Why Tor Browser Used HTTPS Everywhere

The Tor Browser previously relied heavily on the HTTPS Everywhere extension to safeguard users against surveillance, data manipulation, and malicious exit nodes. In an era when encrypted connections were not yet the web standard, bundling this tool ensured that traffic leaving the Tor network remained encrypted whenever possible, closing a critical security vulnerability inherent to the network’s architecture.

Protection Against Malicious Exit Nodes

In the Tor network, traffic is routed through three encrypted relays: the guard node, the middle relay, and the exit node. While the path between the user and the exit node is fully encrypted, the connection between the exit node and the destination website is not protected by Tor itself.

If a user connects to a standard, unencrypted HTTP website, the exit node operator can view the entire contents of the traffic, including login credentials, browsing habits, and personal data. Malicious exit node operators can also perform man-in-the-middle (MitM) attacks, inject malware, or alter web content. HTTPS Everywhere minimized this threat by automatically upgrading unencrypted HTTP requests to secure HTTPS connections, ensuring that exit nodes only saw encrypted ciphertext.

The Era of Inconsistent HTTPS Adoption

During the early and mid-2010s, many major websites supported HTTPS but did not enforce it by default. Users typing an address into a browser would often default to an insecure HTTP connection unless they explicitly typed https:// or were redirected by the server.

HTTPS Everywhere, developed collaboratively by the Electronic Frontier Foundation (EFF) and The Tor Project, maintained a comprehensive, community-curated ruleset. This allowed the browser to automatically rewrite requests from HTTP to HTTPS before the traffic ever left the user’s device, closing the window for interception.

Transition to Native HTTPS-Only Modes

The reliance on HTTPS Everywhere diminished as the broader web evolved. The widespread adoption of automated, free certificate authorities (such as Let’s Encrypt) made HTTPS the global default for web traffic.

Eventually, major browser engines, including Mozilla Firefox (which forms the base of the Tor Browser), implemented native “HTTPS-Only” modes. This native functionality made the HTTPS Everywhere extension redundant, leading to its eventual deprecation and replacement by built-in browser security settings.