Short answer: Tor is a routing overlay with a conservative threat model, not a cloak. It is generally lawful to run the browser in the EU and similar democracies; crime stays crime. It does not hide what you type, does not anonymize other apps, and does not make a random onion honest. Most popular “tips” (extra add-ons, country-picked exits, VPN as double anonymity) fight the design.
Legal geography: Is Tor legal in Europe?. Mechanics: What is Tor?. Practice: Tor Browser setup.
Myth: “Tor is illegal”
No EU member state is documented as banning Tor Browser as software. The United Kingdom likewise does not criminalise the client. What is unlawful on a normal connection stays unlawful on Tor. That is the Project’s own abuse framing: intent sits with the person, not the tool.
Friction is not a ban. Sites block exit IPs. Some ISPs filter the Project’s clearnet site. Russia and Belarus have censored or blocked parts of the public network; that is access control, not an EU statute. Relays, especially exits, are a separate legal and abuse-mail problem from browsing. None of that is legal advice — it is a map of public reporting. Details and sources: the legality explainer.
Myth: “Only criminals use Tor”
The network’s documented users include journalists, censored readers, researchers, and people who want less commercial tracking. Onion services power SecureDrop, OnionShare, and official mirrors for news and the Tor Project itself. Law-enforcement seizures of hidden services exist because the protocol is used in public jurisdictions, not because Tor relocates a shop outside the law. A tool used by both a reporter and a fraudster is still a tool.
Myth: “Tor makes me invisible”
Tor separates two observers: the local network sees a connection to a guard (or a bridge); the destination sees an exit IP (for clearnet) or cannot see a service IP (for onions). It does not stop:
- Logging into a named account
- Unique writing, timestamps, or file metadata
- Other applications on the same computer (they are not automatically proxied)
- A camera, a roommate, or malware
The Project’s staying-anonymous FAQ is explicit: perfect anonymity is not on offer. Fill-in forms are how people undo the network path. OPSEC is the name for that remainder.
Myth: “A VPN plus Tor is double anonymous”
A VPN is one provider who can see source and destination of that tunnel. Tor spreads knowledge across relays. Stacking them is a trust-model choice, not a multiplier.
VPN before Tor can hide Tor use from the local ISP and shifts logs to the VPN. Useful where Tor itself is conspicuous. It does not erase the VPN’s view of your IP, and a random unpaid “anonymous VPN” is often a new log point.
Tor before VPN is easy to misunderstand and rarely what marketing describes.
Neither stack fixes a personal login or a bad device. Full comparison: Tor vs VPN.
Myth: “I should pick my exit country”
Tor Browser’s identity manual discourages overriding path selection. The client’s guard and circuit rules exist to limit profiling and malicious-entry risk. Forcing an exit country shrinks the path set and can make you easier to distinguish. If the real goal is “this site only works in region X,” that is a geoblock problem — a VPN may solve it, with VPN properties, not Tor properties.
Myth: “JavaScript off means I am safe” / “I should add uBlock”
JavaScript is an attack and fingerprint surface, not the whole threat. Safest disables it by default and breaks many sites; Standard leaves it on so the browser remains usable. That trade-off is documented in the security levels guide and the plugins manual.
Extra add-ons — including popular blockers — make your Tor Browser unlike the others. The Project will not support those configurations. The bundled NoScript is the supported script control.
Myth: “.onion means trusted” / “HTTPS is optional on onions”
A v3 address authenticates the key. It does not certify the business, the newsroom, or the forum moderation. Clones generate their own keys. Prefix vanity is advertising, not a checksum of honesty.
Onion services already encrypt inside Tor (the Project analogizes this to getting HTTPS-like properties on the onion path). That still does not tell you which onion to open. Directory hygiene: finding verified onion links.
For clearnet sites reached through an exit, HTTPS remains the last hop. Without it, the exit can read or alter HTTP. HTTPS-Only Mode exists for that reason — not because Tor “already encrypted everything that matters.”
Myth: “Tor Browser protects my whole PC”
Only the browser’s traffic is routed through Tor unless you use a dedicated system (Tails, Whonix) or configure other apps yourself. A PDF opened in a host reader can fetch resources on your real IP. BitTorrent over Tor is a known leak and a burden on volunteers’ relays. Download warnings in Tor Browser are not decoration.
Myth: “Bridges make me more anonymous”
Bridges and pluggable transports (obfs4, Snowflake, meek) hide or disguise access to the network from a censoring or nosy local observer. They do not add extra onion layers against the destination. Publishing a private bridge widely burns it.
Myth: “If check.torproject.org is happy, I am done”
https://check.torproject.org/ confirms that this browser is using Tor. It does not audit other apps, extensions you added, or the honesty of the next onion you paste. It is a circuit smoke test, not an OPSEC sign-off.
A compact correction table
| Claim | Better model |
|---|---|
| Tor is a crime | Software is generally lawful; acts are judged separately |
| Invisible | Path metadata is separated; content and accounts are not |
| VPN + Tor = 2× | Extra trust point; sometimes useful, never automatic |
| Pick exit country | Leave path selection to Tor Browser |
| More extensions = safer | Uniqueness and extra bugs |
| Onion = verified | Key authentication ≠ operator authenticity |
| Bridges = more anonymity | Circumvention, not a new identity |
Sources
- Tor Project: Staying anonymous
- Tor Project: Does Tor enable criminal activity?
- Tor Project: Managing identities
- Tor Project: Plugins
- Tor Project: How do Onion Services work?