How Does Tor Hide Your IP Address?

The Tor network protects online anonymity by concealing a user’s original IP address through a decentralized, multi-layered routing process known as onion routing. Instead of connecting directly to a website, your traffic is wrapped in multiple layers of encryption and bounced through a randomized circuit of three volunteer-operated servers. This structure ensures that no single server along the path knows both who you are and where you are going.

Multi-Layer Encryption

When you send data through the Tor browser, your client software selects a route through the network and encrypts the data three times—once for each server in the circuit. These nested layers of encryption resemble the layers of an onion.

As the data packet travels through each node, that node peels away only its specific layer of encryption using its unique cryptographic key. This reveals instructions for where to send the packet next, but keeps the underlying payload and other routing information hidden.

The Three-Node Circuit

Tor directs traffic through three specialized nodes to isolate connection details:

1. Guard (Entry) Node: This is the first server your data reaches. It can see your actual IP address because you are connecting directly to it. However, because the inner layers of data remain encrypted, the entry node cannot see your payload or the final destination server.
2. Middle Relay: The guard node forwards the data to a middle relay. This server peels away the second layer of encryption. The middle relay only knows the IP address of the guard node that sent it the data and the IP address of the exit node where it must go next. It has no knowledge of your original IP address or your destination.
3. Exit Node: The final server in the chain removes the last layer of encryption. It forwards the request to the target website or service. The exit node can see the destination address, but it only knows the IP address of the middle relay, not your original IP address.

What the Target Website Sees

When your request reaches the destination website, the connection originates from the exit node rather than your personal device. Consequently, the website’s logs only register the exit node’s IP address and geographic location. Your real IP address remains completely hidden from the destination, your internet service provider (ISP) cannot see the specific websites you visit, and individual relays inside the network never possess enough combined information to trace the connection back to you.