Menu
Independent Tor encyclopedia Guides
Guides

Tor + HTTPS: What the Exit Sees

What a Tor exit can read without HTTPS, what it still sees with HTTPS, and why an onion service has no public exit. Tor and TLS do different jobs.

Author
Published
Last reviewed
Level
Beginner
Reading time
5 min
What the exit and the site can see Three paths. On HTTP the exit can read the page. On HTTPS it sees the host, not the content. An onion service has no public exit and the site never sees a client IP. STATE YOU → HOPS → EXIT THAT HOP SEES THE SITE 01 HTTP The page Exit IP 02 HTTPS Host only Exit IP 03 Onion No exit No client IP 01 HTTP EXIT SEES The page THE SITE Exit IP 02 HTTPS EXIT SEES Host only THE SITE Exit IP 03 Onion EXIT SEES No exit THE SITE No client IP
Check the URL bar for https:// before you type. Tor hides your IP from the site; HTTPS hides the page from the exit. An onion service has no public exit.

Short answer: Tor encrypts to and inside the network. Encryption to the website is still HTTPS. Without it, the exit can read or alter HTTP. With it, the exit still sees which host you asked for — not the page, password, or form. An onion service never uses a public exit.

This is the EFF picture, not a myth dump. Broader claims: Tor myths. Mechanics: onion routing.

Three pictures

Tor, no HTTPS. The circuit hides your connection IP from the site. The last hop opens a plain HTTP connection. That hop can see the path, the body, and cookies. Certificate warnings do not apply because there is no certificate. Do not type anything sensitive on that page.

Tor + HTTPS. TLS is negotiated between Tor Browser and the site, through the circuit. The exit forwards ciphertext. It still sees destination IP, port, time, and volume. It should not see the page. Watch the URL bar: https://, a padlock, and the name you expected. Tor Browser’s HTTPS-Only Mode exists to force that upgrade when the site supports it.

Onion service. Both ends stay in Tor. There is no public exit to read a last hop. The v3 address authenticates the service key. That is not a honesty badge — clones generate their own keys. Directory hygiene: verified onion links.

What to check before you type

  1. URL bar shows https:// and the host you intended — not a look-alike.
  2. Prefer the site’s published onion when you already trust the channel that published it.
  3. Leave HTTPS-Only Mode on (Tor Browser default on current builds) so plain HTTP is upgraded or blocked when the site supports TLS.

What this does not fix

HTTPS does not hide the fact of Tor from the local network. Bridges do that work: Tor bridges. HTTPS does not anonymize a login. And a file you then open in a host app can still leave Tor: don’t open downloaded files while online.

The Project’s staying-anonymous page points at EFF’s graphic for this exact split. Use both tools on the clearnet. Use an onion when the operator publishes one on a channel you already trust.

Sources

See also: why torrent and Tor don’t mix, don’t open downloaded files while online, New Identity vs New Circuit.