What is Onion Routing, and How Does It Work?
Onion routing is the technique that makes Tor possible. Your data is wrapped in layers of encryption — like an onion — and peeled away one layer at each relay it passes through, until it reaches its destination with no single point knowing the full path.
The Three-Hop Circuit
When Tor Browser connects, it builds a circuit through three volunteer relays:
- Guard relay — knows your real IP but sees only encrypted traffic heading deeper into the network.
- Middle relay — knows neither your identity nor the destination; it just passes traffic along.
- Exit relay — knows the destination but not who you are; it decrypts the final layer and forwards your request to the clearnet site.
No single relay possesses both halves of the picture. That's the entire security argument in one sentence.
Why "Onion"?
Each relay removes exactly one layer of encryption — the layer addressed to it. Your ISP sees encrypted bytes going to the guard. The guard sees encrypted bytes going to the middle. The middle sees encrypted bytes going to the exit. The exit sees plaintext destined for the website — but has no idea where it originated.
Onion Services — The Other Half
Regular Tor traffic exits to the clearnet. But .onion addresses work differently: the destination is itself a Tor hidden service, so traffic never leaves the network. Six hops instead of three — three to reach the service, three for the response — and both ends stay anonymous.
What Onion Routing Doesn't Do
- It doesn't make you unidentifiable — websites can fingerprint your browser and behavior.
- It doesn't protect against malware already on your device.
- It doesn't hide that you're using Tor (your ISP sees Tor traffic — use bridges like obfs4 if that's a problem).
Key Takeaway
Onion routing distributes trust across thousands of independent relays so that compromising any single one reveals almost nothing. It's imperfect — global adversaries remain a theoretical threat — but it's the strongest mass-deployed anonymity system ever built.