What Is the Tor Network Consensus Document?

The Tor network consensus document is a single, hourly updated file that provides a complete and verified list of all active relays operating within the network. It serves as the foundation for the entire Tor ecosystem, ensuring that every Tor client has an identical, secure, and tamper-proof view of the network. Without this consensus mechanism, clients would not know which relays are safe, operational, or capable of routing encrypted traffic.

How the Consensus Is Created

The consensus document is generated by a small group of trusted, globally distributed servers known as Directory Authorities. Once every hour, these authorities collaborate through a multi-step voting process:

1. Measurement and Voting: Each directory authority independently tests the network, evaluates relay uptime and bandwidth, and publishes a “vote” reflecting its view of the active relays.
2. Consensus Computation: The authorities exchange their votes and compute a deterministic, majority-rule agreement (the consensus). This resolves discrepancies between individual authority perspectives.
3. Cryptographic Signing: Each directory authority signs the consensus document with its private key. If a supermajority of authorities sign the file, it becomes the official network consensus.

Key Information Included in the Document

The consensus document contains vital technical metadata for every valid relay on the network, including:

• Identity Keys and Fingerprints: Unique cryptographic fingerprints to verify the identity of each relay and prevent impersonation attacks.
• IP Addresses and Ports: The network location where the relay accepts traffic and handles directory requests.
• Relay Flags: Status indicators assigned by authorities, such as Guard (entry nodes), Exit (exit nodes), Fast, Stable, and Running.
• Bandwidth Weights: Normalized capacity metrics that clients use to balance network load evenly across all available relays.

Why the Consensus Document Matters

Security in the Tor network relies heavily on path selection. When a user connects to Tor, their client downloads the latest signed consensus document directly from directory caches. Using the cryptographic signatures embedded in the file, the client independently verifies that the document is authentic and unmodified.

With this verified list, the client can safely choose a three-hop path—consisting of a Guard relay, a Middle relay, and an Exit relay—to build an encrypted circuit. By synchronizing the network state globally, the consensus document prevents malicious actors from isolating users, fabricating fake relays, or steering users toward compromised paths.