Tor (The Onion Router) is free, open-source software that routes internet traffic through a global volunteer network of relays. This allows its users to browse privately and keep online communications confidential.
Note: PIA is a privacy and security service and must not be used for unlawful purposes. Users are solely responsible for ensuring their use of PIA and Tor complies with all applicable laws, regulations, and third-party terms.
Using Tor with a VPN
Two configurations are possible depending on your needs:
- VPN to Tor: Connect to PIA first, then open Tor. Your ISP sees VPN traffic, not Tor traffic.
- Tor to VPN: Connect to Tor first, then route through the VPN. Useful if services you want to reach block Tor exit nodes.
Before getting started, note the following:
- Tor exit nodes can observe unencrypted traffic. Always use HTTPS.
- Tor connections are often slower and may be blocked by some services.
- Combining Tor and a VPN increases latency due to multiple routing layers.
- Using Tor to VPN will prevent access to .onion services.
VPN to Tor (Recommended)
Flow: Computer → VPN → Tor entry node → Tor exit node → Destination
When connected this way, your ISP sees VPN traffic, while the Tor entry node sees the VPN server's IP address instead of your real IP address.
To set this up, you will connect to PIA first and then open Tor.
Before doing that, it’s recommended that you enable the kill switch. This ensures that if your VPN connection drops at any point, your traffic is blocked rather than transmitted unprotected. You can find the steps to enabling the kill switch in the PIA app here.
Tor to VPN
Flow: Computer → Tor entry node → VPN → Tor exit node → Destination
In this configuration, your traffic passes through the full Tor circuit before reaching the VPN server. Your ISP can see that you’re using Tor, and the Tor entry node will see your real IP address.
Achieving this setup requires third-party tools to route your traffic through Tor before it reaches the VPN. Two commonly used options are:
- Tails: A live operating system run from a USB drive that routes all traffic through Tor by default. To use PIA with Tails, connect to Tor first, then route specific application traffic through PIA's SOCKS proxy. See the PIA Tails guide for setup steps.
- Whonix: Uses a two-virtual-machine architecture to isolate Tor traffic. A Gateway VM handles all Tor routing; a Workstation VM is where you browse. Connect to PIA inside the Workstation VM after Tor is active via the Gateway.