VPN vs Proxy vs Tor
A proxy hides one connection, a VPN hides your whole route, and Tor hides who you are. Where each one wins, what each one costs, and how they differ.
These three are often treated as interchangeable, and they are not. They differ in what part of your connection they change, and that single difference determines which one is appropriate.
A proxy moves one connection through someone else. A VPN moves your whole device’s traffic through someone else as well. Tor spreads that traffic across several someones in sequence, so that none of them knows both ends.
Summary#
| Proxy | VPN | Tor | |
|---|---|---|---|
| What it hides from your network | that specific destination | all of your destinations | that you are visiting it at all |
| Who can read your traffic | the proxy operator | the VPN operator | the exit relay, and only the exit relay |
| Who sees your address | the proxy operator | the VPN operator | no single relay |
| What it hides from the destination | your address, behind a proxy’s | your address, behind a tunnel’s | your address, behind an exit’s |
| Cost | low | throughput, and a trust decision | throughput, and reach |
The difference that matters most: a proxy hides a destination, a VPN hides your entire route, and Tor makes the route unlinkable to any single party.
How they differ#
A proxy forwards requests#
A proxy is the simplest of the three. Your application asks the proxy to fetch something, the proxy does it, and you receive the result. It has been specified in this form since SOCKS, the protocol defined in RFC 1928, which describes a small handshake for asking a server to connect elsewhere on your behalf.
Two consequences follow from “one connection”:
- It only covers applications configured to use it. Everything else goes direct, and your network sees it.
- The proxy operator knows your address and what you asked it for, because both facts are in front of it.
A proxy is the right tool for one application reaching one destination, with no throughput cost.
A VPN moves the whole device#
A VPN is a network interface. Your operating system sends packets into it, they travel encrypted to a server, and the server sends them onward. Applications do not need to know. That is the difference from a proxy, and it is why a VPN hides your DNS lookups and background traffic as a side effect of carrying your traffic rather than relaying it.
The cost is a party. A VPN operator necessarily sees your address and, if it logs, everything you did through it. This is covered in What Is a VPN?; the honest summary is that the risk is moved, not removed.
Tor makes the route unlinkable#
Tor adds something neither of the others has: it splits your traffic across multiple relays so that no single one knows both ends. As the Tor Project’s own documentation puts it, a circuit is extended one hop at a time and each relay knows only which relay gave it data and which relay it is giving data to. No individual relay ever knows the complete path.
That design has a second half. Because the destination is a website you log in to, network-level anonymity is not enough on its own, because the site would still identify you. Tor Browser addresses this separately by making every user’s browser look alike: its manual describes limiting the variety of screen sizes, fonts and languages so that large numbers of users fall into a small number of buckets, which makes identifying any one of them much harder.
So anonymity under Tor is two projects stacked: an unlinkable network path, and a browser that resists identifying you on its own. A VPN does the first and never attempts the second.
Performance#
Roughly, in order: proxy is fastest, VPN next, Tor slowest. Tor costs more than throughput: circuits are built one hop at a time before your first request completes, and many sites deliberately slow down or refuse traffic that looks like Tor.
Tor pays for that design instead: circuits are built one hop at a time before your first request completes, and many sites deliberately slow down or refuse traffic that looks like Tor. The cost is accepted by a network built to carry it.
Detection#
Each is recognisable, and each is recognisable in a different way.
- A proxy is the hardest to see from the network, because a well-configured proxy looks like ordinary traffic to a single destination. It is also the easiest to forget about, and the traffic you forgot to proxy is the traffic that gets seen.
- A VPN is a recognisable object on the wire. A tunnel has a shape, and shapes can be measured. Encrypted VPN traffic is statistically distinguishable, which the CACM paper on OpenVPN fingerprinting measured; deep packet inspection covers how that works in practice.
- Tor is openly identifiable, deliberately. Its relays are published and its client announces itself. The Tor Project’s own summary of this is that all anyone monitoring can see is that you are using Tor. That is a design decision: it makes Tor easy to block, and in exchange it needs no attempt to blend in.
When to use which#
Use a proxy when one application needs to reach one place, and you care about that destination rather than about your whole device. Lower overhead, one point of trust, and a much narrower claim than a tunnel makes.
Use a VPN when you want your network to stop seeing where you go, for everything you do, at a throughput cost you can live with. This is the right default for public Wi-Fi, for daily browsing, and for most people reading this.
Use Tor when you need no single party to be able to link your activity to you, and you can accept the speed and the fact that some sites will refuse you. Journalists, whistleblowers, people in repressive environments, and anyone whose safety depends on the separation holding.
Use two of them when the threat demands it. Tor over a VPN, or a VPN over Tor, exists because the two properties are different: one hides your route from the network, the other hides your identity from the relay.
What none of them do#
None of the three changes who you are to a website you are logged into, and none protects you from malware, from a convincing phishing page, or from behaviour that identifies you. A search for one very specific rare thing defeats all three equally.
And all three are visible to a network operator as something. What differs is whether the operator can tell which destination, which is a very different question from whether they know you are tunnelling.
Common misconceptions#
“A proxy is a smaller VPN.” It is a different tool for a different job. It covers one connection, requires per-application configuration, and gives its operator both ends of that connection.
“Tor is just a VPN with more steps.” The added steps are the point. A VPN operator can see both ends; that is a structural property of a single-hop tunnel, not a configuration mistake.
“If a proxy is enough, why bother with Tor?” Because “the proxy cannot read it” and “the proxy cannot prove it was me” are different guarantees. Pick based on which one you need.
“HTTPS already handles this.” HTTPS protects the contents of one connection. It does not hide your destination from your network, and it does nothing for the cases in this article where the network is the observer.
Related#
- What Is a VPN? — the mechanism behind the middle column
- Privacy vs Anonymity — the property the right-hand column actually delivers
- What Does Your ISP See? — the observer all three are trying to hide from
Sources
- Tor: Overview The Tor Project
- How Tor works The Tor Project
- Tor Browser Manual: Anti-fingerprinting The Tor Project
- RFC 1928 - SOCKS Protocol Version 5 IETF
- OpenVPN 2.x Community How-To: Complete Setup and Configuration Guide OpenVPN
- WireGuard: Protocol and Cryptography WireGuard
Last reviewed October 7, 2026. Corrections and additions are welcome.