Getting Tor installed is the easy part, and most guides stop there. What separates a setup that works from one still working in three years is a handful of habits nobody puts in the installation walkthrough, because they aren’t steps. They’re things you keep doing.
Here they are. Some will sound obvious once said out loud. Most people have never had them said out loud.
Keep your identities apart
The one that matters most, and the one most often ignored.
If you use Tor for more than one thing, don’t let those things touch. A persona on a forum shouldn’t share a password, a turn of phrase, an email address or a browsing session with anything attached to your real name. The moment two of your identities occupy the same tab, the same login, or the same ten minutes, they become linkable. Linkable is the same as identified.
In practice: separate accounts for separate purposes, never signed in at once. If you wouldn’t want two things connected in public, don’t connect them yourself in private.
Use New Identity like it’s there for a reason
There’s a New Identity option in Tor Browser’s menu and almost nobody touches it. It closes every tab, clears cookies, and gives you a fresh path through the network, so nothing about the next session can be tied to the last.
Use it whenever you move between things that shouldn’t be connected. Finished one task, starting something unrelated — that’s the moment. There’s a lighter version too, New Circuit for this Site, which changes the relay path for one tab without clearing everything, handy when a particular site is being difficult rather than when you need a clean break.
Neither is a reset button. They change your route and clear local traces. They don’t retract anything you’ve already told a website about yourself. But they’re two of the very few controls you actually have, and they mostly sit unused.
Don’t bring your habits with you
Writing style, posting hours, the subjects you keep returning to — all fingerprints, none cleared by software. This came up in what Tor hides and what it doesn’t, and it belongs here too, because it isn’t a warning you heed once. It’s a discipline.
Concretely: if a persona is meant to be separate from you, don’t write in it the way you write everywhere else. Don’t mention the same specific details you mention under your own name. Don’t keep it open during the hours you keep everything else open, if you can manage that. None of this has to be perfect. It has to be a habit you actually keep, because what catches people is rarely dramatic. It’s small carelessness, repeated.
Strip metadata before you send anything
Left out of almost every guide, and it has cost people more than most things on this list.
Photos taken on a phone routinely carry the exact coordinates of where they were taken, written into the file itself, invisible unless you go looking. Documents carry the name of whoever’s computer made them, sometimes a real name, sitting in the file properties. You can’t see any of it by opening the photo or reading the document. All of it travels with the file.
Before sharing a photo or document through anything not tied to your real identity, get rid of it. Screenshotting a photo instead of sending the original usually does the job, since the screenshot has no history. For documents, print to PDF rather than sending the source file, then check the PDF’s own properties, because some carry the author name straight through. There are dedicated tools if you do this often enough to want one.
The machine is part of the picture
Tor protects a connection. It has nothing to say about the computer making it, and a well-configured browser on a badly kept machine is thinner cover than it looks.
Keep the operating system updated, same as the browser. Turn on full-disk encryption if your device offers it, so the contents mean nothing to whoever ends up holding it. If what you’re doing genuinely warrants the effort, a separate device — or at least a separate user account used for nothing else — keeps sensitive work from sharing storage with your ordinary life.
Where the stakes justify it, there’s Tails, an operating system you boot from a USB stick that forces everything through Tor and leaves nothing behind when you shut down. Most people don’t need it. It exists for the people who do, and knowing it’s there is useful even if you never use it.
Ask yourself occasionally what you’re defending against
Which habits are worth keeping depends entirely on what you’re trying to prevent, and for most people that shifts over time without them noticing. A reasonable setup for keeping your provider out of your business is not the setup a source protecting a journalist needs. Treating every situation identically means doing either far more than necessary or far less.
That question deserves its own article and will get one. Short version for now: check in with yourself now and then about what you’re actually defending against, and whether your habits still match the answer.
None of this is a checklist
Every item is something to keep doing, not something to do once and tick off. That’s the real difference between a setup that works on day one and one still working years later. The technology holds up fine. What stops holding up is attention.
Next
What Tor hides and what it doesn’t covers the limits these habits are built around. Installing Tor Browser is where the security level and update habits get set in the first place.