What is onion routing and how does it work inside Tor

Onion routing is a technique for anonymous communication in which a message is wrapped in several layers of encryption, one for each relay it will pass through, so that each relay can remove only its own layer and learns only where to send the message next. The Tor network implements onion routing with three relays per connection, which is why websites see a Tor exit's address and your internet provider sees only a connection to a Tor entry.

The idea is elegant and much older than most people assume. Understanding it explains both why Tor works and where it stops working, which matters if you are going to depend on it. This article walks through the mechanism step by step, explains the roles of the three relays, covers the history of the onion routing project, looks at how onion services extend the idea, and finishes with the attacks the design does and does not defend against.

The core idea: separation of knowledge

Ordinary internet routing tells every device along the path who is talking to whom, because the source and destination addresses travel in every packet. A VPN hides that from your network by moving the visible endpoint to the VPN server, but the VPN server itself then knows both ends.

Onion routing solves the problem differently: it splits the knowledge. The relay that knows your address does not know the destination, the relay that knows the destination does not know your address, and a relay in between knows neither. Encryption enforces the split, because each relay can only decrypt the layer meant for it. No trust in any single relay is required; you only need the relays not to be colluding with each other and watching the same traffic.

How onion routing works, step by step

Here is what happens when Tor Browser loads a page.

1. The client obtains a list of relays from Tor's directory authorities, with each relay's public key.
2. It picks three relays: an entry (also called a guard), a middle and an exit.
3. It negotiates a separate encryption key with each relay in turn, extending the circuit one hop at a time so that each relay knows only its neighbours.
4. To send a request, the client encrypts it with the exit's key, then wraps that in encryption with the middle's key, then wraps that in encryption with the entry's key. Three layers.
5. The entry relay receives the packet, removes the outer layer, and sees only an encrypted blob and an instruction to forward it to the middle relay.
6. The middle relay removes the second layer and forwards the remaining blob to the exit.
7. The exit removes the last layer, sees the actual request, and sends it to the website over the normal internet.
8. The response travels back along the same circuit, with each relay adding its layer, until the client peels all three.

The client rotates to a new circuit periodically and uses different circuits for different sites, so that activity on one site cannot be linked to activity on another through the exit.

The three relays and what each one sees

The roles are worth spelling out because they define the protection.

• Entry or guard relay. Sees your real IP address and knows you are using Tor. Does not see your destination or content. Tor clients keep the same guard for a long period, which reduces the chance of eventually picking a malicious one.
• Middle relay. Sees traffic arriving from the guard and leaving to the exit. Knows neither the origin nor the destination. There are many middle relays and running one is low-risk, which is why volunteers operate thousands of them.
• Exit relay. Sees the destination and, if the connection is not HTTPS, the content. Does not know who sent it. Exits are the relays websites see and blame for abuse, which is covered in the separate exit node guide on this site.

Your internet provider sees an encrypted connection to the guard. The website sees a request from the exit. Everything between is encrypted at least once.

History: the onion routing project and Tor

Onion routing was developed in the mid-1990s by researchers at the United States Naval Research Laboratory, who published papers describing the layered design and built early prototypes. The goal was to protect intelligence communications over public networks, but the design was published openly, because an anonymity system only works if it has many diverse users; a network used only by one agency would identify that agency's traffic.

Tor, originally an acronym for The Onion Router, was developed in the early 2000s as a second-generation design that fixed weaknesses in the original, and the code was released under a free licence. The Tor Project was founded as a non-profit in the mid-2000s to maintain it. Today the network is run by volunteers around the world, and the project develops Tor Browser, the relay software and the onion services protocol. This history is public and is the origin of the frequent question of whether Tor is trustworthy given its beginnings; the answer from researchers has consistently been that the design and code are open and reviewed, and that the network's diversity of operators is what protects users.

Onion services: routing that hides both ends

Ordinary onion routing hides the client. Onion services extend it to hide the server too. A site running as an onion service builds its own circuits into the Tor network and publishes an address derived from its public key, the .onion name. When you connect, your three-hop circuit and the service's three-hop circuit meet at a rendezvous relay, so neither side ever learns the other's location. Traffic never leaves the Tor network, so there is no exit relay and the connection is encrypted end to end by the protocol itself.

This is the mechanism behind what is called the dark web, and also behind the onion mirrors of news sites, secure drop systems and privacy services that use it for censorship resistance. The design is the same; the reputation depends on which sites people talk about.

What onion routing does not protect against

The encryption layers are strong. The design's limits are elsewhere, and knowing them is part of using Tor well.

• Traffic correlation. An observer who can see both your connection to the guard and the exit's connection to the website can match timing and volume and link them. Tor cannot prevent this by design; it relies on it being hard to watch both ends. Large relay operators and network-level observers are the concern.
• Malicious exits. An exit relay can read and alter traffic that is not protected by HTTPS. Use HTTPS or onion services.
• Application leaks. Software that ignores Tor's proxy, opens documents that fetch resources directly, or embeds your identity in content leaks around the routing entirely.
• Browser exploits. Compromising the browser reveals the real IP address regardless of routing. This is why Tor Browser updates matter more than anything else.
• Identity through behaviour. Logging in to accounts, distinctive writing, or timing patterns identify a person however well the packets are routed.

None of these break onion routing. They go around it, which is why the anonymity guides on this site spend so much time on habits.

What the designers and researchers say

The design's strengths and limits are well documented by the people who built and studied it.

The original onion routing papers from the Naval Research Laboratory laid out the layered design and explicitly noted that anonymity requires a large and diverse user base, an argument that shaped Tor's decision to be open to everyone.

The Tor Project's design documentation states plainly that Tor does not protect against an adversary who can observe both ends of a connection, and that its security rests on the difficulty of doing so across a large volunteer network, rather than on any cryptographic guarantee against correlation.

Academic anonymity researchers who have studied Tor for two decades have found that the routing has held up well and that the realistic attacks have been on browsers, on user behaviour and on relays run by a single party controlling too many positions, which is why the project monitors the network for suspicious relay families.

Use the idea, respect the limits

Now that you know how the layers work, the rules for using Tor make sense: keep the browser updated because it is the soft target, use HTTPS because the exit can read plain traffic, and keep your identity out of the content because routing cannot hide what you say. Open Tor Browser with that model in your head and it will do exactly what it was designed to do.

Frequently asked questions

Last reviewed and updated on 2026-09-11. Plain text version: /anonymity/onion-routing.txt.