Short answer: The shield icon is a three-step trade-off, not a “make me anonymous” slider. Standard keeps sites working. Safer turns off JavaScript on non-HTTPS pages and click-to-plays media. Safest disables JavaScript everywhere by default. Extra extensions and about:config tweaks make you look unique. Pick a level for your threat model, then leave the rest of the browser alone.
Setup (download, signatures, first connect) lives in Tor Browser setup. This page is the settings layer: what the three levels change, what bundled NoScript is for, and which “hardening” habits the Tor Project warns against.
Why a security level exists
Tor Browser is a Firefox ESR build with a shared fingerprint. The Project’s threat model assumes many users look alike. Interactive web features — JavaScript, unusual fonts, autoplaying media — are useful to sites and also useful to attackers who want to exploit the browser or measure it.
A security level is a preset that disables classes of those features. It is not a second network. It does not hide a personal login, a unique writing style, or a compromised operating system. Those belong in OPSEC fundamentals.
Changing the level requires a restart. That is intentional: the preset is applied as a whole, not as a pile of one-off toggles that drift over time.
Standard
This is the default. All Tor Browser and website features the Project ships stay enabled. JavaScript runs. HTML5 media plays. Fonts and images load.
Use Standard when the goal is ordinary browsing through Tor: reading news, reaching an onion service, or using a site that will simply not render without scripts. Most people should start here. The fingerprint pool is largest at this level because that is how the browser ships.
Standard is not “insecure.” HTTPS-Only Mode still prefers encrypted connections to clearnet sites. The circuit still hides the connection IP from the destination. What Standard does not do is shrink the browser’s attack surface as far as Safer or Safest.
Safer
Safer disables features the Project treats as frequently dangerous. The official manual lists three visible effects:
- JavaScript is disabled on non-HTTPS sites.
- Some fonts and math symbols are disabled.
- Audio and video (HTML5 media) become click-to-play.
Sites that only work over HTTPS and need scripts still run those scripts. HTTP pages lose JavaScript. That pairing matters: an exit node can see and alter unencrypted HTTP. Removing scripts from those pages removes a common way to exploit the browser on a hop you do not control.
Expect broken players, missing icons, and layout that assumes webfonts. If a page is unusable, that is the trade-off working — not a reason to install an ad-blocker “to compensate.”
Safest
Safest keeps only what static pages and basic services need. The manual’s list:
- JavaScript is disabled by default on all sites.
- Some fonts, icons, math symbols, and images are disabled.
- Audio and video remain click-to-play.
Safest is the right default when the destination is a simple onion page, a signed document, or a newsroom drop box that does not need a rich app. It is a poor default for JavaScript-heavy mail or search UIs: they will look broken, and the usual “fix” (turning scripts back on per site through NoScript) is how people accidentally recreate a unique configuration.
If you need Safest for one task and Standard for another, use two separate sessions or New Identity between roles — do not keep a mixed NoScript allow-list that only you have.
How to change the level
Desktop: click the shield next to the URL bar, open Security Level settings, choose Standard / Safer / Safest, save, and restart.
Android: kebab menu (three dots) → Privacy and security → Security Level → save and restart. The three names match desktop.
Menu labels move between releases. The Tor Browser User Manual is the authority when the UI shifts.
NoScript is already there
Tor Browser ships NoScript. It is how Safer and Safest enforce script policy. You can show its toolbar button from Add-ons and themes, then allow or block scripts per site.
That per-site panel is a power tool, not a second security level. A custom allow-list is a fingerprint. The Project’s own FAQ is blunt: they leave JavaScript on at Standard because otherwise most people would abandon Tor; people who need it off should use Safer or Safest, not a unique NoScript profile copied from a forum post.
Do not replace NoScript with another blocker. Do not add uBlock Origin, Stylus, or “privacy” extensions. The manual’s plugins page states that only the bundled add-ons are tested, that extra add-ons can break Tor Browser or leak, and that a unique fingerprint can be tracked even though the connection still uses Tor.
HTTPS-Only and the padlock
Tor encrypts traffic to and inside the network. Encryption to the destination still depends on that destination. Tor Browser includes HTTPS-Only Mode so clearnet sites that support HTTPS are forced onto it.
For sensitive forms, check the URL bar: https://, a padlock (or onion icon on an onion service), and the name you expected. Onion services already provide end-to-end encryption inside Tor; HTTPS on a clearnet site is the analogous last hop. Details: What is Tor?.
New Identity and New Circuit
These are not security levels. They are session controls from the hamburger menu (and the circuit diagram in the site-information panel).
New Identity closes all tabs and windows, clears cookies and history, and builds new circuits. Use it when the next task must not be linkable to the previous one. Downloads in progress stop. It cannot unsend a form you already posted.
New Tor Circuit for this Site reloads the current site over a new path. Other sites stay on their circuits. Cookies stay. Use it when an exit cannot reach a clearnet page, not as a substitute for a new role.
You cannot usefully “pick an exit country.” The Project discourages overriding entry or exit selection; the security of the design depends on leaving path choice to the client. Geoblocking is a VPN problem, not a Tor Browser setting — see Tor vs VPN.
What not to change
| Habit | Why it fails |
|---|---|
| Extra Firefox add-ons or themes | Untested; unique fingerprint; new attack surface |
about:config “hardening” lists | Same uniqueness problem, undocumented interactions |
| Portable third-party Tor bundles | Classic malware vector — see phishing detection |
| Opening downloaded Office/PDF files in host apps while online | Those apps fetch resources outside Tor |
| BitTorrent “over Tor” | Clients leak IPs and overload the network |
Only Tor Browser’s own traffic uses Tor. Other apps on the same computer do not, unless they are configured separately — or you use a system that forces the path, such as Tails or Whonix.
A simple decision rule
- Everyday research and onion sites that need scripts: Standard.
- Untrusted HTTP, or you want a smaller script surface without breaking HTTPS apps: Safer.
- Static pages, high-risk reading, or you accept that most web apps will fail: Safest.
- After the choice: bookmark verified addresses, do not add extensions, keep the browser updated.
If the fact of Tor use itself must stay hidden from the local network, that is a bridge problem, not a security-level problem.
Sources
- Tor Project: Security settings
- Tor Project: Plugins and JavaScript
- Tor Project: Managing identities
- Tor Project: Staying anonymous