Tor vs VPN: Which One You Really Need?

Tor vs VPN: which one you really need

Tor and VPN both dey send your traffic through machines wey no be your own, but dem dey answer different questions. VPN (virtual private network) dey move the trust from your internet provider go one company. That company go see your real address and every destination wey you visit. Tor dey spread that trust across three relays wey different people dey run. So, no single relay go know both who you be and where you dey go. Choose based on the party wey you wan hide from.

If na the network wey you dey use be that party, VPN na the correct tool. If na the website itself, or anybody wey fit force one company to release its records, be that party, Tor na the correct tool. The rest of this guide explain the details behind those two sentences.

Follow one request through both designs

Make we follow one normal request: your browser open https://news.example.com. TLS (transport layer security) protect the page content for both designs, so nobody wey dey for middle fit read the article. The important part na the metadata: who learn your IP address, who learn the destination, and who fit connect both facts together. Privacy tool na machine wey dey separate this pair. VPN move the pair go another holder. Tor split am.

Wetin each party dey see when you use VPN

Your client dey encrypt every packet and send am go one endpoint. From that endpoint go front, na ordinary traffic again.

• Your ISP (internet service provider) dey see encrypted packets between your line and one VPN server address. E dey see volume and timing. E no dey see destination hostname, as long as DNS (domain name system) queries dey pass through the tunnel too.
• The VPN operator dey see your real IP address for one side and every destination address for the other side, together with times and sizes. Both sides of the pair dey land for the same machine.
• The destination dey see the VPN exit address, plus every identifying detail wey your browser send.

So, VPN no create anonymity. E dey move the observer from your ISP go your VPN provider. This na real benefit when na the local network dey cause problem, or when your ISP dey filter or resell wetin e see. E no benefit you at all against the site wey you dey visit, because your traffic still dey arrive as one stream from one company wey know exactly who you be and hold your payment record.

The "no logs" claim na the whole product, and na the one part wey you no fit check from your side. You fit verify say the tunnel dey up. You fit verify say DNS no dey leak. You no fit verify wetin the operator dey write to disk. Na this trade-off you accept: one company, wey you choose, holding the complete picture.

Check the leak wey fit quietly cancel the tunnel:

resolvectl status
curl -s https://ifconfig.me; echo

The address wey ifconfig.me print suppose be the VPN exit. The DNS servers wey e list for the link carrying your default route suppose be the tunnel's resolver. If dem still list your local router for 192.168.1.1, your name lookups dey comot through the local link as cleartext, because the route to that router dey on-link and e more specific than the tunnel's default route. Your traffic private, but your list of sites no be private. DNS queries wey dey escape from WireGuard tunnel explain the fix step by step.

Wetin each party fit see when you use Tor

Tor dey build circuit with three relays wey e choose from signed list, the consensus, wey small group of directory authorities publish. Your client dey wrap the data with layers, one layer for each relay. Each relay dey remove one layer, learn only the next hop, then pass the remaining layers forward. Na these layers make nobody for the path hold both information together.

• Your ISP dey see encrypted traffic go one guard relay. Relay addresses dey public, so your ISP fit know say you dey use Tor. E no fit know wetin you dey reach.
• The guard relay dey see your real IP address. E no fit see the destination, because the part of the message wey name the site still dey encrypted for the relays after am.
• The middle relay dey see guard for one side and exit for the other side. E no see you and e no see the destination. E dey there so the guard and exit no go talk directly.
• The exit relay dey see the destination and the traffic as e dey leave the network. E dey see the middle relay address, not your own. With HTTPS, e learn the hostname and connection metadata, but e no see the page.
• The destination dey see the exit relay address, wey dey for public exit lists, plus anything wey your browser hand over.

To link you with the site, person need the guard and the exit at the same time. Na the design be this for one sentence. Na also why your client dey keep the same guard for months instead of choosing fresh one every time e start: if e dey rotate entry constantly, hostile relay go get repeated chances to become your guard.

Circuits no dey permanent. New connections dey move to fresh circuit roughly every ten minutes, while stream wey don already open dey stay for the circuit wey e start with. Long download and tab wey you open fifteen minutes later normally dey leave through different exits.

Install am and prove the path:

sudo apt update && sudo apt install -y tor
systemctl status tor@default
journalctl -u tor@default -n 20
curl --socks5-hostname 127.0.0.1:9050 https://check.torproject.org/api/ip

The log suppose reach Bootstrapped 100% (done): Done. The curl suppose print {"IsTor":true,"IP":"..."} with address wey you no recognise, and na your current exit be that. If IsTor be false, the request no pass through the proxy. Ubuntu packaged Tor fit dey behind the current release; Tor Project dey publish im own apt repository if you need follow upstream releases.

One trap dey inside that command. --socks5 make curl resolve the hostname by itself, then send the resulting address through the proxy, so your normal resolver go learn every name wey you visit. --socks5-hostname send the name to Tor and allow the exit resolve am. Na the same tunnel, but the leak completely different. Tor Browser and torsocks dey handle this correctly. Tools wey you configure by hand often no dey.

Tor dey carry TCP streams only. E no fit carry UDP, so ping 1.1.1.1 no dey pass through am, and VPN protocol wey dey use UDP no fit run inside am. Any program wey ignore im proxy setting simply use your normal route with your normal address, and nothing go warn you. Na why system-wide Tor dey use transparent proxy for separate box instead of environment variable.

Where trust dey really go

VPN dey gather trust for one place. One company dey hold your identity, your billing record, and your complete traffic pattern. Your protection depend on the promise say e no go keep the logs. As long as that promise hold, the design clean, fast, and easy to understand. If e fail because of subpoena, breach, or lie, e fail completely for all your traffic at the same time.

Tor dey distribute trust. Three parties wey mostly no know each other dey hold different fragments, and one fragment alone get small value. Nobody need dey honest make the design work. Dem only need to remain independent enough. You pay for this with speed, TCP only, and network wey some relays surely belong to people wey want monitor you. Tor answer to hostile relay na say one relay never enough.

When VPN be the correct tool

• You no trust the local network: hotel, airport, conference hall, or landlord router. The operator go see encrypted tunnel and nothing more.
• You want reach your own machines, or connect from a fixed address wey you control.
• You need speed and UDP: video calls, games, large transfers, and backups.
• You want a stable address wey websites no go challenge. Tor exits dey blocked or dem dey trigger CAPTCHA for plenty parts of the web.

That list na the reason to run your own VPN on a VPS instead of buying subscription, and a WireGuard server wey you set up yourself go give you tunnel wey logging policy dey inside config file wey you own. If you want the same tunnel with device-to-device key management on top, the difference between plain WireGuard and Tailscale na the comparison wey you suppose read. Each one of these tools dey very good for the work wey this list describe. None of dem fit do the work for the next one.

When Tor na di correct tool

• Your adversary include the destination site, or anybody wey fit demand records from one company.
• You dey read or publish something wey fit harm you if dem trace am back to your internet line.
• You want an onion service: traffic wey never comot from the network, no exit relay involved, and a server wey address remain hidden.
• You fit manage slow pages, CAPTCHAs and the occasional 403 Forbidden.

Use Tor Browser, no be your daily browser pointed at port 9050. The browser na half of the protection, and the section after next explain why.

Why VPS wey you rent worse pass commercial VPN for anonymity

Na here people dey get am wrong. VPS wey you rent na lease wey your name dey on top. Signup email, card, invoices, and support tickets all dey inside one company database beside that IP address. Nobody need breach anything before dem connect the address to you. The information don already dey written down, dem keep am for normal accounting reasons, and anybody wey fit ask provider question with legal authority behind am fit access am.

The second problem na the crowd. Commercial VPN exit address dey shared by plenty customers for the same time, so that address alone no point to one person. Your VPS address na only your own. Every request wey comot from am na you, today and next month. The address no dey rotate, so destination fit build profile about you across months without any cookies.

None of this mean say self-hosted VPN na bad thing. E good well-well for encrypting your traffic on network wey you no control, and for reaching your own services from anywhere. E simply no be anonymity tool, and na mistake to use am like one. For plain explanation of wetin your provider fit and no fit see for the machine itself, read how safe VPS hosting really be.

Wetin Tor or VPN no fit fix

• Browser fingerprinting. Your user agent, screen size, timezone, installed fonts, language and canvas rendering dey combine into value wey often unique, and e dey follow you across every IP address wey you use. Tor Browser dey fight this by making all im users look the same and by resizing the window with fixed steps. Your normal browser behind SOCKS proxy still keep im fingerprint and cookies.
• Logging in. Once you sign in to account wey know your name, network layer no matter again. One login from home and another one through Tor to the same account go connect both sessions together.
• Anything wey the endpoint record anyway: wetin you type, wetin you buy, wetin you search for.
• End-to-end correlation. Person wey dey watch your line and the exit at the same time fit compare timing and packet volume, then match both ends. Tor talk clearly say e no protect against adversary wey fit see both sides.

You fit use Tor and VPN together?

Tor over VPN mean say VPN go connect first, then Tor go run inside am. Your ISP go see only the VPN, and the guard relay go see the VPN address instead of your own. But you don put company wey get your name and card for front of system wey design to avoid exactly that. E make sense for one situation: if using Tor at all fit put you for danger for your line, and you no get better option.

VPN over Tor, where traffic comot from Tor network then enter VPN account, harder to set up and usually worse. That account get your payment record attached, so you don tie stable identity to traffic wey anonymous just now.

If na only to hide Tor use from your ISP, the supported answer na bridge: entry point wey no dey inside public consensus, together with pluggable transport like obfs4 or Snowflake wey make the traffic hard to classify. Tor Browser ship with both, and no third company need your name.

FAQ

Tor na just free VPN?

No. VPN dey send your traffic through one server wey one company run, and the company fit see your real address and every destination. So e replace your ISP with provider wey you choose. Tor dey send traffic through three relays wey different people run. The guard sees you but e no see the site. The exit sees the site but e no see you. Tor na TCP only, e slow well-well, and plenty websites dey block am or dey give am extra checks. So e no be direct replacement for VPN everyday use.

My ISP fit know say I dey use Tor?

By default, yes. Dem publish relay addresses for the public consensus, so your provider fit see say you dey connect to known guard relay. E no fit see which sites you reach. To hide the use itself, Tor Browser offers bridges with pluggable transport like obfs4 or Snowflake. Dem dey connect through entry point wey no dey the public list. VPN before Tor also hide am from your ISP, but e give that same information to the VPN operator instead.

If I run VPN for my own VPS, e go make me anonymous?

No. You rent the server with your name and card, so the provider billing records already link that address to you. Request to the provider fit expose those records. Na only you dey use the address, so everything wey leave am belong to one person and remain linkable as long as you keep the server. Self-hosted VPN na strong privacy tool against local network, but na weak anonymity tool against anybody wey fit ask your provider for information.

Why websites dey block me or show CAPTCHAs when I use Tor?

Because exit relay addresses dey public, and many people dey share dem. So abuse from any one of those users dey affect the address wey you dey borrow. Content delivery networks give those addresses poor scores and reply with challenge, a 403 Forbidden, or signup form wey no gree submit. Nothing for your side fit remove this. New circuit go give you different exit, and sometimes that exit get better reputation.

If I use VPN, DNS queries still fit leak?

E fit happen, and e common. With full tunnel and no resolver configured for tunnel interface, your client continue to use resolver wey e learn from local network. The route to that resolver dey on-link, so e beat tunnel default route. Your queries then leave as cleartext while everything else dey encrypted. Run resolvectl status and confirm say the DNS server listed for the link carrying your default route na the tunnel resolver, not your local router.