs — journalism, activism, whistleblowing, or operating under a hostile or surveillance-heavy environment: Tor's architecture is specifically built for this threat model, and organizations that work with sources and activists in high-risk environments commonly recommend it for exactly this reason. It's worth pairing Tor usage with broader operational-security practices, not treating the network layer as the only thing that matters — see our guide for journalists and guide for activists for the fuller picture beyond just network tooling.

Streaming, large downloads, or anything latency-sensitive: a VPN is the realistic option; Tor's speed characteristics make it a poor fit for this use case, and a bare proxy doesn't provide the encryption that makes a VPN worth using for this in the first place.

Torrenting or other peer-to-peer file sharing: a VPN is the tool actually built for this — it hides your IP from other peers in the swarm and encrypts the traffic, and providers that explicitly support P2P traffic are built to handle the sustained connections that torrenting involves. Tor's network is explicitly not designed for the sustained, high-bandwidth connections torrenting involves, and using it for that purpose is discouraged by the Tor Project itself, both because it strains the volunteer-run network's limited capacity for everyone and because BitTorrent's own protocol has known ways of leaking a real IP address that bypass Tor's protections entirely. A bare proxy configured only in a torrent client can mask the IP the swarm sees but, per the DNS and encryption caveats already covered, shouldn't be assumed to add real security. See our guide to VPNs and torrenting for more on what to actually look for in a provider for this specific use case.

Connecting to a work network or accessing region-specific business tools while traveling: this is closer to the VPN's original design purpose — securely joining a private network from an untrusted location — and a consumer VPN handles the general version of that problem well, though a company-issued VPN for actual corporate network access is a different, IT-managed tool from the consumer VPN apps this guide is about. Neither a bare proxy nor Tor is really built for this use case.

You genuinely don't know which threat model applies to you: default to a reputable VPN. It's the tool with the broadest, most defensible coverage for the risks an average internet user actually faces day to day, and it doesn't require you to accept Tor's speed tradeoffs or a proxy's lack of encryption to get meaningful benefit.

Does it work the same way on a phone as on a laptop?

The underlying technology is the same across devices, but how each tool shows up in practice differs enough to be worth a separate note, since a lot of real-world usage now happens on mobile.

A VPN app on a phone behaves essentially the same as on a laptop: install the app, connect, and (assuming the app is well-built) the phone's traffic — across apps, not just the browser — routes through the encrypted tunnel the same way a laptop's would. Mobile operating systems do add some wrinkles: switching between Wi-Fi and cellular data can briefly interrupt the VPN connection depending on the app's handling of that transition, and background app refresh or push notifications can behave differently while a VPN is active. A well-reviewed VPN app should handle these gracefully; it's a reasonable thing to check for in a specific provider's app rather than assume.

Tor on mobile is more constrained. The Tor Project maintains an official Tor Browser for Android with the same relay-routing design as the desktop version, but it — like desktop Tor Browser — only protects traffic that goes through that specific browser app, not the phone's other apps, unless the device is specifically configured to route all traffic through Tor (a more involved, less common setup on mobile). There is no official Tor Browser for iOS from the Tor Project itself, due to platform restrictions on how browsers can be built on iOS; third-party apps exist but warrant the same "verify what it actually does before trusting it" scrutiny as any other privacy tool.

Proxy apps on mobile tend to inherit the same limitation they have on desktop: they typically apply only to the specific app configured to use them, or in some cases to browser traffic within a specific app, rather than the device's traffic as a whole — the "partial coverage, easy to forget about" issue discussed earlier applies just as much on a phone.

What none of the three protect you from

It's worth being explicit about the shared blind spots, because marketing for all three tools sometimes implies broader protection than actually exists. None of them stop malware already on your device from doing whatever it's programmed to do — encrypting network traffic doesn't touch a compromised endpoint. None of them prevent phishing from working if you're tricked into entering credentials on a fake site — the network layer being private doesn't make the destination trustworthy. None of them stop a website from fingerprinting your browser through characteristics that have nothing to do with IP address — screen resolution, installed fonts, canvas rendering quirks, and similar signals can identify a device across sessions regardless of which of these three tools is in use. And none of them anonymize you from a service you're logged into — if you're signed into an account, that service knows who you are through the login itself, independent of what your IP address looks like on their end.

A note on "free" versions of each

Free proxies, free VPNs, and even Tor sit in different trust categories worth distinguishing rather than lumping together as "free is free." Tor is free, open-source, and run by a nonprofit and a global volunteer relay network with public documentation about how it works — its business model isn't built on monetizing users' data, which is structurally different from a commercial product that's free to the end user. A free proxy or a free VPN, by contrast, has to fund its infrastructure somehow, and "somehow" is worth asking about directly rather than assuming — some free VPN and proxy services have been reported to log and sell user data, inject ads, or bundle unwanted software, though the specifics vary by provider and should be verified against that specific provider's actual privacy policy and business model rather than treated as a blanket rule. If a VPN or proxy is free and you can't clearly identify how it sustains its infrastructure costs, that's a reasonable thing to be skeptical about before trusting it with your traffic.

How do you actually check whether the tool you're using is working?

Rather than trusting that a VPN, proxy, or Tor connection is doing what it's supposed to, it's worth actually verifying it, and the checks are simple enough to be worth doing once after any new setup.

For a VPN or proxy, visiting a site that reports back your public IP address — before and after connecting — is the most basic check: if the reported IP address doesn't change, the traffic isn't actually routing where you expect. Beyond that, a dedicated DNS-leak test checks whether your DNS requests are going through the same tunnel as the rest of your traffic or slipping out to your ISP's resolver separately, which — as covered above — is a common and easy-to-miss gap, especially with proxies and with VPN setups on operating systems that don't fully cooperate with the VPN app's routing.

For Tor, Tor Browser itself displays whether it has successfully connected to the Tor network, and visiting a site that specifically checks for Tor connectivity confirms the traffic is actually routing through the network as expected rather than, for instance, falling back to a direct connection due to a misconfiguration or a blocked relay.

None of these checks are one-time-forever guarantees — network conditions, app updates, and operating-system changes can all affect whether a given setup is actually working as intended, so it's a reasonable habit to re-check periodically rather than assuming a setup that worked once will keep working indefinitely without any changes.

Practical takeaway

Treat "VPN vs proxy vs Tor" as a question about matching a tool to a threat model rather than picking an overall winner. A proxy changes the IP address one application shows to one website and generally adds no encryption of its own — a narrow, situational tool rather than a security tool. A VPN encrypts and reroutes all of a device's traffic through a single provider-run server, which is a solid, practical default for everyday privacy and security as long as you've thought about which provider you're trusting with that traffic — see our guide to evaluating VPNs for privacy for how to do that. Tor splits trust across three independent relays specifically to prevent any single party from linking your identity to your destination, at a real and unavoidable cost in speed, making it the right tool for a narrower set of high-stakes anonymity needs rather than an everyday browsing default. None of the three is a complete answer to "how do I stay safe and private online" on its own — each addresses a specific layer, and understanding which layer you actually need covered is most of the decision.