Tor over VPN: Why the VPN Goes First and Who Still Sees What

Tor over VPN is the sequence "VPN first, Tor second": your device connects to a VPN server, and only then Tor builds its circuit through that server. Your ISP sees an ordinary encrypted tunnel to a VPN address, while the Tor entry relay sees the VPN server's IP instead of your home one. Beyond that entry point, everything works like regular Tor. The vendor names vary: NordVPN calls it Onion over VPN, Proton VPN offers dedicated Tor over VPN servers, others just say "VPN then Tor".

Which comes first: the VPN, then Tor

The chain looks like this: device → VPN server → guard (entry) relay → middle relay → exit relay → website. Reverse it and you get VPN over Tor, where Tor runs first and the VPN server sits at the end. That rare setup lets you reach sites that block Tor exit relays, because the site sees the VPN address, not a Tor exit. The catch: the provider must accept connections arriving over Tor, few do, and your ISP can see that you use Tor at all.

What the VPN layer adds

Two things, both near the start of the circuit. First, nobody watching your line, from the office admin to the broadband company, can tell that you use Tor; the tunnel hides the connection to the guard. Second, a curious or malicious guard relay logs a datacentre address instead of yours. On networks where Tor is filtered by IP, the VPN also provides the road to the relays in the first place.

What stays visible: the provider and the exit relay

The provider now knows what your ISP used to know: your real IP and the fact that the traffic it carries belongs to Tor. With Tor Browser on top it cannot read destinations, but a logging provider can tie timestamps to your paid account, so a no-logs policy matters more than usual here.

The far end changes nothing. The exit relay still sees plain HTTP content and the destination domain, websites still spot a Tor exit IP and may block it, and signing into a personal account deanonymises the session regardless. Browser fingerprinting outside Tor Browser remains untouched, and Tor carries TCP only, with the VPN adding one extra leg to an already slow path. The Tor Project's position is that a VPN stacked with Tor can weaken anonymity when misconfigured, and advanced users should be the ones trying it.

One-click Onion over VPN versus Tor Browser on a VPN

A built-in Onion over VPN mode means the provider's server forwards your traffic into Tor itself, so any browser, Chrome included, can open onion services. Convenient, but two protections disappear. The browser keeps its regular fingerprint, since Tor Browser's anti-fingerprinting defaults never come into play. And the provider handles your traffic before the onion layers are added, raising the trust you must place in it.

Launch the VPN app first and Tor Browser after, and Tor's own circuit selection plus its browser defences stay intact: the VPN only ever carries already-encrypted Tor traffic. For sensitive work that is the route to take, leaving the one-click mode for casual onion browsing. Either way, keep the kill switch on: without it, a dropped tunnel sends Tor traffic straight to your ISP.

When obfs4 bridges beat a VPN

If the problem is a Tor block rather than a nosy ISP, a bridge often solves it without a paid subscription. obfs4 is a pluggable transport built into Tor Browser that disguises Tor traffic as random bytes, so simple blocklists that filter known relays stop working. It costs nothing, leaves no payment trail, and no company ends up holding your real IP. The trade-offs: bridges get discovered and blocked over time, they run slower than ordinary relays, and traffic analysis can still detect Tor use. See how obfs4 works for the details.

Providers that offer Tor routing

Of the 377 services in the VPNRadarLab main ranking, 10 say they offer Tor over VPN, 40 say they do not, and 327 do not say, which points to an undisclosed feature rather than a missing one. Proton VPN, NordVPN, Cryptostorm and MonVPN are among the services listing Tor routing in the data; the Tor over VPN comparison covers the ones that offer it.

FAQ

Is Tor over VPN safe?

Provided the provider keeps no logs and the kill switch is on, yes. A misconfigured pair can reduce anonymity, per the Tor Project's warning.

Does it slow the connection?

Tor itself causes most of the latency through its three relays; the VPN adds one extra leg on top.

Is it legal?

Where both Tor and VPNs are legal, so is the combination; jurisdictions restricting either apply the same rules to the stack.

Do I need Tor if I already use a VPN?

For everyday privacy, usually no. Tor makes sense when the VPN provider should not see which sites you open, or when you need onion services.

Short answer

The order is VPN before Tor. Your ISP stops seeing that you use Tor, the guard relay stops seeing your IP, the provider gains both facts, and the exit relay keeps its view of unencrypted traffic. For sensitive work, Tor Browser launched on top of the VPN beats the one-click Onion over VPN mode, and an obfs4 bridge is the tool when the goal is only to get Tor working again.