Installing Tor Browser takes about five minutes. Getting hold of a genuine copy is the part that actually matters, because fake ones exist, they look convincing, and a tampered browser quietly undoes the entire point of using Tor at all.
What follows covers Windows, macOS, Linux and Android. If you’re not sure yet what the network does, read the introduction first and come back.
Before you start
It’s free. Nobody should ever charge you for it, and any site asking you to pay is not the Tor Project.
It runs on Windows, macOS, Linux and Android. On iPhone and iPad it doesn’t exist at all. Apple requires every browser to use its own engine, which makes a real port impossible. The Tor Project points iOS users to Onion Browser instead, which is a different app with different trade-offs. If you find something called Tor Browser in the App Store, it isn’t.
Getting the file
One address:
That link is safe to click — you’re already on an encrypted connection here, and it goes where it says. If you’d rather not take my word for it, type the domain into your address bar yourself. What you shouldn’t do is search for it and click whatever comes up first, or use a download aggregator, or trust a mirror site that looks official.
The reason isn’t general caution. A modified Tor Browser can behave completely normally while reporting everywhere you go, or swapping any cryptocurrency address you copy for one belonging to somebody else. People have lost serious money this way, and it’s one of the frauds that never stops working. Adverts impersonating the Tor Project have shown up in search results more than once.
The site works out which system you’re on and offers the right file.
Checking the file is real
Every release is published with a cryptographic signature, which lets you confirm the file you received is the file they published and hasn’t been interfered with on the way.
Doing it properly means installing GnuPG and running a handful of commands. The Tor Project has a step-by-step guide covering every platform.
Should you? If you’re somewhere that interferes with internet traffic, or you’ve got reason to think someone might tamper with your connection, yes. If you’re a curious person on a home connection who typed the address correctly, the risk is small and most people skip this step. I’d rather say that than pretend everybody verifies, because they don’t.
Installing it
Windows. Run the .exe, pick a language and a location, let it finish. No administrator rights needed, and you can install it to a USB stick if you’d rather not leave it on the machine.
macOS. Open the .dmg, drag Tor Browser into Applications. First launch warns you it came from the internet. Expected.
Linux. Extract the archive and run start-tor-browser.desktop from inside it. Your distribution probably packages it too, but the official archive tends to be more current.
Android. Google Play or F-Droid. Check the publisher says The Tor Project.
First connection
You get two options on first launch: connect, or configure first.
Connect is the right answer unless Tor is blocked where you are. A few seconds to build a circuit and you’re through.
If it stalls, your network or your country is probably filtering it. Go back, choose the configuration option, and turn on a bridge — an entry point that isn’t published in the public relay list, so it can’t simply be blocked by address. The browser can fetch one for you automatically. What bridges do and don’t conceal has the detail, and getting one is far less painful than it used to be.
If you can’t even reach the download site, email gettor at torproject.org and you’ll get download links back. That service exists specifically for people behind national filters.
Set the security level first
People skip this. It takes thirty seconds.
The shield icon in the toolbar has three settings:
- Standard. Everything enabled, sites work normally, most exposed to attacks that use browser features against you.
- Safer. Scripts off on unencrypted sites, risky media blocked. Sensible middle ground.
- Safest. Scripts off everywhere. Plenty of sites will break. For when you have a specific reason.
Do it before you start browsing. Changing it halfway through doesn’t undo whatever an earlier page already did.
Leave the rest alone
Tor Browser tries to make every user look identical, so that hiding your IP address isn’t undone by your browser being individually recognisable. Anything that makes your setup unusual works against that.
- Don’t resize the window. It opens at a deliberate size shared with other users. Maximising it turns your screen dimensions into a distinguishing feature.
- Don’t install add-ons. Your particular combination is close to a name badge.
- Don’t improve the privacy settings. Unusual is the opposite of what you want.
- Don’t log into your normal accounts. Fastest way to undo all of it.
Updates
It’s built on Firefox and inherits Firefox’s security fixes. An old version means running with holes that are publicly documented and well known to anyone interested.
It checks for updates itself and prompts you. Take the prompt seriously. An update postponed indefinitely is usually the weakest thing about an otherwise careful setup.
Next
Now that it’s installed, read what Tor hides and what it doesn’t before you rely on it for anything, then developing good habits for what to actually do about those limits. If you’ve been wondering about addresses ending in .onion, that’s onion services. And the scams that keep coming back is worth reading before you go exploring.