A Tor exit node is the last of the three relays in a Tor circuit. It removes the final layer of encryption and sends your request to the website using its own IP address, so the site sees the exit's address instead of yours. Because the exit is where Tor traffic joins the ordinary internet, it can read anything not protected by HTTPS, and its address appears in a public list that websites use to recognise Tor users.
Exit nodes generate more confusion than any other part of Tor. People worry that exits spy on them, wonder why a list of them is published, and are frustrated when sites block or challenge Tor traffic. All three follow from what an exit is. This article explains the exit's role, exactly what it can and cannot see, why the exit list is public and how sites use it, the abuse dynamics behind blocking, how to protect yourself at the exit, and what running one involves.
The exit's role in a circuit
Your Tor Browser builds a circuit through an entry relay, a middle relay and an exit relay. Each relay peels one layer of encryption. The exit peels the last one, which means it is the only relay that sees your actual request: the domain, the path, and, if the site is plain HTTP, the content. It sends that request to the site, receives the answer, encrypts it for the trip back and hands it to the middle relay.
The exit does not know who you are. It knows only that the request came from a middle relay. Your address is known to the entry relay, which does not know the destination. That division is the whole point of onion routing, explained in its own guide on this site.
Exits are volunteers' servers. Anyone can run one, subject to the Tor Project's policies, and thousands of people do. The network chooses your exit for you, weighted by capacity, and changes it as circuits rotate.
What an exit can and cannot see
Be precise about this, because both the paranoid and the complacent versions are wrong.
An exit can see the destination address and domain of every connection it carries. For HTTP connections, it can also read and modify the content, including any passwords or form data sent in the clear. For HTTPS connections, it sees the domain and the encrypted stream, but not the pages, the form data or the cookies. For connections to onion services, there is no exit at all, because the traffic never leaves the Tor network.
An exit cannot see your IP address, your location, or which other sites you are visiting through other circuits. It cannot link your visit to this site with your visit to another site five minutes later, because Tor uses different circuits for different destinations.
The practical rule is therefore simple: over Tor, use HTTPS sites and onion services, and treat any plain HTTP page as readable by a stranger. Tor Browser enforces HTTPS by default and warns when a site does not support it.
Why the Tor exit node list is public
The Tor Project publishes the addresses of current exit relays, and anyone can download or query the list. This surprises people who expect an anonymity network to hide its infrastructure, but the reasoning is sound.
Exits are discoverable regardless. A website receiving Tor traffic can identify exits by their behaviour, and researchers can enumerate relays from the network directory. Publishing the list changes nothing about detectability. What it does is give website operators an accurate tool, so that they can make deliberate choices: allow Tor, allow it with extra checks, or block it. Without the list, sites would rely on cruder heuristics that misclassify ordinary users. The list also directs abuse complaints to the relay operator rather than to whoever happens to share an address range, and it lets services offer Tor users alternative access such as onion mirrors.
The list is not a list of Tor users. It is a list of the servers through which their traffic emerges, and each server carries traffic for a great many people at once.
Why sites block or challenge Tor exits
An exit's address is shared by everyone whose circuit ends there. If one of those users scrapes a site, spams a forum, or attempts logins, the site sees that behaviour from the exit's address and cannot tell it apart from yours. Many sites respond to the exit address as a whole with CAPTCHAs, rate limits or outright blocks.
Other reasons are less about abuse. Some sites block Tor because payment fraud prevention flags anonymous traffic, some because a content delivery network applies a default rule, and some because the operator has decided that anonymous visitors are not welcome. Tor Browser's "New Circuit for this Site" option assigns a fresh exit and often gets past a block that was aimed at one address, and many large services now run onion mirrors specifically so Tor users can avoid the problem.
Protecting yourself at the exit: a five-point checklist
- Keep HTTPS-only mode on, which Tor Browser does by default, and stop if the browser warns that a site is not using HTTPS.
- Prefer onion services when a site offers one; there is no exit to trust.
- Never enter passwords or personal data into a plain HTTP page over Tor. That is the one situation where an exit can read what you type.
- Do not trust certificate warnings away. If a site over Tor suddenly presents a certificate error, a relay or someone between the exit and the site may be interfering. Close the tab and get a new circuit.
- Remember that the exit sees the destination even when it cannot see the content. Visiting a site does not identify you, but the exit knows that someone visited it.
Exit node abuse and what the project does about it
Because exits carry plain traffic for HTTP sites, a malicious exit operator could tamper with it. The Tor Project actively scans for exits that modify traffic, strip HTTPS or interfere with connections, and removes relays that are caught. Researchers periodically run their own scans and publish results. The number of bad exits found at any time is small compared with the network, but the possibility is why HTTPS and onion services matter.
Malicious relays that operate in large groups to try to observe both ends of circuits are a different concern, handled by monitoring for relays that share operators and by the guard design that keeps your entry stable. Neither problem is unique to exits, but exits are where tampering is easiest to notice.
Running an exit node
Running a middle relay is low-risk and welcomed. Running an exit is a bigger commitment, because abuse complaints and legal inquiries go to the exit operator's address. People who run exits generally do so from a dedicated server with a hosting provider that knows and permits Tor, use a reduced exit policy that blocks ports commonly abused, publish contact information and a notice page on the relay's address explaining that it is a Tor exit, and sometimes operate through an organisation formed for the purpose. The Tor Project publishes detailed guidance and legal resources for operators. Running an exit from a home connection is strongly discouraged, because the complaints arrive at your door and your ISP.
What operators and researchers have found
The picture above matches what relay operators and researchers have documented.
Long-time exit operators describe the work as mostly handling automated abuse complaints and occasional law-enforcement questions, and report that a clear notice page and a reduced exit policy resolve the large majority of them. Their experience is the basis of the project's operator guidance.
Researchers who have scanned the network for malicious exits have found small numbers of relays tampering with traffic, mostly targeting plain HTTP, and have noted that HTTPS-only browsing neutralises almost all of the observed behaviour.
Website operators who have written about their Tor policies frequently describe moving from blanket blocks to targeted challenges after realising that most Tor traffic was ordinary, and several large services have launched onion mirrors as the cleanest way to serve Tor users without the shared-exit problem.
Use Tor with the exit in mind
The next time you open Tor Browser, keep one picture in your head: everything you send goes out through a stranger's server that sees the destination and, for HTTP, the content. Stay on HTTPS, use onion services where they exist, and when a site blocks the exit, ask for a new circuit rather than giving up. The exit is not a flaw in Tor; it is the point where Tor's protection ends and the ordinary web's protection has to take over.
Frequently asked questions
What is a Tor exit node?
It is the third and final relay in a Tor circuit. It removes the last layer of encryption and sends your request to the website using its own IP address, then relays the response back. The website sees the exit's address, not yours.
Can a Tor exit node see my data?
It can see the destination of your traffic, and it can read the content if the connection is not encrypted with HTTPS. It cannot see your IP address, because that is known only to the entry relay. Using HTTPS or onion services keeps the content private from the exit.
Why is there a public Tor exit node list?
The Tor Project publishes exit addresses so that website operators can identify Tor traffic and decide how to treat it, and so that abuse complaints reach the right place. Secrecy would not help, because exits are discoverable anyway, and transparency lets sites offer Tor users a better experience than a blanket block.
Why do websites block Tor exit nodes?
Because many users share each exit, and a small number of abusive users make the whole exit look suspicious. Sites see repeated logins, scraping or spam from an exit address and respond with blocks or CAPTCHAs. Others block Tor for policy reasons unrelated to abuse.
Is it safe to run a Tor exit node?
It is legal in most countries but carries practical risks, because abuse complaints and legal inquiries arrive at the exit operator's address. The Tor Project's guidance recommends running exits from a dedicated server with a hosting provider that understands Tor, not from a home connection.
Last reviewed and updated on . Plain text version: /anonymity/tor-exit-node.txt.
