>VPN vs Proxy vs Tor:What Each One Hides, and From Whom

Introduction

A proxy, a VPN and Tor all put another computer between you and the website you open. Each of them hides you from a different watcher, and none hides you from all of them at once.

A proxy changes the address a website sees, but only for the apps you point at it, and a plain proxy encrypts nothing. A VPN encrypts everything your device sends as far as the VPN company's server, so your Wi-Fi and your internet provider see only that server, while the VPN company sees what they used to see. Tor sends your traffic through three volunteer-run relays, picked so that none of them knows both who you are and which site you open.

This guide goes further than the 15-minute video version at the end of the page: it also covers SOCKS5 and socks5h, Shadowsocks, residential proxies, Tor combined with a VPN, multi-hop VPNs, kill switches, and the ways websites notice all of it.

Is a proxy the same as a VPN?

No, although both relay your traffic through someone else's server and in both cases the website sees that server's address instead of yours. The proxy vs VPN difference comes down to coverage and encryption. A proxy works per app: you set it in a browser, a messenger or a torrent client, and everything else goes the usual way. A VPN works for the whole device, and when it is set to carry everything it takes every app, its DNS lookups and its video calls, over TCP and UDP alike. A plain HTTP or SOCKS5 proxy encrypts nothing on the way from you to the proxy, while a VPN always encrypts that leg.

What they share is the server in the middle, which knows your IP address and every site you visit. Picking a proxy or a VPN means picking who gets that knowledge.

Who sees what: Wi-Fi, ISP, the middle server and the website

Every packet carries two addresses in plain sight, where it came from and where it is going, and every router on the way reads them. Encryption hides what is inside the packet, never those two addresses. Along the path, three parties matter most: whoever runs your Wi-Fi, your internet provider, and the website at the end. A proxy, a VPN or Tor adds a fourth, the server in the middle.

The content of an HTTPS page stays sealed in every row. What changes is who knows your address and your destinations. None of the tools hides how much you send or when, because TLS does not hide the length of what it carries.

What HTTPS already hides

The padlock in the browser seals the page, the form and the password between your browser and the website's server. The site's name still leaks twice. Your device first asks a DNS server where the site is, usually in plain text, and then the browser names the site in the first message of the encrypted connection, in a field called SNI. Encrypted DNS hides the lookup from your network, though not from the DNS company that answers it. Encrypted Client Hello seals the name, but only on sites that have turned it on, and the server's IP address stays visible either way.

The website itself sees your real IP and everything you send.

What is a proxy server?

A proxy server makes requests on your behalf. Your app connects to the proxy, the proxy connects to the website, and the website sees the proxy's address. For an old http:// address the app hands the proxy the full URL. For an https:// site it only asks the proxy to open a tunnel to a host and port, and the proxy then forwards encrypted bytes it cannot read, while still knowing the host.

A proxy can also pass your real address along. The HTTP standard defines a Forwarded header for exactly that, and a proxy built for privacy simply leaves it out. Sellers call such proxies "anonymous" or "elite", but those words come from price lists, not from any standard, and nothing checks them.

A plain HTTP proxy talks to you unencrypted, so your Wi-Fi and your provider can read which host you asked for, and the whole page on http:// sites. An HTTPS proxy wraps the connection to itself in TLS, and the network sees only that you are talking to the proxy. The proxy itself sees the same either way: you and every site.

SOCKS5 proxy: socks5 vs http proxy, and socks5 vs socks5h

A SOCKS5 proxy works a level lower than an HTTP proxy. It ignores the protocol an app speaks and relays the connection, so any app with SOCKS support can use it, while an HTTP proxy is mostly for web traffic. The SOCKS5 standard, RFC 1928, covers UDP as well as TCP, but support varies: Chrome, for one, cannot send UDP through it.

SOCKS5 has no encryption of its own. The destination address travels in the open, and so do the username and password when the proxy asks for them. The standard for that login says itself that the password goes in cleartext.

DNS is the detail that trips people up. With socks5h, where the "h" stands for hostname, the app gives the proxy the site's name and the proxy looks it up. With plain socks5, the app looks the name up itself, through your usual resolver and outside the proxy. That lookup is a DNS leak: your provider sees the names of the sites although the connections go through the proxy. Firefox has sent DNS through SOCKS5 by default since version 128. Other apps decide for themselves.

Even in the browser, WebRTC, the technology behind video calls, can go around a proxy and show a website your real address. The WebRTC leak guide explains when that happens and which setting stops it.

Shadowsocks: SOCKS5 with encryption

Shadowsocks calls itself "a secure split proxy loosely based on SOCKS5". The local half runs on your device and behaves like an ordinary SOCKS5 proxy for your apps. It encrypts the traffic and sends it to the remote half on a server, which decrypts it and connects to the site. Current versions use AEAD ciphers, and the stream is designed to look like random bytes, which is why people use it on networks that block VPNs. Projects such as V2Ray go further and dress the traffic up as ordinary HTTPS.

It is still a proxy, although people often call it a VPN: the remote server sees your IP and every destination, and only the apps pointed at the local half are covered.

Residential proxy

A residential proxy sends your request out through an address that belongs to a home internet connection rather than a data center. Websites treat such addresses as ordinary visitors, because IP databases cannot simply label them as hosting, and the vendors of those databases admit that residential proxies are harder to detect than other kinds.

The home addresses come from somewhere. Some people install an app that shares their connection for a reward, some apps carry proxy code their users never noticed, and some devices, such as cheap Android TV boxes, arrive infected before anyone opens the box. The TV box article shows how. A buyer of residential proxy traffic usually cannot tell which kind of home they are borrowing.

Compared with a VPN, a residential proxy gives one app a home address that blends in, while a VPN gives the whole device an encrypted tunnel to a server that usually sits in a data center.

SSH tunnel vs VPN

SSH is the encrypted remote login administrators use to reach servers, and it can carry other traffic too. Port forwarding sends one local port to a host on the far side. Dynamic forwarding turns the SSH client into a local SOCKS proxy for any app you point at it.

Your Wi-Fi and your provider then see only the SSH server, plus the fact that it is SSH, because the protocol announces itself before encryption starts. Past the server, traffic travels as it would from there, and the server sees your account and every site you send through it, so a tunnel helps most when the server is your own. The difference from a VPN is coverage: SSH takes the apps and ports you send into it, a VPN takes the whole device. SSH can build a full VPN as well, but its own manual warns about the overhead, and WireGuard or IKEv2 is the usual tool for joining a whole network.

How does a VPN work?

A VPN builds an encrypted tunnel from your device to the VPN server. Each packet is encrypted and put inside a new packet addressed to that server, so from outside every packet looks like a sealed envelope with the same address on it. The server opens the envelope and sends the contents on to the website from its own address, which means the VPN company now sees what your provider used to see.

Three protocols do most of this work and differ in the details. WireGuard is small and modern, runs only over UDP, and its documentation says plainly that it "does not focus on obfuscation". OpenVPN uses UDP by default and can fall back to TCP, which gets through networks that block UDP but slows down on a bad line. IKEv2 with IPsec is built into phones and laptops and keeps the tunnel up when you switch networks. All three leave a recognisable pattern on the wire, so a network operator can usually tell that you use a VPN without reading what goes through it.

Does a VPN hide your IP address and the sites you visit?

From the website, it hides your IP address: the site sees the VPN server's. Your cookies, your logged-in accounts, your language and your time zone come along unchanged.

From your Wi-Fi and your internet provider, it hides which sites you open, provided your DNS lookups go through the tunnel as well. Your ISP can still see that you use a VPN: a steady connection to one server, and often the protocol.

From the VPN provider it hides nothing. The provider sees your real address and every destination, and the content too on sites without HTTPS.

Kill switch, split tunneling and always-on VPN

A tunnel can drop when the Wi-Fi changes, the server restarts or the app crashes, and for those seconds your device may send traffic the normal way, from your real address. A kill switch blocks all traffic while the tunnel is down. Android builds it in as an always-on VPN with an option to block connections without the VPN, and most VPN apps have their own version. Read what yours covers: in some apps the basic kill switch reacts only to a dropped connection, not to switching the VPN off by hand, and a stricter mode does both.

Split tunneling is the opposite choice: some apps or routes go around the VPN on purpose, a banking app or a local printer, say. Whatever goes around shows your real address, and in the browser this matters more than it seems, because with a split tunnel WebRTC can find both the VPN's address and your provider's.

What a "no logs" promise can prove

A VPN provider can see your address and your destinations, so everything depends on what it stores. A no-log policy is a promise not to store that, and nobody outside can check what a server does not write down. Independent audits help, but an audit covers the setup the auditors were shown, at the time they saw it.

How does Tor work?

Tor gets rid of the single server that knows both ends. Your request passes through three volunteer-run relays in a row: an entry, also called the guard, a middle and an exit. Before it leaves your device, Tor Browser wraps it in three layers of encryption, and each relay peels off its own layer and learns only the next stop.

So the entry knows who you are but not the site. The exit knows the site, and without HTTPS what you send, but not who you are. The middle knows neither. With only two relays, each would know which other one to watch. More than three adds load without making you safer. Onion sites, the ones ending in .onion, use six relays, three picked by you and three by the site.

Your provider sees only that you connect to Tor, and bridges, entry relays that are not listed publicly, can hide even that when combined with transports that disguise Tor traffic. The website sees the exit's address and can tell it is Tor, since the list of exits is public by design. Anonymity draws bad traffic as well as good: spammers, scrapers, bots and people breaking into accounts use Tor too, and each exit carries the traffic of many users at once, so sites trust Tor addresses less. That is why Tor users meet so many captchas.

Tor carries TCP only, so most voice calls and games don't work over it, and it is slower, because traffic bounces between volunteer servers around the world. Someone who watches both your connection and the exit can match the traffic by its timing, and Tor does not defend against that. Logging in to an account gives you away as well: Tor hides your address, and the account still has your name on it.

Tor Browser protects only itself. Other apps can go through Tor with Orbot on phones, the Tor Project's beta Tor VPN app for Android, or Tails, an operating system that sends everything over Tor. Picking the exit country in Tor Browser is discouraged. If you only need another country, a VPN is simpler.

VPN vs Tor: which is better?

They do different jobs. A VPN is fast, covers every app including calls and games and lets you choose a country, and you trust one company with both ends. Tor splits that knowledge across three volunteers' relays and needs no account, but it is slow, carries TCP only and makes many sites suspicious. For streaming, games or café Wi-Fi, use a VPN. To hide who you are from the site itself, use Tor Browser and don't log in.

Tor over VPN, VPN over Tor and multi-hop VPN

You can use a VPN and Tor at the same time, in either order, and the order decides who learns what. The Tor Project's own advice is cautious: it does not generally recommend using a VPN with Tor "unless you're an advanced user who knows how to configure both in a way that doesn't compromise your privacy."

Tor over VPN: VPN first, then Tor

In Tor over VPN you connect to the VPN and then start Tor Browser. Your provider sees a VPN connection, which may keep it from seeing that you use Tor, although Tor traffic can sometimes be recognised by its pattern even inside a tunnel. The VPN provider now sits at your entry point: it knows your address and that you use Tor, but not where you go. The website still sees a Tor exit. This helps where using Tor at all draws attention or is blocked, a problem Tor's own bridges solve without adding a company that knows your address.

VPN over Tor: Tor first, then a VPN

Here the traffic goes through Tor first and leaves through a VPN server. The website sees the VPN's address instead of a Tor exit, so sites that block Tor let you in. The VPN provider sees every site you open, and although the traffic reaches it from a Tor exit, your account and your payment are clues of their own. Tor normally changes its path through the network. A fixed last hop gives that up, and every site sees you arrive from the same address. The Tor Project's old wiki page on the subject calls a permanent destination after Tor "generally a really poor plan" and warns that such a server "can build a profile of everything you do."

Double VPN and multi-hop VPN

A double VPN, also sold as multi-hop, sends your traffic through two VPN servers in a row. Your provider sees the first server, the website sees the second. The first knows your address and the second knows your destinations. An observer who watches a single server no longer sees both ends. If one company runs both servers, though, that company can still join them, so your trust in it stays where it was, and you pay for the second hop in speed. Two VPNs from two different companies is a different setup: two VPN apps on one device tend to fight over the same routes, so one of them usually runs on a router or in a virtual machine.

iCloud Private Relay and Cloudflare WARP vs a VPN

iCloud Private Relay uses two relays run by different companies. Apple's relay sees your IP address but not the site, and a partner's relay sees the site but not your IP. It covers Safari, DNS lookups and unencrypted traffic from apps, but not the encrypted traffic of every app, and it keeps you in your own region. Apple publishes the list of relay addresses, so sites can recognise them.

Cloudflare's WARP replaces your IP address with a Cloudflare address near your approximate location. Cloudflare says itself that WARP does not provide anonymity and does not let you appear to be in another country, and video calls that use your camera or microphone go around it.

Which one should you use?

Start with whom you are hiding from:

• On café or hotel Wi-Fi, HTTPS already seals what you send. A VPN also hides which sites you open from whoever runs the network.
• From your internet provider, use a VPN or Tor. On Apple devices, Private Relay covers Safari and DNS. A plain proxy won't help, because its first leg isn't encrypted.
• To appear in another country, use a VPN with the server you pick, or a proxy for a single app. Private Relay and WARP keep your country.
• From the website itself, use Tor Browser and don't log in. A VPN or proxy changes your address, but your logins and cookies come along.
• When one app needs another address, set a proxy, SOCKS5 or an SSH tunnel in that app's own settings, with the proxy resolving names (socks5h) so DNS stays inside.
• On a network that blocks VPNs, an encrypted proxy such as Shadowsocks or Tor with bridges gets through more often.
• To reach your own server or home network, SSH covers one server and WireGuard or IKEv2 a whole network. A VPN you rent for privacy ends at the company's servers, not at your home.
• At work, your employer's VPN puts the employer in your provider's seat for everything that goes through it.

If all you want is to hide your IP address from a website, every tool here does that. The choice between them depends on who else is watching.

How do websites detect a VPN or proxy?

Often they can, by adding up clues. The "VPN or proxy detected" message you sometimes see is the sum.

1. The address. Tor exits are on a public list, and many VPN servers sit in data-center ranges that IP databases already label. IP reputation explains how those labels follow an address around. Residential proxies are the exception, which is what they are sold for.
2. Time zone and language. The browser reports both, and if they say Berlin while the address says Tokyo, that is a clue. Time zone mismatch and regional integrity cover the details.
3. DNS. When the lookups for a site's name come from your provider's resolver and the connection comes from a VPN, the two don't match (DNS leaks).
4. WebRTC. A leak past the tunnel can point straight back to your real network (WebRTC leaks).
5. The packets. The first packet of a connection hints at the operating system that sent it, so a browser that says Windows over packets that look like Linux suggests something in between. A tunnel also wraps every packet, which makes your largest packets a little smaller, and the site can see that too (passive OS fingerprinting).
6. The browser. How it draws, its fonts, its settings and the way it opens a TLS connection can be enough to recognise it after its address changes (what a browser fingerprint is).

A site that knows you use a VPN still doesn't know who you are, but for some sites that knowledge is enough to show a captcha or block you.

Check what a site sees about you

To see all of this on your own connection, run the Privacy & Trust Index. It checks your connection and browser the way a website can and turns the result into two scores from 0 to 100: a Privacy score for how exposed and trackable you are, and a Trust score for how genuine you look to anti-fraud systems. Each check sits on its own card, so you can see which one costs you points and why: the address a site sees and what kind of network it belongs to, the DNS resolver your lookups come from, whether WebRTC exposes another address, whether your time zone matches your IP, and what your packets say about your system. Run it once with your VPN or proxy on and once without, and compare.

Watch the video version

The same story in fifteen minutes, with animated diagrams of who sees what at every stop on the path, from HTTPS and proxies to VPNs, Tor, Private Relay and WARP.

15:39

FAQ

Can my ISP see what sites I visit if I use a VPN?

Not if your DNS lookups also go through the VPN. Your provider sees the connection to the VPN server, how much data you send and when, but not which sites you open. The VPN provider sees them instead.

Does Tor hide my traffic from my ISP?

It hides where you go and what you send. Your provider can still see that you connect to Tor unless you use a bridge.

Which is better, a proxy or a VPN?

For privacy, usually a VPN: it encrypts the whole device's traffic up to its server, while a plain HTTP or SOCKS5 proxy encrypts nothing and covers only the apps set to use it. A proxy fits better when a single app needs a different address.

Does a VPN change your location?

It changes the location websites read from your IP address to that of the VPN server. Your browser's time zone and language stay as they were, and sites can compare them with the address.

Is a VPN safe?

As safe as the company that runs it, since that company sees your real address and every site you visit. A VPN protects you from your Wi-Fi and your provider, not from the VPN provider.

Can I use a VPN and Tor at the same time?

Yes. Tor over VPN (VPN first) can hide your Tor use from your provider, and VPN over Tor (Tor first) shows websites a VPN address instead of a Tor exit. Each order adds a company that learns part of what you do.

Sources

• RFC 1928: SOCKS Protocol Version 5 (IETF)
• Tor Project: how Tor compares with other proxies
• Apple: iCloud Private Relay overview