Short answer: A bridge is an entry relay that is not listed publicly. It helps against censorship, not deanonymization. Get bridges only from the Tor Project. Pluggable transports also change how the traffic looks.
An ISP or firewall can recognize public Tor relays from their address list. Bridges are relays that do not appear in that public list. They are a tool against censorship, not an extra anonymity layer.
What a bridge sees
Like a guard, the bridge sees your IP, not the actual destination of a correctly built connection. Circuit details are in Onion Routing.
Pluggable transports
A bare bridge can still be recognized as Tor traffic. Pluggable transports change the outer appearance:
- obfs4 makes the stream look random.
- Snowflake uses short-lived WebRTC proxies run by volunteers.
- meek wraps traffic so it looks like requests to large web services.
Glossary entries: Pluggable Transport, Bridge.
Where bridges come from
Get bridges through the Tor Project’s official channels (Tor Browser, website, documented mail or messaging paths). Unchecked “bridge lists” on forums are a classic way to steer users onto observed or fake entry points.
What bridges do not do
They do not make Tor faster. They do not replace a threat model. They do not legalize use. In some networks even the transport fails — then another network or another medium is often the only option.
Next step
If you do not have Tor Browser yet, start with Tor Browser setup. To sharpen the model, read OPSEC fundamentals.