Tor Browser utilizes the Tor network, which is a series of virtual tunnels, to allow people and groups to improve their privacy and security on the Internet. It also enables software developers to create new communication tools with built-in privacy features.

How does the Tor Browser keep my internet activity anonymous?

The Tor Browser uses the Tor network, which consists of more than six thousand relays located worldwide, to hide the users' location and online traffic. This ensures anonymity and avoids your activities from being seen by others.

What is Tor Browser?

The Tor Browser is the flagship product from the Tor Project. The web browser is based on a modified version of Mozilla Firefox ESR that includes extras like the Tor proxy, TorButton, TorLauncher, NoScript, and HTTPS Everywhere extensions.

Who uses the Tor Browser?

With Tor Browser having made Tor more accessible to everyday internet users and activists, Tor was an instrumental tool during the Arab Spring beginning in late 2010. It not only protected people's identity online but also allowed them to access critical resources, social media, and websites which were blocked.

Individuals use Tor to keep websites from tracking them and their family members, or to connect to news sites, instant messaging services, or the like when these are blocked by their local Internet providers. Tor's hidden services let users publish web sites and other services without needing to reveal the location of the site. Individuals also use Tor for socially sensitive communication: chat rooms and web forums for rape and abuse survivors, or people with illnesses.

Journalists use Tor to communicate more safely with whistleblowers and dissidents. Non-governmental organizations (NGOs) use Tor to allow their workers to connect to their home website while they're in a foreign country, without notifying everybody nearby that they're working with that organization.

Groups such as Indymedia recommend Tor for safeguarding their members' online privacy and security. Activist groups like the Electronic Frontier Foundation (EFF) recommend Tor as a mechanism for maintaining civil liberties online. Corporations use Tor as a safe way to conduct competitive analysis, and to protect sensitive procurement patterns from eavesdroppers. They also use it to replace traditional VPNs, which reveal the exact amount and timing of communication. Which locations have employees working late? Which locations have employees consulting job-hunting websites? Which research divisions are communicating with the company's patent lawyers?

A branch of the U.S. Navy uses Tor for open source intelligence gathering, and one of its teams used Tor while deployed in the Middle East recently. Law enforcement uses Tor for visiting or surveilling web sites without leaving government IP addresses in their web logs, and for security during sting operations.

Is Tor better than a VPN?

Tor is not a VPN. Tor is a free browser similar to Chrome or Firefox, but it includes features that encrypt your IP address, making your browsing sessions private. A VPN (Virtual Private Network) is software that can change your IP address when you use any browser installed on your PC. To learn more about VPNs, you can read this article.

What's New

The full changelog since Tor Browser 14.0 is:

All Platforms

Updated Tor to 0.4.8.13

  • Bug tor-browser#43231: Rebase Tor Browser 128-based stable and alpha onto 128.4.0esr
  • Bug tor-browser#43240: Backport security fixes from Firefox 132

Windows + macOS + Linux

  • Updated Firefox to 128.4.0esr

Android

  • Updated GeckoView to 128.4.0esr
  • Build SystemAll Platforms
  • Bug tor-browser-build#41289: Fix single-browser in relprep.py

Linux

  • Bug tor-browser-build#41282: Add SSL to our custom Python for MozBug 1924022

Previous Release Notes:

All Platforms

  • Bug tor-browser#30543: compat: make spoofed orientation reflect spoofed screen dimensions
  • Bug tor-browser#30862: 10ms time precision via EXSLT date-time function
  • Bug tor-browser#41328: Follow firefox ESMify for Bug 1308512
  • Bug tor-browser#42054: ESR128: investigate - thorin's list
  • Bug tor-browser#42220: Flip all the possible preferences to prevent any automatic download
  • Bug tor-browser#42255: pdfjs.disabled used to be part of RFP until Bug 1838415; lock pref to false in stable
  • Bug tor-browser#42356: Review 000-tor-browser.js and 001-base-profile.js for 128
  • Bug tor-browser#42601: Check Bug 1894779: Allow font-face urls to be resource:// urls and relax CORS for resource:// URLs
  • Bug tor-browser#42611: Set clipboard.imageAsFile.enabled to false
  • Bug tor-browser#42646: Drop patch for tor-browser#40166
  • Bug tor-browser#42683: Create script to generate issue triage csv's from bugzilla query and git scraping
  • Bug tor-browser#42684: Disable network prefetch
  • Bug tor-browser#42685: compat: ESR128: enable textmetrics
  • Bug tor-browser#42716: Disable unwanted about:* pages
  • Bug tor-browser#42730: Make RemoteSettings use only local dumps
  • Bug tor-browser#42746: Extend prefers-contrast rules to include forced-colors
  • Bug tor-browser#42759: CI: remove localization file names that are in neither 14.0 nor 13.5 branches
  • Bug tor-browser#42814: Opt out from Firefox relay by default.
  • Bug tor-browser#42830: Enable WebAudio APIs
  • Bug tor-browser#42831: Remove the shopping components
  • Bug tor-browser#42867: Disable contentRelevancy component
  • Bug tor-browser#43011: Ship only one copy of the MIT license, like upstream.
  • Bug tor-browser#43012: Mixed content: browser requests HTTPS images from onion domain accessed via HTTP
  • Bug tor-browser#43013: security.mixed_content.upgrade_display_content.image is true by default
  • Bug tor-browser#43054: check bounceTrackingProtection in PB mode does not persist to disk
  • Bug tor-browser#43074: Pass the browser to TorDomainIsolator.newCircuitForBrowser
  • Bug tor-browser#43144: Ensure non-privacy browsing also sets the GPC header
  • Bug tor-browser#43163: Disable offscreen canvas until verified it is not fingerprintable
  • Bug tor-browser#43170: Disable user-agent spoofing in HTTP header
  • Bug tor-browser#43178: Audit fingerprinting overrides (MozBug 1834274)
  • Bug tor-browser#43184: Backport Bugzilla 1922294: RFP: fixup square spoofed orientation
  • Bug tor-browser#43197: Disable automatic exception for HTTPS-First

Windows + macOS + Linux

  • Updated Firefox to 128.3.0esr
  • Updated NoScript to 11.4.42
  • Bug tor-browser#40147: Re-enable Picture-in-Picture mode
  • Bug tor-browser#41309: Re-enable screenshots component
  • Bug tor-browser#41811: Primary buttons that result in a connection attempt should be purple
  • Bug tor-browser#41817: Add more color aliases that take dark mode into account
  • Bug tor-browser#41820: Downloads warning styling improvements (use moz-message-bar)
  • Bug tor-browser#42070: Backport Bugzilla 1834307 and hide smooth-scroll UX
  • Bug tor-browser#42212: Fluent migration: onion services
  • Bug tor-browser#42362: "New window" missing from File menu
  • Bug tor-browser#42441: Evaluate RR version-by-RR version rebases instead of ESR-to-ESR
  • Bug tor-browser#42488: ESR 128: Remove role="code" from tor circuit panel
  • Bug tor-browser#42603: Remove safebrowsing URLs
  • Bug tor-browser#42612: Re-implement moz-toggle customizations for ESR 128
  • Bug tor-browser#42617: Restore the HTML form on DDG when using safest in 128
  • Bug tor-browser#42629: Tweak isOnNewTabPage patch
  • Bug tor-browser#42630: Review LaterRun in 128
  • Bug tor-browser#42640: Disable Firefox Flame button due to unknown interactions with New Identity
  • Bug tor-browser#42641: Move from panel-footer class to moz-button-group
  • Bug tor-browser#42643: downloads panel separator has mismatched margin
  • Bug tor-browser#42644: toolbar rules in panelUI-shared.css are unneccessary
  • Bug tor-browser#42647: "Switching to a new device" regressed on 128
  • Bug tor-browser#42653: The Neterror page has a checkbox to report iframe origin errors to TPO
  • Bug tor-browser#42662: Use data-hidden-from-search for hiding the firefox connection settings
  • Bug tor-browser#42663: Tor Browser "Connection" settings missing a tooltip
  • Bug tor-browser#42665: Drop "Learn More" spacing
  • Bug tor-browser#42667: Add description-deemphasized class to our additions to about:preferences
  • Bug tor-browser#42679: Use a more robust approach to hide the "tracking protection" urlbar button
  • Bug tor-browser#42687: Disable Privacy-Preserving Attribution
  • Bug tor-browser#42695: Use --arrowpanel- variables for tor circuit panel spacing
  • Bug tor-browser#42698: Bridge card background contrast is low for bridge-moji
  • Bug tor-browser#42699: Drop level="top" attribute from panels
  • Bug tor-browser#42700: Remove !nodes condition from gTorCircuitPanel._updateCurrentBrowser
  • Bug tor-browser#42704: Drop the badged="true" attribute from security level button
  • Bug tor-browser#42705: Update our preferences to account for new line height
  • Bug tor-browser#42713: Some --in-content CSS variables were renamed/removed
  • Bug tor-browser#42718: Remove the firefox-view button from UI, even when always-on private-browsing mode is disabled
  • Bug tor-browser#42735: Disable recent search suggestions
  • Bug tor-browser#42740: Stop trying to hide "Restore previous session"
  • Bug tor-browser#42742: Inconsistent use of "New private window" vs "New window"
  • Bug tor-browser#42743: Invalid onion sites are shown as secure in the page info window
  • Bug tor-browser#42744: Light theme override for "about:tor" is inherited by chrome error pages.
  • Bug tor-browser#42745: Remove some residuals from update scripts
  • Bug tor-browser#42764: Unconditionally disable find-bar transition animation
  • Bug tor-browser#42777: Remove 'Website Privacy Preferences' and ensure sensible default prefs
  • Bug tor-browser#42803: Lost focus styling for built-in bridges radio options
  • Bug tor-browser#42806: Use the lh CSS unit
  • Bug tor-browser#42872: Disable translations until audited and solved the UX problems
  • Bug tor-browser#43015: Missing region-name-skr fluent entry when fetching TorConnect country names
  • Bug tor-browser#43067: Use html:link rather than xml-stylesheet in our dialogs
  • Bug tor-browser#43071: Make sure "tor-button" elements that are also "primary" still use the tor colors
  • Bug tor-browser#43072: moz-message-bar does not get announced on Orca screen-reader
  • Bug tor-browser#43075: Should we drop link spacing in about:tor
  • Bug tor-browser#43081: Remove hard-coded CSS line-height
  • Bug tor-browser#43082: Search engine icon is not shown while typing in the address bar
  • Bug tor-browser#43083: Backport fix for Mozilla 1436462
  • Bug tor-browser#43087: Onion pattern on about:torconnect needs a dark theme asset
  • Bug tor-browser#43103: Verify whether an update is unsupported before choosing one
  • Bug tor-browser#43104: Local files and extensions can't be loaded in new windows before bootstrap
  • Bug tor-browser#43105: Migrating Disconnect is not needed anymore
  • Bug tor-browser#43109: Remove mention of Firefox Relay from settings
  • Bug tor-browser#43115: Height of search bar has collapsed on about:tor
  • Bug tor-browser#43117: Hide 'Always underline links' option
  • Bug tor-browser#43118: hide CFR
  • Bug tor-browser#43131: Reduce layout jank when loading about:tor
  • Bug tor-browser#43134: Backport Bugzilla 1436226 Hardcode VP8/VP9
  • Bug tor-browser#43164: Prevent search-bar from being auto-hidden when not used for awhile
  • Bug tor-browser#43169: compat: align userAgent in navigator + HTTP Header
  • Bug tor-browser#43174: Issue with custom home page on local filesystem
  • Bug tor-browser#43209: UI freezes when clipboard is empty after screen lock
  • Bug tor-browser#43217: Fullscreen videos have rounded letterboxing corners
  • Bug tor-browser#43218: Switch to browser.reload, since Browser:Reload signal was dropped upstream
  • Bug tor-browser-build#41248: Check and update bundled font versions

Windows + macOS

  • Bug tor-browser#43021: Revert the OS deprecation notification introduced in #42347

macOS + Linux

  • Bug tor-browser#42467: Make OS HTTP User-Agent OS spoofing configurable by pref

Windows

  • Bug tor-browser#43051: windows: remove UI for "open Tor Browser automatically when computer starts"

macOS

  • Bug tor-browser#42494: mac: add Arial Black and Arial Narrow to allowlist

Linux

  • Bug tor-browser#42702: Cannot access the clipboard for the crypto address check (wayland)
  • Bug tor-browser#42773: Replace ~ with the original HOME
  • Bug tor-browser#43092: Disable Wayland by default in 14.0
  • Bug tor-browser#43101: Security features warning links to Firefox installation support page with incomplete info
  • Bug tor-browser#43141: Hardcode Arimo as a system-ui font
  • Bug tor-browser#43196: Remove the vendor name from the "is playing media" notification on Linux
  • Bug tor-browser-build#41237: Add some aliases to our Linux font config for compatibility

Regular readers of our release posts will know that for the past two years we've been gradually increasing our capacity to not only maintain, but bring tangible improvements to Tor Browser for Android. In that respect, Tor Browser 13.5 feels like a milestone: in addition to the dozens of bug fixes and minor improvements noted in the changelog below, this release features major changes to Android's connection experience in preparation for the future addition of Connection Assist, including full access to Settings before connecting and a new, permanent home for Tor logs.

For desktop, we're continuing our efforts to improve the user experience of Tor Browser's fingerprinting protections. Following the changes we introduced to new window sizes in Tor Browser 13.0 for Desktop, this release features welcome design changes to letterboxing, including new options to remember your last used window size and adjust the alignment of the letterbox in General Settings. Bridge users will also discover a myriad of improvements to bridge settings, including a complete redesign of bridge cards with improved sharing features, and a new section designed to help you find more bridges elsewhere. Lastly, the design of onion site errors has received a visual refresh aimed at making them consistent with the other kinds of Network Errors you can find in Tor Browser.

What's new for Android?

New connection experience

We've completely replaced Tor Browser for Android's connection screens with a new, "native" implementation. This is a welcome and necessary first step in our longer-term efforts to bring Connection Assist – a feature which can circumvent censorship of the Tor network automatically – to Android in a future major release. However, while we await Connection Assist's arrival, Tor Browser's new connection screens already offer a series of small improvements for Android users.

In order to establish a firm foundation on which we can expand Android's connection features in future, these screens have also been made more consistent with desktop. Ultimately, it's our hope that a user who can successfully circumvent censorship on desktop will be able to pick Android up without needing to relearn how it works.

In addition to a visual refresh, you can now enable the option to connect automatically (based on your last used connection settings) when the app is launched. Plus, you can also access the full settings menu before connecting to Tor – either by tapping the settings icon, or via the new button to "Configure connection" – where you can find the new Tor logs too (more on that below!).

A permanent home for Tor logs

As many of you may know, Tor Browser maintains a log of Tor's background activity to help troubleshoot issues when they occur. Tor logs don't contain any sensitive information about your browsing activity, but simply reveal what Tor is trying to do behind the scenes – for example, these logs typically include a record of Tor's bootstrapping progress, plus any warnings or errors as they occur.

Should a user run into a problem and contact support, we may request a copy of your Tor logs to help them diagnose the issue. However, in previous versions of Tor Browser for Android, Tor logs could only be found by swiping to the side during the connection sequence. This meant that once Tor Browser had established a successful connection, users were unable to return to this screen to view and copy their Tor logs.

To address this issue, we've rebuilt and relocated Tor logs to a new section within Settings called "Connection Settings" – which is exactly where you can find Tor logs on desktop too. Given that the settings menu can now be accessed regardless of your connection status, this means that you can retrieve your Tor logs at any point while using Tor Browser. And finally, there's a handy button you can use to copy all logs without needing to fiddle around with selecting text.

What's new for desktop?

Introducing Betterboxing

"What are those gray bars?" is a question we get so frequently from new users, that it has its own entry on our support website. And the answer is: the letterbox!

To recap, letterboxing was introduced in Tor Browser 9.0 to allow users to resize their browser window without fear of being fingerprinted by rounding the inner content window (sometimes referred to as the "viewport") down to the nearest hundred pixels. This technique works by grouping the window sizes of most users into a series of common "buckets", protecting individual users within those buckets from being singled-out based on their window or screen size.

Although the existing implementation of letterboxing works excellently to protect you from fingerprinting, its visual design would often be misinterpreted by new users either as a bug with the browser or rendering issue with the website they're browsing. Based on the user feedback we've collected online, in our user research activities and during training sessions we've identified the following issues:

  • The design doesn't look very deliberate, hence users who misinterpret the letterbox as browser breakage instead. In response we've given the visual design of the letterbox a little polish – however the elements we've introduced have been kept deliberately subtle so as to avoid distracting you from the content you're actually trying to view.
  • Letterboxing as a feature isn't acknowledged anywhere in Settings, because in the past, there were no additional options to configure. Beginning in this release, you can now find a new letterboxing section in General Settings, including the options to remember your last known window size and choose whether you prefer the letterbox to be aligned to the top or middle of your browser window.

Pro tip: if, like me, you find yourself manually resizing Tor Browser to hide the margins letterboxing has introduced – you can now double-click within the letterbox margin to snap Tor Browser down to its next window size.

Even better bridge settings

Bridge users will notice a series of refinements coming to Connection Settings in this release, aimed at helping censored users find working bridges and improve the management of multiple bridges when added.

Bridge cards, first launched in Tor browser 11.5, are now displayed in a single, more compact card rather than the previous stacks of cards. To help you remember where your bridges came from, the new bridge cards also come pre-labelled with the source of your bridges, be they built in, requested from Tor, or added by you. Finally, when you have three or fewer bridge cards added, you can now share all of them at once instead of the previously fiddlesome process of sharing one at a time.

When Tor Browser's built-in options don't cut it, you can also find a new "Find more bridges" section which points the way to additional channels where censored users may retrieve bridges – including Telegram, the "Get Bridges" website, and via email. The existing ability to "Request a bridge" has been moved here too, allowing users to retrieve bridges from Tor Browser's built-in bridge bot without needing to connect to Tor first.

Simplified onion site errors

Unless you're perfect, you've probably misspelled a website's address at some point and landed on an error screen instead. The user-friendly messages you receive when you run into an issue like this are known as Network Errors, or neterrors for short, and were introduced to Firefox all the way back in version 1.5.

For the last few years onion site errors have appeared different from other types of neterrors in Tor Browser. Although the design decisions behind this change were well intentioned, they sometimes led to confusion about the source of the issue. In response, we've simplified the design of our onion site errors and made the user experience consistent with other types of neterrors you may encounter while you surf the onionverse.

Release notes

Tor Browser 13.5 will be the final major version of Tor Browser to support Windows 8.1 and older, and macOS 10.14 and older

Keeping Tor Browser up to date is critical to maintaining your privacy, security and anonymity. However following Tor Browser 14.0's release in Q4 this year, users of these platforms will no longer receive important updates. Therefore we strongly encourage affected users to update their systems to supported versions of Windows and macOS before the next release, and users running older versions of Windows and macOS will begin seeing messages to this effect in Tor Browser.