# URnetwork vs Tor

Tor is the strongest widely deployed anonymity network; URnetwork keeps the
split-knowledge idea at everyday speed, exiting through residential addresses
instead of a public relay list.

**Choose Tor** if your adversary may be a government, if you need onion
services, or if the price must be zero. **Choose URnetwork** if you want split
knowledge at streaming-class speed, exits that appear as ordinary home users,
and a location you choose. Neither asks you to trust a no-logs promise. Tor's
separation is deeper and its scrutiny unmatched. URnetwork splits visibility
between its operator and a member-run provider and stays fast enough for
video.

[Tor](https://www.torproject.org) is run by the nonprofit Tor Project, a US
501(c)(3). Roughly 10,000 volunteer relays served an estimated 3.5 to 4
million daily users in mid-2026, numbers anyone can recount from the
project's [live metrics](https://metrics.torproject.org), since every relay
sits in a public consensus. A connection passes through three volunteer
relays: a guard that sees your IP, a middle that sees neither end, and an
exit that contacts the website, so no single relay learns both who you are
and where you go. Two pieces of folklore do not survive the record: using Tor
is legal in most of the world, and a 2020 study estimated that only about 7%
of Tor users connect to onion services. The rest browse the ordinary web.

URnetwork uses member-run exits. The provider does not receive your source IP
on the relayed path. Native apps seal traffic to the provider by default.
[How URnetwork works](/docs/overview) explains the full design. The
[threat model](/docs/threat-model) holds the complete record of what is stored
and enforced.

## Six differences that affect the choice

| | Tor | URnetwork |
|---|---|---|
| Separation | Three volunteer relays; no relay sees both ends, and no operator exists at all | Two relay parties; the exit never sees your IP, and the operator cannot read the sealed session |
| Speed | High latency by design; poor for video and calls | Streaming-class; URnetwork's own average figure is 40 Mbps+ |
| Exit address | Published relay list, blocked or challenged across much of the web | Residential addresses on no public list |
| Location choice | Not a product feature | Browse countries, search for a city |
| Onion services | Server-side anonymity, unique to Tor | None |
| Price | Free and uncapped, funded by grants and donations | Free daily allowance; Pro $5/month or $40/year |

Caveats below the table:

- Post-quantum: Tor runs a hybrid X25519/ML-KEM-768 key exchange at the relay
  TLS layer in current releases, rolling out across relays; the circuit-layer
  onion handshake is still a proposal. URnetwork's X25519MLKEM768
  client-to-provider session is default in the native apps, skipping any
  provider it cannot seal to rather than downgrading. The browser extension
  has no sealed session; there, the operator's data path logs nothing, pinned
  by a test in the open code.
- Tor Browser covers browsing and fails closed: if Tor drops, pages stop
  loading rather than loading outside it. Routing a whole phone or computer
  through Tor takes extra tooling. URnetwork is a full-device tunnel on
  Android, iOS, macOS, Windows, and Linux, with an explicit kill switch
  toggle in every app.
- Your ISP can tell that you connect to Tor, because entry addresses are
  public; bridges hide that. URnetwork traffic looks like ordinary encrypted
  traffic.
- Tor's capacity comes from unpaid volunteers. URnetwork's providers
  participate in the [UR protocol](https://ur.xyz) under signed, metered
  contracts.
- Neither tool makes you anonymous to a site you sign in to.

## What Tor says about its own limits

The Tor Project publishes its boundaries itself. "Generally it is impossible
to have perfect anonymity, even with Tor," says its own
[support documentation](https://support.torproject.org/faq/staying-anonymous/).
The concession is specific: an adversary able to watch both ends of a
connection, or to observe enough guard relays, can correlate traffic timing
without decrypting anything, and no low-latency design can eliminate that.

It has been done in practice. German reporting in September 2024 revealed
that police had deanonymized users of Ricochet, a long-retired messenger,
through guard discovery and timing analysis conducted around 2019 to 2021.
The Tor Project's response: the attack targeted an application that lacked
the vanguards defense, which has shipped in Tor since 0.4.7 and in Ricochet's
maintained successor since 2022, and Tor Browser users were not shown to be
affected.

Two more episodes show the network policing itself. In 2020, a malicious
operator controlling roughly a quarter of exit capacity at peak, downgrading
HTTPS on cryptocurrency sites, was identified and ejected. Across 2020 and
2021 the directory authorities expelled KAX17, a cluster of more than 900
relays positioned to observe traffic; those relays could contribute to
correlation but could not read encrypted content. Attacks are published,
defenses ship, the network continues. No commercial product is examined this
way.

One folk claim runs the other direction. Onion routing began at the US Naval
Research Lab, and US government internet-freedom programs long supplied much
of the project's funding, which feeds a persistent "government-built, so
backdoored" story. The funding history is real. The backdoor has never been
found: the code is open, releases are signed, Tor Browser builds are
reproducible, and two decades of adversarial scrutiny have surfaced nothing.

## Exits, bridges, and extenders

Tor's onion encryption ends at the exit relay. For a plain-HTTP site the exit
can read and alter what passes; with HTTPS it sees the destination domain and
nothing inside. VPN marketing repeats the first half against Tor while
omitting the symmetry: every egress terminates encryption, a VPN's server and
a URnetwork provider included. The difference is who the exit is. A Tor exit
does not know who you are. A single-company VPN's egress belongs to the one
company that does. A URnetwork provider sees destinations the way an ISP
does, and never your IP on the relayed path.

Both networks assume their front door gets blocked, and both let volunteers
run disguised entries. Tor's bridges include Snowflake, which turns a
volunteer's browser into an entry point, plus WebTunnel and obfs4.
URnetwork's equivalent is the extender: a volunteer-run first hop on an
independent address and a believable port that forwards the encrypted session
to the operator. The same caveat applies on both systems: a bridge or an
extender is your first hop, so its operator sees your real IP. And on both
systems the first hop reads nothing: a bridge carries Tor's layered
encryption, and an extender forwards a session that stays encrypted end to
end past it.

After the door, the routes differ on purpose. Tor chains three relays and
rebuilds circuits as you browse, each relay adding its own leg to every
round trip, because its adversary is an observer able to watch much of the
network at once.
URnetwork's path runs through two relay parties, the operator and then a
member's device, and spreads a session across a window of several providers
with each site pinned to one. Tor buys deeper separation with latency.
URnetwork keeps the two properties that matter, a provider blind to who you
are and an operator unable to read the sealed session, at speeds where video
and calls are normal use.

![Anonymity vs everyday usability — qualitative placement of single-hop VPNs, URnetwork's four legs, Tor, and mixnets](/docs-assets/infographic-anonymity-latency.svg)

*The same curve both networks sit on, placed qualitatively rather than
measured: Tor's longer relay chain buys the stronger separation, and
URnetwork stops at two relay parties, the fewest that still keep identity
apart from activity.*

## Accounts and payment

Tor has no account system: nothing to sign up for, nothing to pay, ever.
URnetwork reaches a similar floor by other means. The Instant Account is one
tap with no email, and the recovery seed phrase the server issues once
restores the account after a reinstall. That phrase is URnetwork's own
credential; no URnetwork screen ever asks for a crypto wallet's seed phrase
or private key. The free daily allowance requires no payment. Pro is where a
trail can start: on-chain USDC keeps it to a wallet address on a public
ledger, and an app-store purchase ties it to that store account. Tor never
has anything to bill.

## Where Tor wins

- Anonymity against the most capable adversaries: a longer, churning relay
  chain with no operator anywhere in it.
- Scrutiny. Two decades of published attacks, shipped defenses, and academic
  study, with reproducible Tor Browser builds.
- Onion services: server-side anonymity nothing else in this set offers.
- Mature censorship circumvention (Snowflake, WebTunnel, obfs4) with a
  research community behind it.
- Free, uncapped, and accountless.

## Where URnetwork wins

- Speed. Split knowledge at streaming-class throughput; URnetwork's own
  average figure is 40 Mbps+.
- The exit address. Residential IPs on no public list, where Tor's published
  exits are blocked or challenged by many sites.
- Choosing where you appear: browse countries, search for a city, with a
  location listed only while a member's device is online in it.
- Whole-device coverage with ordinary apps on Android, iOS, macOS, Windows,
  and Linux, plus the browser extension and web app.
- A contracted supply side: providers participate in the
  [UR protocol](https://ur.xyz) rather than depending on volunteer goodwill.

## Limits and evidence

URnetwork's main limits:

- No independent audit covers the protocol, the connect engine, or the
  operator's server code. Two 2025 third-party assessments cover other
  surfaces: a penetration test of the web application and API (April–May
  2025), and the Leviathan MASA AL2 assessment of the Android app, which
  passed. Leviathan writes that its assessment "should not be read as a
  holistic security evaluation or comprehensive penetration test." Neither
  examined logging, retention, or the data path.
- URnetwork's structure includes an operator at all: it authenticates you,
  assigns providers, and relays your traffic. The sealed session keeps it
  from reading what it carries, and while the seal is on a provider it cannot
  seal to is skipped rather than used unsealed — so the cost is availability,
  not a silent downgrade. No app yet shows a per-connection sealed-or-not
  verdict. Tor needs no such caveat.
- The split assumes the operator and the providers in your window are
  independent. Nothing in the system attests that independence, the operator
  could itself run providers, and no outside party has measured the fleet.
  See the [threat model](/docs/threat-model), §6.1.
- Tor's relay counts can be recounted by anyone from the public consensus.
  URnetwork's provider and location counts come from its own live stats
  feed: open and unauthenticated, but the operator reporting on itself.

Tor's limits are the ones it publishes. Latency is structural and permanent,
and the project discourages torrenting. Exits can read plain-HTTP payloads.
Using Tor is visible to your ISP unless you use a bridge, and timing
correlation by an adversary watching both ends remains possible, as the
project has said for as long as it has existed. None of that is a scandal.
It is the price of the strongest separation deployed at scale.

Many careful people run both: URnetwork as the everyday layer, Tor Browser
for the moments that need maximum anonymity. Trying either costs nothing,
and URnetwork's Instant Account takes one tap and no email. More questions
are answered in the [FAQ](/docs/faq).