How Many Layers of Encryption Does Tor Use?

When a message enters the Tor (The Onion Router) network, exactly three layers of encryption are applied to it by default. Each layer corresponds to one of the three volunteer-operated relays in a standard Tor circuit: the Guard (or Entry) node, the Middle relay, and the Exit node. As data travels through the network, each node strips away a single layer of encryption to reveal instructions for where to send the packet next, ensuring that no single node knows both the origin and destination of the traffic.

The Three Layers of Tor Encryption

Tor’s layered design is where the “onion” metaphor originates. Before any data leaves the user’s Tor client, the client negotiates a unique set of cryptographic keys with three randomly chosen relays. The message is then encrypted sequentially in reverse order of the route:

1. The Innermost Layer (Exit Node Key): The client first encrypts the actual payload and final destination address using the symmetric key shared with the Exit node.
2. The Middle Layer (Middle Relay Key): The client takes the already-encrypted payload and encrypts it again using the key shared with the Middle relay. This layer includes routing instructions to the Exit node.
3. The Outermost Layer (Guard Node Key): Finally, the client encrypts the entire package once more using the key shared with the Guard/Entry node. This layer contains instructions directing the packet to the Middle relay.

How the Routing and Decryption Process Works

Once the triple-encrypted packet is transmitted into the Tor network, it passes through the circuit step-by-step:

• Entry/Guard Node: Receives the packet from the user’s IP address. It decrypts the outermost layer using its key, discovering the IP address of the Middle relay. It cannot see the message content or the final destination.
• Middle Relay: Receives the packet from the Guard node. It decrypts the second layer, discovering the IP address of the Exit node. It knows neither the original sender’s IP nor the final destination.
• Exit Node: Receives the packet from the Middle relay. It decrypts the innermost layer to reveal the final destination and the payload. It delivers the data to the target server without knowing the IP address of the user who sent it.

Tor Encryption vs. End-to-End Encryption

The three layers of encryption applied by Tor are designed exclusively to provide anonymity and route obfuscation. The Exit node decrypts the final Tor layer, meaning that if a user visits an unencrypted website (HTTP), the Exit node can view the plaintext data. However, if the user connects to a secure site using HTTPS, an additional end-to-end encryption layer (TLS) remains intact beneath the three Tor layers, preventing the Exit node from reading the message content.