VPN vs Proxy vs Tor: What Each Actually Hides (2026)

Every few weeks someone in a forum thread gets told that paying for a VPN is pointless — just use a free proxy — or that a VPN is security theater and real privacy means Tor. The VPN vs proxy vs Tor question gets asked so often because all three tools change the IP address a website sees, which is why they get lumped together. But that surface similarity hides the actual difference: a proxy, a VPN, and Tor each hide different things from different people. Deciding between them is not a question of which is safest in the abstract. It’s a question of who you’re trying to keep in the dark, and what you need them not to see.

This guide walks through what each one actually conceals, who can still see through it, and which tool fits which situation.

VPN vs Proxy vs Tor, in One Paragraph

A proxy reroutes one app’s traffic through another machine. The website sees the proxy’s IP instead of yours; the proxy operator sees everything. A VPN encrypts all your device’s traffic and routes it through the provider’s server, so your internet provider and the local network see only an encrypted connection to that server — but the VPN company now occupies the spot your ISP used to, and could see what your ISP no longer can. Tor sends your traffic through three volunteer-run relays wrapped in three layers of encryption, arranged so that no single relay knows both who you are and where you’re going — at the cost of speed, and with a specific weakness against anyone who can watch the traffic enter and leave the network.

The rest of this article is the long version of that paragraph.

A Proxy Moves Traffic. It Doesn’t Protect It.

A proxy server is an intermediary. Your app sends its requests to the proxy, the proxy forwards them to the destination, and the responses come back the same way. The two kinds you’ll actually encounter are SOCKS proxies (usually SOCKS5, defined by the IETF in RFC 1928 back in March 1996) and HTTP proxies (which handle HTTPS through the CONNECT method described in RFC 9110).

The important thing about both specifications: neither one encrypts your traffic. SOCKS5 is described in its own RFC as a “shim-layer between the application layer and the transport layer” — a routing mechanism.[1] It can negotiate a password so not just anyone can use the proxy, but it does nothing to the data passing through. If you load a plain HTTP site through a SOCKS proxy, the operator sees the whole page. If you load an HTTPS site, TLS still protects the page contents from the operator — but that protection comes from HTTPS, not from the proxy, and it would be there without the proxy too. Either way, the operator sees which sites you connect to, when, and from what IP address. RFC 9110 is explicit that once an HTTP proxy opens a CONNECT tunnel it becomes “a blind relay” for the encrypted bytes — but it has already logged the destination host and port to open that tunnel in the first place.[2]

So a proxy hides your IP address from the destination website and nothing else. It hides nothing from the proxy operator. It doesn’t touch traffic from your other apps. And your ISP still sees every site you visit, because the connection to the proxy itself is usually unencrypted.

That makes a proxy a reasonable tool for one narrow job: making a single app appear to connect from somewhere else — a scraper that needs to rotate IPs, a game client, a region check. It is not a privacy tool, and the free public ones are worse than neutral: a proxy you don’t control is a machine logging your browsing in exchange for nothing, run by someone whose incentives you can’t see. The same warning applies to the “free VPN / proxy” apps in mobile stores. A February 2026 study that audited 281 free Android VPN and proxy apps — with 2.4 billion installs between them — found 29 leaking traffic outside the tunnel, 246 contacting known tracking servers, and four running with no encryption at all.[3]

A VPN Hides Your Traffic From the Network. It Moves the Trust to the Provider.

A VPN builds an encrypted tunnel from your device to the provider’s server and sends everything through it — every app, every connection, at the operating-system level. Your ISP, your mobile carrier, the coffee-shop Wi-Fi, anyone sniffing the local network: all they see is encrypted traffic to one VPN server. They can’t see which sites you’re visiting or what’s in the traffic. The websites you visit see the VPN server’s IP, not yours.

This is a real improvement over both a proxy and a bare connection, and for most people most of the time it’s the right tool. But it comes with a structural catch. Your traffic still has to exit the tunnel somewhere and go to the real internet, and that somewhere is the VPN provider’s server. The provider is now in exactly the position your ISP was in: it can see the sites you visit and, for anything not itself encrypted, the contents. You haven’t removed the trusted middleman. You’ve swapped your ISP — which is often legally required to retain records and answer subpoenas — for a company you chose, ideally one in a better jurisdiction that has promised in writing not to keep those records.

That promise is the whole game, which is why “no-logs” claims get independently audited and why the audits vary so much in how far you can trust them. Proton VPN has run five consecutive annual no-logs audits with the full reports publicly downloadable, no account required. Mullvad had its no-logs claim tested the hard way in April 2023, when Swedish police arrived at its Gothenburg office with a search warrant on behalf of German authorities and left with nothing, because there was no customer data to seize. IVPN had its no-logs claim verified by an independent auditor and lets you sign up with no email address at all. None of that makes the trust disappear — it makes it checkable, which is the best a VPN can offer.

What a VPN does not do: it doesn’t make you anonymous to a site you log into, it doesn’t stop browser fingerprinting, and it doesn’t hide your activity from a provider that breaks its no-logs promise. It’s privacy from the network, resting on a company’s word that’s been checked by someone else.

Tor Splits the Trust So No One Holds All of It

Tor takes the middleman problem and divides it three ways. Your traffic goes through three relays — an entry guard, a middle relay, and an exit — run by different volunteers, with a separate layer of encryption for each. In the Tor Project’s own words, a normal proxy or VPN is “a single point of trust,” where the operator “can see both who you are and what you are browsing.” In Tor, the entry guard sees your IP but not where you’re going. The exit sees where you’re going but not your IP. The middle relay sees only two other relays. No single relay — and no one who compromises a single relay — has both halves.[4]

That’s a genuinely different security model, and it’s why Tor doesn’t need you to trust an operator’s no-logs policy: there’s no operator with enough information to log. The price is paid in two places.

Speed. Everything goes through three hops run by volunteers on donated bandwidth. The EFF puts it bluntly: “browsing the web is much slower over Tor, and certain websites may not work at all.”[5] Streaming, large downloads, and video calls range from painful to impossible.

The both-ends problem. Tor’s design, by the Tor Project’s own longstanding admission, “doesn’t try to protect against an attacker who can see or measure both traffic going into the Tor network and also traffic coming out” — because “if you can see both flows, some simple statistics let you decide whether they match up.”[6] This is a deliberate trade-off: defeating it would need the kind of delays that make a network unusable for browsing. It has been understood since before Tor was popular, but it is not only theoretical. In 2024, German outlets reported that law enforcement had de-anonymized a user of the retired Ricochet messenger by watching connection timing; the Tor Project’s response put the operation in 2019-2021 and noted it required an outdated client without modern guard protections and a connection held open long enough to analyze.[7] Academic correlation attacks have kept advancing since — the most recent large benchmark, a machine-learning framework called RECTor published in November 2025, reports substantially better accuracy under noisy conditions than the previous landmark, DeepCoFFEA, which is now four years old.[8]

Tor also, per its own published guidance, does nothing for torrent traffic (which leaks your real IP in the tracker request), can be undone by browser plugins or by opening a downloaded document that phones home, and cannot help you if you log into an account tied to your name. And “generally it is impossible to have perfect anonymity, even with Tor.”[9]

What Tor is genuinely unmatched at: separating your identity from your activity when the people you’re hiding from can’t watch the entire network at once. That’s the situation of a journalist protecting a source, someone researching something dangerous in their country, or a person living under an adversary that monitors ISPs but not global traffic flows.

Who Sees What

	Proxy	VPN	Tor
Your ISP / local network sees	Every site you visit (connection to proxy is usually unencrypted)	An encrypted connection to one VPN server, nothing more	An encrypted connection to the Tor network (unless you use a bridge, they know it’s Tor)
The operator/relay sees	Your IP + every destination + timing	Your IP + destinations + unencrypted contents — can log, promises not to	No single relay sees both your IP and your destination
The destination site sees	Proxy’s IP	VPN server’s IP	Exit relay’s IP
Covers which apps	One app, configured manually	Entire device	Tor Browser only (other apps unless separately configured)
Speed cost	Minimal	Small — usually well under 20%	Large
Rests on	Trusting the operator completely	An audited no-logs promise	Math, plus not being watched at both ends

Which One To Use

• You need one app to appear to connect from elsewhere, and privacy isn’t the point — a scraper, a region check, a game server: a proxy, ideally one you run or pay for. Never a free public one for anything you care about.
• You want your browsing hidden from your ISP, the network you’re on, and the sites you visit, with normal speed and all your apps covered — the everyday case, public Wi-Fi, stopping ISP tracking, region-shifting a stream: a VPN, chosen for a credible independently-audited no-logs record.
• You need your identity separated from your activity and your adversary can’t watch the whole internet at once — a source-protecting journalist, sensitive research, life under a censoring or surveilling government: Tor, via the official Tor Browser, with a bridge if Tor itself is blocked or dangerous to be seen using.
• You want a VPN but you’re on a network that blocks VPN protocols: that’s a protocol and obfuscation question, not a reason to switch tools.

What about running a VPN and Tor together?

Connecting to a VPN first and then to Tor hides the fact that you’re using Tor from your ISP, and hides your real IP from the Tor entry guard — the VPN sees it instead. That’s the main thing it buys. It does not add a fourth hop of anonymity in any meaningful sense: the VPN still sees you connect to the Tor network at a given time, and Tor’s exit relay still sees your unencrypted traffic exactly as before. It’s a niche move for hiding Tor use in places where Tor use itself draws attention, and it shifts one piece of trust to the VPN rather than removing it. For almost everyone, one tool chosen correctly is the answer.

The Common Thread

The reason these three get confused is that “hides your IP” is true of all of them and useless as a way to tell them apart. The question that actually separates them is who is still watching. A proxy leaves the operator and your ISP watching. A VPN clears the network but leaves a company you have to trust — so you check that trust. Tor removes any single watcher but can’t beat one who sees both ends, and makes you pay in speed for what it does give you. Pick the one whose blind spot you can live with.