Dark Web

Can You Be Tracked on Tor?

Tor is the best-known privacy tool on the internet — and the most misunderstood. It hides your address from the websites you visit, but it does not make you invisible, and it was never designed to. The honest answer to "can you be tracked on Tor" is: it depends on who is watching, what you do, and what you mean by tracked.

By Abdul Hannan · Published 14 November 2026 · Updated 14 November 2026

Try the tool: Who Sees What? Packet Journey

The short answer. Tor hides your address, not your behaviour. If you log in, download, or reveal information about yourself, you can be identified. Tor makes tracing harder — it does not make it impossible.

Who sees what: the full picture

The clearest way to understand Tor tracking is to ask, for each party in the chain, what exactly they can see. Here is the picture for an ordinary website visit through Tor, with HTTPS:

Who is watching	Sees your real address?	Sees the website?	Sees the content?
Your internet provider	Yes — it is your provider	No — only that you use Tor	No — encrypted
Guard relay	Yes	No	No
Middle relay	No	No	No
Exit relay	No	Yes	Only if the site is not HTTPS
The website	No — sees the exit relay	It is the website	Yes — you sent it

Read that table carefully, because it contains the whole answer. Nobody in the chain sees both your address and your destination except you. But several parties see one half of the picture — and the website sees everything you choose to tell it.

What your internet provider sees

Your provider sees that you are using Tor. The connection to the guard relay is visible to it, as is the timing and the volume of your traffic. What it cannot see is which websites you visit or what you do there — that information is wrapped in Tor's encryption layers.

That matters in two ways. In most countries, using Tor is legal and your provider does not care. But in countries where Tor is blocked or restricted, the fact that you use it is itself visible and can draw attention. Tor hides what you do, not that you do it.

What the relays see

Each relay sees only its neighbours, by design. The guard relay knows your address but not your destination. The middle relay knows neither. The exit relay knows the destination but not who you are. To learn both ends of a connection, an attacker would need to control or observe both the guard relay and the exit relay of the same circuit — and circuits are chosen at random from thousands of volunteer relays.

The exit relay deserves a second look, because it is the one place where your traffic becomes readable. If the website you visit does not use HTTPS, the exit relay can see the content of what passes through it. Tor does not encrypt the final hop — that is the website's job. This is why using unencrypted sites over Tor is more dangerous than using them normally: the exit relay is a stranger, and you have no way to know whether it is honest.

What the website sees

A website you visit through Tor sees the exit relay's address, not yours. It cannot tell where you are from the connection alone. But it sees everything you do on the site — and everything you do can identify you:

Logging in. The moment you log in to an account, the site knows who you are. Tor cannot hide an identity you hand over voluntarily.
Your behaviour. Writing style, typing patterns, the times you are active, the things you search for — all of these can link sessions together, even without an address.
Downloads. A document can contain identifying details, and opening it outside Tor Browser can reveal your real address.
Scripts and plugins. Scripts, media players and browser extensions can leak information about your device and your real connection. Tor Browser blocks or limits these by default for exactly this reason.
Fingerprinting. The combination of your screen size, fonts, language and settings can make your browser recognisable. Tor Browser tries to make every user look the same, which is why it warns you against maximising the window or installing add-ons.

How people actually get identified

The most common way Tor users are identified is not a technical attack on Tor. It is a mistake. Security researchers and law enforcement investigations tell the same story again and again: a marketplace operator reuses a username from an earlier account; a vendor ships a package to a real address; a user logs in to a personal email account over Tor; a file contains identifying data; two accounts are linked by the same writing style or the same operating hours.

There are also technical attacks. The best documented is traffic correlation: an observer who can watch traffic entering the network at the guard relay and leaving it at the exit relay can match timing and volume to link a user to a destination. This is a known weakness of all low-latency anonymity networks, documented since Tor's earliest research papers — and it is why Tor's own documentation describes the network as making tracing harder, never impossible.

A related risk is a malicious relay. Anyone can run a relay, including attackers, and a compromised exit relay can observe unencrypted traffic. The design limits what any single relay can learn, which is the point of splitting knowledge three ways — but it does not remove the risk.

What about onion services?

Onion services — .onion sites — are harder to trace than ordinary websites visited through Tor, because the connection never leaves the network and there is no exit relay to observe. Both sides build circuits into Tor and meet at a rendezvous point inside the network. But the same behavioural rules apply: logging in, revealing information, or making an operational mistake can still identify a person. Onion services protect the connection, not the user.

What reduces your risk

If you use Tor for legitimate privacy reasons, the practices that matter most are boring and practical:

Use Tor Browser as it comes. Do not install add-ons, enable plugins, or change the window size. The defaults are the protection.
Only visit HTTPS sites. Treat any unencrypted site as public, and assume the exit relay can read it.
Do not log in to accounts that identify you unless you accept that the site will know who you are.
Do not download and open files from untrusted sources, and never open a downloaded file in an application that can reach the internet outside Tor.
Keep identities separate. Do not reuse usernames, passwords, or writing styles between Tor activity and your ordinary online life.
Remember the provider. Your internet provider knows you use Tor. If that matters where you live, consider the legal situation before you start.

The bottom line. Tor is a strong privacy tool that makes tracing much harder. It is not invisibility, it is not a guarantee, and it does not make illegal activity legal or safe. Anyone who promises you complete anonymity on the internet is selling you something.

Sources

Tor Project — A short introduction to Tor (Tor Specifications, accessed 14 November 2026)
Dingledine, Mathewson and Syverson — Challenges in deploying low-latency anonymity (Tor Tech Report 2005-02-001, February 2005)
Tor Project — Download Tor Browser (accessed 14 November 2026)