Tor Browser

Best for: people who need genuine anonymity for specific sessions — journalists, researchers, activists, anyone under surveillance or censorship — and who accept slow page loads, constant CAPTCHAs, and broken logins as the price. It is not a replacement for your everyday browser, and the Tor Project doesn’t pretend otherwise.

Pros

• Routes every connection through three Tor relays, hiding your real IP address from the sites you visit and your activity from your ISP — a protection no other browser here provides on its own
• Ships the Tor Project’s full anti-fingerprinting stack — letterboxing, User-Agent and OS spoofing into a handful of buckets, canvas randomisation, first-party isolation, font-enumeration limits — all aimed at making every user look identical
• Permanently amnesic: no history, and cookies last only until you close the browser or request a New Identity
• Directly audited by Cure53 in 2023, with the full report published and the findings fixed — and the auditors singled out the reproducible-build and build-signing process as a real strength
• Backed by a US 501(c)(3) nonprofit that publishes its tax filings, independently audited financials, and conflict-of-interest policy
• Zero telemetry — Tor Browser has never collected usage data, and Mozilla’s reporting mechanisms are disabled and their endpoints neutralised
• Built-in censorship circumvention: bridges and pluggable transports let it connect from countries that block Tor outright
• Available in roughly 38 languages, and on Android as well as desktop

Cons

• Slow by design — traffic bounces through volunteer relays worldwide, and heavy network load or ongoing denial-of-service attacks make it slower still
• Constant friction on everyday sites: shared exit-relay IPs trigger CAPTCHAs, “unusual activity” warnings, and outright blocks far more often than a normal browser
• No persistent logins in practice — the amnesic design signs you out of everything on close, and logging into a personal account while on Tor links that identity to the session anyway
• No DRM video, so streaming services don’t work; Flash and other plugins are blocked
• Torrenting over Tor is unsafe and explicitly discouraged — clients leak the real IP and slow the network for everyone
• Opening downloaded documents while online can reveal your real IP, so files need an offline machine or a tool like dangerzone
• No sync of any kind — bookmarks move only by manual HTML or JSON export
• No iOS version; the Tor Project points iOS users to the third-party Onion Browser instead
• Anonymity is not guaranteed — timing attacks, malicious exit relays, and user mistakes can still deanonymise you

Privacy Defaults

Tor Browser’s defining feature is the network underneath it. Every request is sent through three randomly chosen relays, so the sites you visit see a Tor exit-relay address instead of yours, and anyone watching your local connection sees only that you’re talking to the Tor network. This is a fundamentally different guarantee from a VPN or a single proxy — no one relay knows both who you are and what you’re looking at — and it’s why the Tor Project tells people not to route other browsers through Tor: only Tor Browser is built to avoid the leaks that would undo it.

On top of that, the browser is permanently amnesic. Nothing is written to history, and cookies set during a session are dropped when the last window closes or when you click New Identity, which also builds fresh circuits. Within a session, connections to different sites are forced onto separate circuits so a third-party tracker present on two of them can’t join the visits up. HTTPS-Only mode is enforced, DNS resolves through the Tor circuit rather than your system resolver, and the default search engine is DuckDuckGo, which also runs an onion service the browser can switch to.

The one thing it does not do is block ads and tracker scripts out of the box. Unlike some privacy browsers, Tor Browser ships only NoScript, not a content blocker — the reasoning being that first-party isolation and the anti-fingerprinting work already break cross-site tracking, and every extra add-on makes you more identifiable. In Standard mode JavaScript still runs, so trackers that rely on it will execute; raising the Security Level to Safer or Safest cuts that down at a steep cost to site functionality.

Anti-Fingerprinting

This is the model that other fingerprint-resistant browsers copy, and here it’s the genuine article. The goal isn’t to hide every attribute — some, like language and OS, are needed for pages to work — but to collapse each one into a small number of shared buckets so no single user stands out. The User-Agent and platform are spoofed aggressively: every Windows install reports as Windows 10, every Mac as OS X 10.15, every Android as Android 10, and every Linux, BSD, or other system is lumped together as “Linux running X11”. You cannot choose which OS you appear to be, on purpose — any such option would only make you rarer.

Screen and window dimensions are handled with letterboxing, which rounds the content area to a multiple of 200×100 pixels and pads the rest with grey margins when you resize or maximise, so the window size stays in a shared bucket. Canvas reads return randomised data, WebGL readback and a range of hardware APIs are restricted, the timezone is normalised, and fonts are limited with character fallback. A New Identity button wipes all state and starts over.

The trade-off shows up as small visual glitches — slightly blurry canvas-rendered images, letterbox margins — and as anti-bot systems misreading the spoofed User-Agent as automation, which feeds directly into the usability problems below.

Transparency & Audits

Tor Browser is fully open source, built with a reproducible-build process and signed releases, and its modifications to Firefox ESR are documented rather than hidden. It was directly audited by Cure53 over 72 days spanning late 2022 to early 2023, with the report published in October 2023. The auditors described Tor’s security posture as “admirably robust and hardened” and the code as written to a “first-rate standard”, and called out the build process as contributing “considerable defense-in-depth”. Two high-severity issues turned up, both in the backend systems that distribute bridges rather than in the browser, and both were fixed.

The organisation behind it is unusually transparent for the category. The Tor Project is a US 501(c)(3) nonprofit that publishes its bylaws, conflict-of-interest policy, annual IRS Form 990 filings, and independently audited financial statements, most recently for the year ending June 2024. Funding is a stated mix of government grants — including US federal agencies — private foundations, and individual donors, and the project addresses that openly rather than downplaying it.

Two recent incidents are worth addressing head-on, and neither is a mark against the browser itself. In September 2024, German law enforcement deanonymised a user through timing analysis, but the target was the long-retired Ricochet messenger running over Tor, the operation dated to 2019–2021, and it predated a guard-discovery defense added in mid-2022; the Tor Project responded publicly, said it had not been given the technical details, and asked for the same information handed to the Chaos Computer Club. In April 2026 a Firefox fingerprinting flaw (CVE-2026-6770) involving the ordering of IndexedDB database names affected Tor Browser through its ESR base — briefly defeating New Identity isolation within a running process — and was patched upstream in Firefox 150 and picked up in Tor Browser 15.0.10. Android privacy scanners also flag tracker libraries inherited from Firefox for Android; the Tor Project says they are disabled by default and slated for removal.

Usability & Compatibility

Tor Browser is a specialised tool, and it is scored here as one. The network tax is unavoidable: pages load slowly because traffic crosses several volunteer relays, and periods of heavy load or denial-of-service pressure make it worse. Because thousands of people share each exit relay, sites constantly serve CAPTCHAs, “suspicious activity” warnings, and hard blocks — banks in particular may lock an account when a login suddenly comes from the other side of the world. Anything that needs a persistent login fights you, since closing the browser signs you out, and logging in at all ties that account to the session.

DRM video doesn’t play, so streaming services are out. Plugins are blocked. Torrenting is unsafe over Tor and explicitly discouraged. Opening a downloaded document while still online can leak your real IP, so the safe workflow involves an offline machine or a sanitising tool. The Security Level control (Standard/Safer/Safest) lets you trade more functionality for more protection, and JavaScript is left on by default precisely because turning it off breaks too much of the web.

There are real conveniences — the interface is translated into around 38 languages, censorship circumvention is built in, and New Identity is genuinely useful — but the honest summary is the Tor Project’s own: this is not a browser you set as your default. It is the one you open when a session needs to be anonymous, and you accept the friction because the alternative tools can’t give you what it does.

Cross-Platform & Sync

There are builds for Windows, macOS, Linux, and Android, the last available as a direct APK and through Google Play and F-Droid. There is no iOS version — Apple’s engine restrictions make a proper port impractical, and the Tor Project points iOS users to the separate, third-party Onion Browser rather than shipping something it can’t stand behind.

There is no sync. Firefox Sync is not part of Tor Browser, and bookmarks move between machines only through a manual HTML export or a JSON backup. That’s a deliberate choice — a sync account would be another identifier — but in practice every install is set up from scratch.

Our Rating

Category	Score
Privacy Defaults	9.5/10
Anti-Fingerprinting	9.5/10
Transparency	9/10
Usability & Compatibility	4.5/10
Cross-Platform & Sync	5.5/10
Overall	8.3/10

Weighted: Privacy Defaults 30% · Anti-Fingerprinting 25% · Transparency 20% · Usability & Compatibility 15% · Cross-Platform & Sync 10%.

Nothing else here matches what Tor Browser does: it hides your IP through a network no single party controls, resists fingerprinting as well as any browser in existence, and comes from an organisation that publishes its audits and its books. The score is held back by usability that is bad on purpose — slow, CAPTCHA-ridden, hostile to logins and streaming — and by the lack of sync and an iOS build. That’s the right shape for this browser. Run it alongside a normal one, reach for it when a session genuinely needs to be anonymous, and don’t expect it to be pleasant.

Affiliate Disclosure

Tor Browser is free software from a nonprofit, and there is no affiliate program to join. This review carries no tracked link and earns PrivacyPick.com nothing — it’s here because it is the reference implementation of anonymous browsing and a legitimate, heavily audited option.

Rating: 8.3/10