VPN vs Tor: different tools for different jobs

How each one routes your traffic

A VPN client encrypts your traffic once and sends it to a single server, which decrypts it and forwards it to the destination. The provider's server is the one place where your identity (your IP) and your activity meet — which is why the provider's no-logs policy carries the whole trust model.

Tor encrypts your traffic in three layers and sends it through three relays chosen from thousands run by volunteers. The entry relay peels the first layer and learns your IP but not your destination; the middle relay knows neither; the exit relay peels the last layer and learns the destination but not who asked. This is onion routing — each hop sees only what it needs to forward the packet.

Who sees what in each scheme

With a VPN: your internet provider sees an encrypted stream to one server and nothing inside it. The VPN provider can technically observe your traffic metadata — the reason logging policy is the deciding criterion. The website sees the VPN server's IP, shared with other users of that server.

With Tor: your provider sees that you connect to the Tor network (entry relays are public), which itself stands out on a network. The entry relay sees your IP, the exit relay sees your destination, and no single party sees both. The website sees a known Tor exit address — and many sites respond to that with captchas or outright blocks.

In both schemes, whatever you do inside the session still identifies you: logging in to an account, or a browser fingerprint, links the visit to you regardless of the routing underneath.

Why Tor is slow

The slowness is structural, not a bug. Every request crosses three extra machines scattered across the world, so the round trip accumulates hundreds of milliseconds of latency before the website even answers. Bandwidth is bounded by the narrowest volunteer relay in your circuit, and the whole network's capacity is donated, not provisioned.

Three layers of encryption add some CPU cost, but distance and relay congestion dominate. In practice Tor delivers enough for text and images with noticeable page-load delay, while video calls and large downloads range from painful to impractical — and heavy downloads also consume the shared capacity other users depend on. A VPN's single provisioned hop typically costs a few dozen milliseconds and a small slice of bandwidth instead.

What about Tor over VPN

Tor over VPN means connecting the VPN first, then running the Tor Browser through the tunnel. Mechanically: your provider now sees only a VPN connection instead of Tor usage, and the Tor entry relay sees the VPN server's IP instead of yours. The layering is straightforward — Tor's three hops simply start from the VPN's exit.

What it does not do: it does not make Tor faster (you added a hop), and it does not remove the need to trust the VPN — the VPN provider now sits where your provider used to. The reverse order, VPN over Tor, is rarely used and breaks most of Tor's design assumptions. Treat the combination as a trust-shuffling tool for specific threat models, not a default upgrade, and remember that no routing scheme changes what is legal where you live.

What each tool is actually for

Reach for a VPN when you want everyday privacy at everyday speed: shielding browsing from your internet provider, using untrusted Wi-Fi, moving your visible location, covering every app on the device including calls and streaming. It runs permanently in the background — with WireGuard the overhead is small enough to forget about, and one Aurora subscription keeps up to 7 devices inside the tunnel.

Reach for Tor when unlinkability is the requirement — when no single operator should be able to connect your identity to your destination. Journalists working with sources, and people whose browsing could endanger them, accept the speed cost because that property is the point. Tor is free, browser-shaped, and deliberately narrow.

• Everyday privacy, all apps, full speed — VPN
• Public Wi-Fi and untrusted networks — VPN
• Streaming, calls, gaming, large downloads — VPN
• No single party may link identity to destination — Tor
• Reaching .onion services — Tor only
• Free, no account, browser-only scope — Tor

Can you just use both interchangeably

No — the overlap is smaller than it looks. Both hide your IP from websites, and both stop your provider from reading your traffic, but they optimize for opposite corners: a VPN maximizes usability with a single trusted operator, Tor maximizes unlinkability by assuming every operator might be hostile.

The honest summary: if your concern is your provider, your Wi-Fi, or your visible location, Tor is overkill and the speed cost buys you nothing you need. If your concern is that no company anywhere should be able to correlate your identity with your activity, a VPN alone cannot promise that — its provider is a single party in exactly that position, constrained only by policy. Match the tool to the threat, not to the mystique.