Menu
Independent Tor encyclopedia Learn
Learn

Tor Bridges: obfs4, Snowflake, meek, and WebTunnel

Tor bridges explained: unlisted entry relays, Connection Assist, and when obfs4, Snowflake, meek, or WebTunnel help. Get bridges only from the Tor Project.

Author
Published
Last reviewed
Level
Advanced
Reading time
8 min
Ordinary Tor entry versus a bridge Two paths. Ordinary: you enter through a listed guard and the ISP can recognize a public relay. Censored: you enter through an unlisted bridge; the ISP sees that bridge, not a directory listing. ORDINARY You Listed guard Circuit ISP: listed relay CENSORED You Bridge Circuit ISP: a bridge Connection Assist can pick the transport. Get the bridge only from the Tor Project. ORDINARY You → listed guard → circuit ISP sees a public relay CENSORED You → unlisted bridge → circuit ISP sees a bridge, not a directory Connection Assist picks the transport. Get the bridge only from the Tor Project.
A bridge is an unlisted entry. It hides that you are using Tor from a censor, not who you are from a later hop. Get bridges only from the Tor Project.

Short answer: A bridge is an entry relay that is not listed publicly. It helps against censorship, not deanonymization. Get bridges only from the Tor Project. Pluggable transports also change how the traffic looks.

An ISP or firewall can recognize public Tor relays from their address list. Bridges are relays that do not appear in that public list. They are a tool against censorship, not an extra anonymity layer.

What a bridge sees

Like a guard, the bridge sees your IP, not the actual destination of a correctly built connection. Circuit details are in Onion Routing.

Pluggable transports

A bare bridge can still be recognized as Tor traffic. Pluggable transports change the outer appearance. The Project’s 2026 circumvention table lists four built-in transports:

  • obfs4 makes the stream look random and resists address scanning.
  • Snowflake uses short-lived WebRTC proxies run by volunteers (the docs analogize this to a video call).
  • meek wraps traffic so it looks like requests to a large CDN or cloud site.
  • WebTunnel masks the connection so it looks like ordinary HTTPS to a webpage. Support for WebTunnel is documented on Tor Browser for Desktop and Android, Tails, and Tor VPN Beta.

Lyrebird is the program inside Tor Browser that implements those transports, can request bridges, and supports Connection Assist.

Glossary entries: Pluggable Transport, Bridge.

Connection Assist

If a direct connect fails, Connection Assist can try a bridge or Snowflake for your region. On first launch, if the status bar sticks, try Assist — or pick your region from the dropdown and “Try a Bridge” when location detection fails. Android has the same offer when a direct circuit will not build.

Assist is an automatic pick, not extra anonymity. If it fails, configure a transport yourself (built-in obfs4 / WebTunnel / Snowflake / meek) or paste bridges from an official channel: the bridges website (advanced options → WebTunnel), Telegram @GetBridgesBot (/obfs4 or /webtunnel), or bridges@torproject.org from Gmail or Riseup.

Obtaining the browser when torproject.org is blocked is a different door: GetTor.

Where bridges come from

Get bridges through the Tor Project’s official channels (Tor Browser, website, documented mail or messaging paths). Unchecked “bridge lists” on forums are a classic way to steer users onto observed or fake entry points.

What bridges do not do

They do not make Tor faster. They do not replace a threat model. They do not legalize use. In some networks even the transport fails — then another network or another medium is often the only option.

Next step

If you do not have Tor Browser yet, start with Tor Browser setup. To sharpen the model, read OPSEC fundamentals.

Sources