A VPN hides your traffic from your internet provider and your IP address from the websites you visit, but you have to trust the VPN company with everything it hides. Tor hides who you are by splitting trust across several volunteer relays, at the cost of speed. A basic proxy only changes the IP address a site sees, usually without encrypting anything. None of the three makes you invisible, and none replaces strong passwords, updates and two-factor authentication.
People use the words "VPN", "proxy" and "Tor" as if they were interchangeable privacy switches. They are not. Each one moves trust to a different place, hides a different set of details from a different set of observers, and fails in a different way. This guide compares them side by side, explains how each works in plain language, looks at what happens when you stack them, and helps you match a tool to your real situation: everyday privacy, public Wi-Fi, travel, geo-restricted content, or higher-risk work such as journalism. It is written for readers in the US, UK, Canada and Australia and sticks to lawful, everyday uses.
Who wrote this guide
This guide was written by IT Cares, an IT support company founded in 2014 that helps individuals and small businesses with security setup and remote support. Technical claims about Tor and VPNs are taken from the Tor Project's support documentation and the Electronic Frontier Foundation's Surveillance Self-Defense guide, both linked below. It reflects information available as of November 2026.
Side-by-side: what each tool hides and what it does not
Start with the table, then read the sections below for the reasoning. "ISP" means your internet service provider, or whoever runs the network you are on, such as a cafe, hotel or office.
| Question | Typical commercial VPN | Tor Browser | Basic web proxy |
|---|---|---|---|
| Hides your IP address from the website? | Yes. The site sees the VPN server's address instead. | Yes. The site sees the address of the last Tor relay. | Yes, for traffic sent through the proxy, if it is configured correctly. |
| Hides what you do from your ISP or Wi-Fi owner? | Yes for the content and destinations of traffic inside the tunnel. They can still see that you use a VPN and how much data moves. | Mostly. They see you connect to Tor, not which sites you visit. Bridges can reduce even that signal. | Often no. Many simple proxies do not encrypt the connection to you, so the local network may see everything. |
| Who you must trust | The VPN company. It can see your destinations and, for unencrypted traffic, the content. | No single operator. Trust is split across relays run by different volunteers, plus the software you run. | The proxy operator, who often is unknown and may be funded by ads or data. |
| Encryption | Encrypts everything between your device and the VPN server. | Layered encryption through at least three relays. The last hop to the site depends on HTTPS. | Depends on the proxy. Frequently none. |
| Speed | Usually close to normal, depending on server distance and load. | Noticeably slower, because traffic bounces through volunteer relays. | Varies widely, often poor for free services. |
| What it covers | Normally the whole device, every app. | Only traffic inside Tor Browser, unless other software is specifically configured. | Only apps or browsers set to use it. |
| Anonymity | Not anonymity. Privacy from some observers, with a trusted intermediary. | The strongest of the three, but still not perfect. | Minimal. |
| Everyday and legal use | Lawful and common in the US, UK, Canada and Australia. Some countries restrict VPNs, so check local rules when you travel. | Lawful to use in those four countries. Some websites block or challenge Tor traffic. | Lawful for ordinary use, but a poor choice for anything sensitive. |
The cells above are generalisations. A well-run VPN and a badly run one are very different products, and Tor's protection depends heavily on how you use it. Treat the table as a map of the trade-offs, not a ranking.
How a VPN works, in plain language
A virtual private network builds an encrypted tunnel between your device and a server run by the VPN provider. Your traffic goes into the tunnel, comes out at the VPN server, and continues to its destination from there. According to the EFF, this means your traffic appears to originate from the VPN rather than from your ISP, which masks your IP address, and the website sees the VPN server's location instead of yours.
The tunnel also hides your outgoing traffic from your ISP and from the owner of the local network, whether that is a coffee shop or a hotel. This is the real benefit. The EFF is equally clear about the catch: while a VPN hides your browsing data from your ISP, it is all visible to the VPN provider. You are not removing a middleman, you are swapping one for another. That is why the EFF stresses trust, transparency, business model and logging policy when you choose one.
What a VPN is good for
The EFF summarises VPNs as best suited to one thing: routing your network connection through a different network. In practice that covers two main uses. The first is getting around blocking on a network, such as a school or workplace connection or a country that filters content, with the caveat that streaming services increasingly detect and block VPN traffic, so it is never guaranteed. The second is connecting to a workplace network or your own home network remotely. A third, narrower use is shielding your activity from a network you do not trust.
What a VPN does not do
- It does not make you anonymous. The EFF notes that companies can still track you with cookies, tracking pixels, fingerprinting and, on phones, GPS. If you log in to an account, the site knows who you are regardless of your IP address.
- It does not hide you from the VPN company. A commercial VPN can see your traffic, and payment details can link the account to you. Providers are also subject to the laws and legal requests of the countries they operate in.
- It does not stop malware or phishing. The EFF describes VPNs as "not a security multi-tool". Strong passwords, two-factor authentication, device encryption and software updates matter more. Our guide on whether you need both antivirus and a VPN covers that division of labour, and firewall vs VPN vs antivirus explains how the layers fit together.
- Encryption quality varies. The EFF warns that broken protocols such as PPTP can be easily decrypted, and recommends checking that a provider uses modern protocols such as OpenVPN or WireGuard.
How Tor works, in plain language
Tor is a volunteer-run network. When you use Tor Browser, your traffic is encrypted in layers and routed through at least three relays before it reaches the website. The Tor Project explains that each relay can only unwrap one layer, so the first relay knows who you are but not where you are going, and the last relay knows the destination but not who you are. No single relay learns both.
The Tor Project describes three problems this addresses. Websites cannot easily learn your location. Anyone watching your connection locally, such as your ISP or someone on your Wi-Fi, cannot see what you are fetching or from where. And because the traffic crosses relays run by different people, no single relay can piece together your activity. All your ISP can see is that you are talking to the Tor network, which is the opposite of the VPN arrangement where one company sees everything.
Where Tor falls short
The Tor Project is candid that perfect anonymity is generally impossible, even with Tor. The limits worth knowing:
- It is slower. Your traffic bounces through volunteers' servers around the world, so some latency is built in. The Tor Project says it is much faster than it used to be, but expect it to feel slower than a VPN.
- It only protects what goes through it. The EFF and the Tor Project both stress that Tor Browser protects activity inside the browser. Other apps on your computer are not routed through Tor unless they are specifically configured.
- Your behaviour can identify you. If you sign in to a website or type your name, email or address into a form, that site knows who you are, even though it does not know where you are connecting from.
- HTTPS still matters. Tor encrypts your traffic to and within the network, but the last hop to the website depends on that site using HTTPS. Tor Browser includes an HTTPS-only mode for this reason.
- Downloaded files can leak. The Tor Project warns that documents such as DOC and PDF files can contain internet resources that load outside Tor when opened by another application, which can reveal your real IP address.
- Torrenting is a bad idea. The Tor Project says file-sharing applications often ignore proxy settings and can expose your real address, and they slow the network for everyone else.
- Powerful observers are out of scope. Tor does not defend against an adversary who can watch both your connection and the destination at once, because timing can be correlated. That is a threat model for specialists, not for most households.
- Your ISP can see you use Tor. By default, someone watching your connection can tell that you are using Tor. Bridges can reduce that risk where it matters.
In everyday terms, Tor is a strong tool for hiding who you are from the sites you visit and from a local observer, as long as you use Tor Browser as intended and do not undo its protections yourself.
How a proxy works, and why it is the weakest option
A proxy is the simplest of the three: a server that forwards your requests and returns the answers. A website sees the proxy's address rather than yours. The Tor Project describes a typical proxy provider as a single server where all users enter and leave, and says such a setup is fine only if you do not need privacy protections and you trust the provider not to do bad things.
The important point is the single point of trust. The Tor Project notes that a simple proxy provider knows both who you are and what you browse, and in some cases can see inside encrypted traffic as it relays it. Some proxies use SSL to protect your connection to them, which helps against eavesdroppers on a cafe network, but many free web proxies do not encrypt anything, and some inject ads or tracking. In general terms, an unencrypted proxy gives your local network the same view of your activity it had before. Proxies still have legitimate roles, such as company gateways that filter and log traffic, or developer tools that route requests through a test server. For personal privacy, they are rarely the right choice.
Combining tools: what helps and what quietly backfires
It is natural to assume that stacking tools multiplies protection. Often it does the opposite, because each layer adds a place where something can leak or be misconfigured.
Tor plus a VPN
The Tor Project says plainly that, while combining a VPN with Tor might seem to increase privacy, in practice it can reduce anonymity or break Tor's protections if it is not configured correctly. It does not recommend using a VPN with Tor unless you are an advanced user who knows how to configure both in a way that does not compromise your privacy. Its documentation also notes that VPNs tend to interfere with Tor and may need to be disabled. If you are not sure why you would add a VPN to Tor, you do not need to.
Pitfalls that apply to every combination
- Leaks when a tunnel drops. If a VPN disconnects silently, traffic can fall back to your normal connection. A "kill switch" feature, where available, blocks traffic until the tunnel returns. Test it rather than assuming it works.
- Logged-in accounts defeat the purpose. Browsing through any of these tools while signed in to your usual accounts ties the activity to you.
- Browser fingerprinting and cookies. Changing your IP address does nothing about cookies, tracking pixels or browser fingerprinting, as the EFF points out.
- Mixing identities. The Tor Project warns that Tor reuses circuits for multiple connections, so it is wise to be careful about which applications run at the same time.
- Extra browser add-ons. The Tor Project advises against installing additional add-ons into Tor Browser because they can bypass Tor or harm your anonymity.
A threat-model decision guide
The EFF's advice for choosing any privacy tool is to start with your security plan: who might watch you, what they could learn, and what harm that would cause. The scenarios below turn that into practical choices. They assume lawful, everyday goals.
| Your situation | Main concern | Reasonable choice |
|---|---|---|
| Everyday privacy at home | Your ISP and advertisers building a profile of your browsing | A reputable VPN can stop your ISP seeing destinations, but you are trusting the VPN instead. Pair it with HTTPS-only mode, a tracker blocker, a password manager and updates. For many people those steps matter more. |
| Public Wi-Fi (cafe, airport, hotel) | Someone on the same network watching or tampering with traffic | Mostly safe today thanks to HTTPS. Keep devices updated, avoid sensitive tasks on networks you do not trust, and consider a trusted VPN if you cannot tell who runs the network. |
| Travelling and reaching your own services | Secure access to home or work systems | A company VPN or one you host yourself. Check local laws on VPN use in the country you are visiting. |
| Geo-restricted content | Region-locked catalogues and sites | A VPN is the usual tool, but there is no guarantee. Streaming platforms increasingly block VPN traffic, and using one may breach a service's terms. Read the terms first. |
| Journalists, researchers, people at risk | Protecting sources, identity and location from capable observers | Tor Browser as the starting point, used exactly as the Tor Project recommends, combined with end-to-end encrypted messaging and careful habits. Seek specialist advice from digital security organisations for high-risk work. |
Everyday privacy
Most people overestimate what a VPN adds and underestimate simpler habits. The EFF lists stronger passwords, two-factor authentication, HTTPS-only mode, device encryption, end-to-end encrypted chat apps, software updates, encrypted DNS and tracker blocking as often more impactful than a VPN. If you want to start there, our guides to choosing a password manager and setting up two-factor authentication will do more for your security than any tunnel. If you do want a VPN on a budget, see free VPNs for Windows, and read the business-model warnings carefully, because free services must make money somehow.
Public Wi-Fi
The old advice to avoid public Wi-Fi entirely is mostly out of date. The EFF explains that because most web traffic now uses HTTPS, the content of your communications is protected. What remains visible to people on the network is metadata: the domain names you visit and when. If that is an acceptable risk, the EFF says you should not worry about public Wi-Fi. A VPN can protect that metadata from someone listening locally, but then the VPN provider sees it instead. If you cannot tell who runs the network and you have a VPN you trust, it may be useful. For a deeper look, see our article on public Wi-Fi safety: real risks vs myths.
Geo-unblocking
This is where a VPN is the most practical tool, and also where results are least predictable. Content providers, especially video streaming platforms, increasingly block devices that appear to be using a VPN, so it is not a guaranteed way around location restrictions. Regional licensing rules and service terms are the provider's to set, so check what you are agreeing to before relying on this.
Journalists and higher-risk users
If a mistake could expose a source or put someone in danger, a consumer VPN alone is not the right answer. The EFF recommends Tor as a better solution than a VPN when anonymity is the goal, because no single Tor relay can see your browsing data the way a VPN provider can. Even then, the tool is only one piece. Operational habits, such as not logging in to personal accounts and being careful with downloaded documents, decide whether the protection holds. High-risk users should seek guidance from specialist digital security groups and not rely on a general consumer article like this one.
Common myths
Myth: "A VPN makes me anonymous." It does not. The EFF says a VPN is not a tool for anonymity. It moves what is visible from your ISP to the VPN provider and does nothing about cookies, logins or fingerprinting.
Myth: "No-logs means nobody can see anything." A no-logs policy is a claim, not a guarantee. The EFF advises verifying claims, reading the privacy policy closely and checking whether the provider has published independent audits or transparency reports.
Myth: "Free VPNs are just as good." Some are fine and many are not. The EFF notes that a free service still has to pay for itself, and some sell data. An app being on an official app store does not prove it is trustworthy.
Myth: "A VPN protects me from viruses and scams." It does not. It will not stop a phishing email or a malicious download. See antivirus vs VPN for how the tools differ.
Myth: "Tor is only for criminals." The Tor Project lists journalists, activists, survivors of abuse, businesses doing competitive research and ordinary people avoiding tracking among its users. The variety of users is, in the Tor Project's words, part of what makes it secure.
Myth: "Using Tor means I am untouchable." It does not. The Tor Project says perfect anonymity is generally impossible, and your own behaviour, such as logging in, downloading files or torrenting, can undo the protection.
Myth: "A proxy and a VPN are the same thing." They are not. A VPN encrypts the whole connection between your device and its server, while a basic proxy typically relays traffic for one app and may not encrypt anything.
How to choose a VPN if you decide you need one
If your scenario calls for a VPN, the EFF suggests evaluating providers on several criteria, and these are worth a few minutes of reading before you pay.
- Claims. Be sceptical of hyperbole such as "military-grade" or "stops all hackers". Claims are not guarantees.
- Trust and transparency. Look for published third-party security audits, while remembering that practices could change after an audit.
- Business model. Work out how the company makes money if the service is free or very cheap.
- Reputation. Check who runs the company and what independent coverage exists.
- Data collection. Read the privacy policy for what is logged and where the company operates, because that determines which legal requests it can receive.
- Encryption. Prefer modern protocols such as WireGuard or OpenVPN and avoid PPTP.
The EFF adds an important caveat: it cannot vouch for any particular VPN or ratings, and you should not use a VPN you do not trust.
What to do next
- Name your goal. Is it hiding browsing from your ISP, staying safer on unfamiliar Wi-Fi, reaching region-locked content, or protecting your identity? The answer picks the tool.
- Fix the basics first. Turn on two-factor authentication, use a password manager, enable HTTPS-only mode in your browser and keep your devices updated.
- Choose one tool, not a stack. A trusted VPN for convenience-level privacy, or Tor Browser for anonymity. Avoid combining them unless you know why.
- Test it. Check your visible IP address with the tool on and off, and confirm the VPN reconnects without leaking when the connection drops.
- Review yearly. Providers, laws and streaming rules change. Reread the privacy policy and check that your tool still fits your needs.
When to bring in outside help
Setting up a VPN on every device, tuning a home router, working out whether a suspicious app is leaking data, or building a sensible privacy setup for a small team can be fiddly. IT Cares offers remote help and a 60-minute Expert Consultation at 119.99 CAD (taxes extra), delivered remotely by a senior technician. It is a practical way to review your devices and accounts and leave with a clear to-do list. You can book a session online.
Sources and further reading
- Electronic Frontier Foundation: Choosing the VPN That's Right for You (Surveillance Self-Defense, last reviewed July 28, 2026).
- Electronic Frontier Foundation: Why Public Wi-Fi is a lot safer than you think.
- Tor Project: How is Tor different from other proxies? and Tor Browser best practices.
- Tor Project: Tor Browser with VPN.