How to Install Tor Browser: Complete Setup Guide

Most guides skip the step that matters: cryptographically verifying the build before you run it. Tor Browser 13.x ships from the Tor Project as hardened Firefox ESR, with all traffic routed through Tor. Below: download, signature check, install, security levels, bridges, and the threat model this setup actually serves.

What Tor Browser Actually Does

Tor Browser isn't a VPN add-on or a proxy switch. It's a self-contained browser built on Firefox Extended Support Release (ESR), with privacy patches applied by the Tor Project — the nonprofit maintaining the Tor network since 2006. Every time you open it, Tor Browser creates a three-hop circuit: your traffic enters through a guard relay, bounces through a middle relay, and exits at an exit relay before reaching the destination. The exit node sees your traffic destination; no single node in the circuit sees both who you are and where you're going.

The browser also hardens Firefox against fingerprinting. It standardizes window dimensions to 1000×800 pixels, disables canvas API calls that leak GPU information at higher security levels, and prevents JavaScript timing attacks that can fingerprint CPU speed. The design goal is that every Tor Browser user looks identical in a crowd. Individual features don't win here — anonymity set size does.

What it doesn't do: encrypt traffic after the exit relay. If you visit a non-HTTPS site, the exit node reads your traffic in plaintext. Always prefer HTTPS. Tor Browser enforces HTTPS-Only Mode by default to reduce this risk.

Step 1: Download from torproject.org Only

Go to https://www.torproject.org/download/ — that URL exactly, no mirrors, no torrent sites, no repackaged downloads. Third-party mirrors have historically shipped modified versions with added tracking or malware. There's no legitimate reason to use them.

Choose your platform: Windows, macOS, Linux (64-bit or ARM), or Android. As of Tor Browser 13.5, the macOS download is approximately 85 MB. Download both the installer and the .asc signature file — you'll need both for Step 2.

If the Tor Project website is blocked in your region, the official Tor Browser Manual lists safe fallback download methods, including the GetBridge email service and the signed distribution mirror at https://dist.torproject.org/.

Step 2: Verify the PGP Signature

This step gets skipped constantly. Don't skip it. A tampered installer that you run without checking defeats the entire purpose — the installer itself becomes the attack surface.

The Tor Project publishes its signing key at https://www.torproject.org/download/. The current signing key fingerprint is EF6E 286D DA85 EA2A 4BA7 DE68 4E2C 6E87 9329 8290 — confirm this on the Tor Project's site directly, not from this article alone.

If you're not yet comfortable with PGP, our PGP encryption guide covers GPG installation and key verification. The short version:

# Import the Tor Project signing key
gpg --auto-key-locate nodefault,wkd --locate-keys torbrowser@torproject.org

# Verify the downloaded file (adjust filename to your version)
gpg --verify tor-browser-linux64-13.5_ALL.tar.xz.asc \
    tor-browser-linux64-13.5_ALL.tar.xz

A valid result reads: Good signature from "Tor Browser Developers (signing key) torbrowser at torproject.org". If you see BAD signature, stop. Re-download from the official URL.

Step 3: Install on macOS, Windows, and Linux

macOS: Double-click the .dmg and drag Tor Browser to Applications. On first launch, right-click → Open to bypass Gatekeeper's warning — the Tor Project doesn't pay Apple's notarization fee. Subsequent opens work normally.

Windows: Run the .exe installer. Windows Defender may flag it as suspicious — this is a behavioral heuristic false positive. The PGP signature you verified in Step 2 confirms authenticity. Install anywhere; Tor Browser is portable and doesn't touch system libraries.

Linux: Extract the .tar.xz archive and run ./start-tor-browser.desktop from inside the directory. No root required, no system libraries modified. It runs from a USB drive if needed.

Android: Download Tor Browser for Android from Google Play or the Tor Project's GitHub releases. Don't install from third-party APK sites.

Step 4: Choose Your Security Level

Tor Browser ships three security presets, accessible via the Shield icon in the toolbar:

Level	JavaScript	WebGL	Practical impact
Standard	Enabled everywhere	Enabled	No site breakage; larger fingerprint surface
Safer	Disabled on non-HTTPS sites	Disabled	Some HTTP-only sites degrade
Safest	Disabled everywhere	Disabled	Rich web apps and some fonts break

We recommend Safest for any threat model where anonymity matters — journalists, activists, anyone accessing .onion services or sensitive material. The cost is real: many clearnet sites degrade or break entirely at Safest. For casual educational browsing where you're not at risk, Standard is acceptable.

The security level affects what JavaScript can fingerprint or execute in your browser. It does not affect your circuit — all three levels route through Tor's three-hop network.

Step 5: First-Launch Checklist

After Tor Browser establishes its first connection (a progress screen appears on launch):

Don't resize the window. Default dimensions are 1000×800. Resizing creates a unique fingerprint. This is one of the most common Tor mistakes people make on day one.
Don't install extensions. uBlock Origin, Privacy Badger — every popular extension changes your browser fingerprint. Tor Browser's defaults already block trackers and ads.
Verify your connection. Visit https://check.torproject.org/. "Congratulations" means Tor is working. If not, close and reopen to generate a new circuit.
Never maximize the window. Tor Browser letterboxes content to preserve the fingerprint. Maximizing breaks this protection.
Check HTTPS on every sensitive page. Look for the padlock in the address bar.

Step 6: Configure Bridges for Censored Regions

If your ISP or government blocks direct Tor connections — China's Great Firewall, Iran, Russia, and several others actively do this — bridges let you connect through unlisted relays not in the public Tor consensus.

Three bridge protocols ship with Tor Browser:

obfs4: Obfuscates Tor traffic to look like random noise. Works in most censored regions; the first choice for most users.
meek: Routes Tor through major cloud providers (Amazon, Azure, Google) using domain fronting. Slower but resilient against deep-packet inspection.
Snowflake: Uses volunteer-run browser-based proxies. Works in regions where obfs4 is blocked but cloud traffic isn't.

To configure: at the connection screen, click "Configure Connection" → "Use a bridge." Use built-in bridges or request new ones at https://bridges.torproject.org/, or email bridges@torproject.org with the subject get transport obfs4.

Step 7: When NOT to Use Tor Browser

Tor Browser solves a specific set of problems. Using it for the wrong job creates false confidence.

Don't use Tor Browser to:

Log into real accounts. Google, Facebook, your bank — any account login collapses anonymity by design. The account is your identity; Tor can't hide that. More in our common Tor mistakes guide.
Stream video long-term. Three-hop routing introduces 200–500ms latency and reduced throughput. It works, but it's painful for sustained video.
Maintain a long-running pseudonym. Tor protects sessions, not personas built over months. A single OPSEC slip connects a long-running pseudonym to your real identity. Review our threat modeling guide for how to structure that kind of work.
Replace OS security. On a compromised machine, Tor Browser protects network traffic — not your files, clipboard, or keyloggers. For higher-risk work, we recommend Tails OS.

Threat Model: What Tor Browser Protects Against

Tor Browser's threat model is specific. Understanding it prevents two failure modes: using it where it doesn't apply, and not using it where it does.

Protects against:

ISP surveillance of which sites you visit (your ISP sees a Tor guard connection, not destinations)
Network observers watching the wire between you and the internet
Basic tracking and fingerprinting (cookies sandboxed per session; fingerprint surface standardized)
Passive deanonymization by exit nodes (exit sees destination but not your IP)

Doesn't protect against:

Malicious JavaScript at Standard level — a crafted exploit can leak your real IP
Traffic correlation attacks by an adversary watching both your guard node and exit node simultaneously (documented in Tor Project research; impractical at scale but real)
OPSEC failures — logging into personal accounts, downloading files that phone home, using your real name
Physical device seizure — Tor Browser doesn't encrypt your disk

For deeper coverage of how the underlying protocol works, read onion routing explained. For the Tor-vs-VPN comparison, see Tor vs VPN.

The EFF's Surveillance Self-Defense guide covers how Tor Browser fits into a broader personal security plan — strongly worth reading alongside this one.

Frequently Asked Questions

Is Tor Browser legal to use?

In most countries, yes. Using Tor Browser is legal in the US, EU, UK, and most of the world. China, Russia, and Iran restrict or block Tor itself — which is why bridge protocols exist. Using Tor Browser to commit crimes is illegal in every jurisdiction Tor doesn't change the underlying law.

Does Tor Browser hide my IP address?

From sites you visit, yes — they see the exit relay's IP, not yours. Your ISP sees that you connected to a Tor guard relay, not which sites you visited. A sophisticated adversary watching both ends of your circuit simultaneously could correlate timing (called an end-to-end confirmation attack), but this requires resources that fall outside most users' threat models.

Can I use Tor Browser with a VPN?

Yes, in two distinct configurations. "VPN before Tor" hides Tor use from your ISP but shifts trust to the VPN provider. "Tor before VPN" is rarely useful for anonymity. Our Tor over VPN guide covers when each configuration helps and when it doesn't.

How slow is Tor Browser in practice?

Realistically 3–5× slower than a direct connection for most browsing. The three-hop circuit introduces latency; typical Tor round-trip times run 200–500ms. For reading pages and accessing .onion services, the speed is usable. For large downloads or video, plan for slowdowns.

Should I use Tor Browser on my phone?

There's an official Tor Browser for Android. iOS has Onion Browser (unofficial but Tor Project-endorsed). Mobile brings additional risks — app sensors, push notifications, and device identifiers that desktop Tor Browser doesn't face. Read our Tor Browser mobile guide before relying on mobile Tor for sensitive work.