VPN vs Tor: Differences, Trade-offs & When to Use Each

When you connect to a VPN, your device opens an encrypted tunnel to one server operated by your VPN provider. All traffic flows through that tunnel: your ISP sees only encrypted bytes going to the VPN server, and websites see the VPN server's IP instead of yours.

The VPN provider can technically see your real IP and the destinations you're connecting to (which is why an published privacy policy matters — see our privacy guide). Modern providers like NordVPN, ExpressVPN, ProtonVPN, and Mullvad have all published published disclosures confirming they retain no such records.

Tor (The Onion Router) routes your traffic through three random relays operated by volunteers around the world:

• Entry guard: Knows your real IP but not your destination.
• Middle relay: Knows neither your IP nor your destination — just that traffic is passing through.
• Exit node: Knows the destination but not your real IP.

Each relay only knows the relay before and after it in the chain, so no single party can link you to your activity. Traffic is encrypted in three layers (hence 'onion'), with each relay peeling off one layer.

Tor is free, run by the non-profit Tor Project, and is the strongest available defense against network-level surveillance. The trade-off is speed: routing through three relays plus the encryption overhead means most Tor connections run at low throughput.

A VPN is usually better for everyday performance than Tor because it routes traffic through one provider network rather than several volunteer relays. Tor is built for stronger anonymity, not speed, and is best reserved for threat models that need it. For video, calls, gaming, and large downloads, a reputable VPN on a nearby server is usually the practical choice.

A VPN protects against:

• ISP surveillance and selling of browsing data
• Network operators on public Wi-Fi (hotels, airports, coffee shops)
• Geographic restrictions on content you have legal access to
• Casual network observation

Tor protects against:

• All of the above, plus
• The risk of any single party (including the VPN provider) being able to link you to your activity
• Adversaries with subpoena power over a single network operator or VPN provider
• Persistent identity correlation across browsing sessions (when used with Tor Browser's other defenses)

Neither protects against a compromised endpoint, malware, phishing, or logging into accounts that already know who you are. If you sign into Gmail through Tor, Google still knows it's you.

Two patterns are commonly used:

Tor over VPN (most common): Connect to your VPN first, then open Tor Browser. Your ISP sees only the VPN connection (not Tor), and the Tor entry guard sees the VPN's IP instead of yours. ProtonVPN's 'Tor over VPN' servers and NordVPN's 'Onion over VPN' servers do this automatically.

VPN over Tor (rare, advanced): Route VPN traffic through Tor. Useful if you want to access services that block known Tor exit nodes. More complex to set up and only beneficial in specific threat models.

For most users wanting the strongest practical privacy: VPN + Tor Browser for sensitive sessions, VPN alone for everyday privacy.

Use a VPN if you:

• Want practical privacy from your ISP and network operators
• Need strong practical performance for streaming, video calls, gaming, downloads
• Want to access your home services while traveling
• Have a 'normal' threat model — not a high-profile target

Use Tor if you:

• Are a journalist working with confidential sources
• Are an activist in a hostile network environment
• Need the strongest available unlinkability between your identity and your activity
• Are accessing .onion sites
• Don't need strong reported performance for the session

Use both if you:

• Want VPN-level speed for general browsing plus Tor for specific sensitive sessions
• Are concerned about a single party (ISP, VPN provider, or network operator) linking you to your activity