Why Is Tor Rewriting Its Codebase in Rust?

The Tor Project is actively replacing its legacy C codebase with a new implementation written in Rust, known as Arti (A Rust Tor Implementation). This transition addresses decades of accumulated technical debt by improving memory safety, boosting network performance, and transforming Tor into a modular, embeddable library for third-party applications. By moving to Rust, the project aims to create a more resilient and maintainable privacy network for the future.

Eliminating Memory Safety Vulnerabilities

The original Tor implementation was written in C, a language notorious for memory management vulnerabilities such as buffer overflows, use-after-free errors, and null-pointer dereferences. Because Tor functions as critical security and anonymity software, a single memory corruption bug can lead to severe exploits, including traffic de-anonymization or remote code execution. Rust provides compile-time memory safety without requiring a garbage collector, eliminating an entire class of vulnerabilities that historically required continuous patching in the C implementation.

Resolving Decades of Technical Debt

The legacy Tor codebase spans over twenty years of development. Over time, it grew into a complex, monolithic architecture that became increasingly difficult to audit, refactor, and maintain. Rewriting the system from scratch allows the Tor development team to discard obsolete protocols, streamline core algorithms, and implement a clean, modern software architecture that is easier to maintain and verify.

Creating a Modular and Embeddable Architecture

The original C client was designed primarily as a standalone proxy daemon. Developers who wanted to integrate Tor into their own mobile or desktop applications often had to run Tor as a background process and communicate with it over local network sockets, introducing overhead and platform-specific bugs. Arti is structured as a collection of modular, idiomatic Rust crates (libraries). This architecture enables external developers to embed Tor capabilities directly into applications—such as web browsers, messaging apps, and operating system utilities—without running a separate background service.

Better Concurrency and Performance

The original C implementation relied heavily on event-driven, single-threaded processing that struggled to fully utilize modern multi-core processors without complex workarounds. Rust features robust, thread-safe concurrency abstractions and a modern asynchronous programming model. This allows Arti to scale efficiently across multiple CPU cores, reduce latency in circuit building, and handle high-throughput routing with significantly lower resource consumption.

Modern Developer Tooling and Ecosystem

Rust’s package manager (Cargo), built-in testing framework, and strict compiler tooling make the codebase significantly more accessible to contributors. The modern development environment reduces the barrier to entry for open-source developers, accelerates feature deployment, and simplifies continuous integration and security audits across multiple platforms.