Why Tor Bridges Are Not in the Public Directory

Tor bridges are private, unlisted entry relays specifically designed to help users bypass internet censorship and firewalls. Unlike standard Tor relays, bridge IP addresses are deliberately excluded from the public directory to prevent internet service providers (ISPs), network administrators, and hostile governments from harvesting their addresses and systematically blocking access to the Tor network.

Public Relays vs. Tor Bridges

The standard Tor network operates using a publicly available consensus directory. This directory contains the IP addresses of every standard entry guard, middle relay, and exit node in the network. While public visibility is necessary for regular Tor routing and network consensus, it also makes it trivial for censors to download the list and implement network-wide IP blocks against all known Tor entry points.

Bridges solve this vulnerability by functioning as alternate entry points that do not appear in any public network consensus.

Preventing Bulk Censorship

If bridge IP addresses were published in a central, open directory, any blocking authority could easily scrape the entire list and add those IP addresses to their firewall blacklist within minutes. By keeping bridge addresses secret, censors cannot create an automated, exhaustive blocklist to stop users from connecting to the Tor network.

Controlled Distribution via BridgeDB

Because bridges are not publicly listed, users must obtain them through specialized, rate-limited channels managed by the Tor Project’s BridgeDB system:

• Web and Captcha: Users can request a limited number of bridges at a time via Tor’s official BridgeDB website after solving a CAPTCHA.
• Automated Email and Messengers: Users can email specific Tor Project addresses or use designated bots (such as on Telegram) to receive a small set of bridge addresses.
• Integrated Transports: Modern versions of the Tor Browser include built-in pluggable transports and automatic bridge allocation.

Distributing bridges in small, controlled batches ensures that an adversary cannot query the system once and harvest every available bridge address. Even if a censor acquires and blocks a few bridge IPs, thousands of other unlisted bridges remain operational and accessible to other users.

Integration with Pluggable Transports

Hiding the IP address is only the first layer of defense. Many unlisted bridges also implement pluggable transports (such as obfs4, Snowflake, or WebTunnel). These transports disguise the metadata and traffic patterns of Tor connections, making Tor traffic appear as standard HTTPS browsing, video calls, or benign data transfers to bypass Deep Packet Inspection (DPI).

Tor bridges remain unlisted because their security and utility rely entirely on obscurity. Without public obscurity, censors could easily eliminate the primary circumvention tool used by millions living under strict digital censorship.