Why NoScript is Pre-Installed in Tor Browser

The Tor Browser comes with the NoScript extension pre-installed as a core defense mechanism to protect user anonymity and security. Because JavaScript and other active web scripts can be exploited to reveal a user’s real IP address, exploit browser vulnerabilities, or track users across the web, NoScript gives Tor the necessary framework to block or restrict these scripts, power the browser’s built-in Security Levels, and significantly reduce the attack surface.

Protection Against Deanonymization and Exploits

The primary reason NoScript is bundled with Tor Browser is to mitigate software vulnerabilities that could compromise user anonymity. Malicious websites can use complex JavaScript to exploit browser zero-day vulnerabilities, execute arbitrary code, and bypass the Tor proxy entirely to transmit the user’s real IP address and hardware details back to an attacker. By restricting how and when scripts run, NoScript minimizes these execution paths.

Powering Tor’s Security Levels

Tor Browser integrates NoScript directly into its user interface through the “Security Level” slider (Standard, Safer, and Safest). Rather than requiring users to manually configure complex script-blocking rules, Tor uses NoScript in the background to enforce these presets:

• Standard: JavaScript is enabled by default on all sites for maximum usability.
• Safer: JavaScript is automatically disabled on non-HTTPS sites, and certain fonts and math symbols are blocked.
• Safest: JavaScript is disabled entirely by default across all websites, along with media auto-play and specific web fonts.

Without NoScript, Tor Browser would lack the granular mechanism needed to dynamically apply these security profiles.

Mitigating Browser Fingerprinting

Browser fingerprinting involves running scripts to gather unique information about a user’s system—such as installed fonts, screen resolution, GPU details, and supported media formats—to track them without using cookies. Disabling or restricting scripts via NoScript stops trackers from executing the JavaScript APIs required to build an identifiable device fingerprint, helping Tor users blend into the crowd.

Defense Against XSS and Clickjacking

NoScript includes built-in protection against Cross-Site Scripting (XSS) and clickjacking attacks. It prevents malicious websites from injecting code into trusted sessions and blocks invisible interface layers designed to trick users into clicking links they did not intend to click. This ensures that even when scripts are enabled, unauthorized cross-origin requests and script executions are strictly contained.