This is a long explanation, for a TL:DR, read my first answer here.
What a VPN does is create an encrypted tunnel between you and a VPN server. When you want to send data to a server on the internet (let's call it website for simplicity but it can be anything and everything on the internet), you first send it to the VPN server through the encrypted tunnel and the VPN sends it on your behalf. For the website, it seems as if the VPN server sent the data. It then sends it response to the VPN server, which then forwards it to you using the encrypted tunnel again.
Now this helps makeing you anonymous in several ways. It prevents the website from seeing your IP address from the connection, because the data is sent to it by the VPN server. You could also try spoofing your IP address but then, the response would be sent to the spoofed IP and never get to you. That is why you need a VPN. Your ISP still can see you are sending data, but it can only see when you send it, how much you send and that it is sent to the VPN server. Because the data is encrypted in the tunnel, the ISP does not know what you are sending or whom to.
Now notice that the ISP knows you are sending data to the VPN server and the website knows it is receiving data from the VPN server. Therefore if they cooperate, they can immediately narrow down the number of "suspects" to the users of the VPN you are using. Further, they can see when exactly you were sending data and how large the packets were and narrow it down further, possibly to you exactly. This is called a correlation attack.
Furthermore, the VPN obviously knows everything. It knows your IP, because you are sending data to it and it needs to send you the responses. It knows who you are sending data to, because it has to deliver it. It also knows what you are sending, as the encrypted VPN tunnel ends at the VPN server. Now if there is another layer of encryption, such as HTTPS, then the VPN server still just sees the encrypted traffic, but it still knows a lot and the website knows the rest. If you don't use HTTPS or other encryption, than the VPN knows everything on its own. The FBI has successfully compromised a VPN in the past.
As you can see, VPN are only secure if you trust the VPN provider and even then, correlation attacks can be dangerous. While VPN can be effective against less powerful attackers, that can't force ISPs, websites and VPN providers to cooperate, they are not as effective against nation state actors, especially the USA, who can usually just force them to reveal the information they seek.
Tor works similarly to a VPN, except there are three computers between you and the website. These servers are called nodes. When you send data through Tor, they are sent to the first (entry) node, which forwards them to a second node, and that one forwards them to a third (exit) one. The exit node then forwards them to the website. Responses take the same route in the opposite direction. Now there are encrypted tunnels from YOU to each of the nodes, sort if tunnels within tunnels. This prevents anyone but the exit node to see, what and to whom you are sending. And of course, the exit node is furthest away from you, so it has the least chance of figuring out, what IP address is yours.
Now nodes in Tor are volunteers. Anyone can add a Node to the Tor network. This includes malicious attackers. It is theorized that many such attackers try to control exit nodes, so they can see the un-encrypted traffic and then try to figure out who it belongs to based on the content. Also if you are unlucky, you may end up connecting to three malicious nodes and then, these know everything just like a VPN server. Some believe an attack on Tor by flooding the network with malicious nodes was already pulled off by the FBI in collaboration with a university to take down the Silk Road 2.0.
Now as I said, compromising all three Tor nodes you use is more difficult than compromising a single VPN server, but not necessarily impossible for someone like the US government. Keep in mind that these nodes (or VPN server) do not need to cooperate voluntarily with the US government. A US agency, such as the NSA may simply hack the nodes/servers to gain access or send a team to break in and access the server physically.
Furthermore, while Tor makes correlation attacks harder, because there are many more users of the whole Tor network than a single VPN server, they are far from impossible. Especially if they can find clues elsewhere. A student once used Tor to report a bomb threat before an exam. He was caught, because he was the only student using Tor at that school at the time. While they did not break Tor per-se, he was an obvious suspect and eventually admitted to it.
Neither a VPN, nor Tor can protect you from revealing your identity accidentally. Internet browsers send large amounts of data to websites, that you may not even know about. Javascript and Flash may send your real IP or even physical location, browsers automatically send the size of your screen so that the website can adjust, they send cookies, information about the browser, about the operating system you use and many more. Your content may also provide clues. Your vocabulary, style of writing, language, references, etc. can all be used to narrow down the "suspects" and trace back to you. A certain well known hacker whose name I forgot got caught, because he shared too many broad personal details on IRC. While the FBI was never able to trace him through Tor, he over the years revealed bits of seemingly generic information that slowly narrowed down the possibilities until he was found.
In addition, this all presumes that the encrypted tunnels are secure. But with no-one knowing, what capabilities the NSA has, when it comes to breaking encryption, it is entirely possible they can just decrypt the tunnels and see everything without any of this hassle.
Using VPN and Tor together is a mixed bag. On one hand, it can sort of "extend" Tor to four nodes and decrease the chance of you being traced that way, but it can pose some other dangers.
And finally, neither a VPN nor Tor prevents a website from sending you malware and hacking your computer, then using it to find your real identity and/or location. The FBI has been known to use malware in its investigations and have successfully used it to unmask someone using Tor.
In the end, you can try your best to stay anonymous, but a single mistake, that may not even be made by you can reveal you, irreversibly. It may be an oversight by a developer of Tor, or the browser you use. There is no sure way to stay secure at all, only decreasing the risk. And against someone like the US government, who won't let a mistake go unpunished, the risks will always be high, no matter what you do.
The US government complicates things even further by keeping their successes secret. For example, they were known not to use advanced malware against hackers, because there was increased chance it would be discovered. Preventing us from knowing about it prevented us from defending against it. They will only use their most advanced techniques when they need to, keeping us from learning about them and defending ourselves from them.
If you are interested in doing your best, I would recommend taking a look at Tails. Tails is an operating system, whose whole idea is, that it does not allow to store any information. It does not allow writing anything to the disk, meaning you can't be distinguished from others using anything on your computer. It also routes all traffic through Tor, preventing you accidentally connecting somewhere directly. Because it is so minimalist, it is harder to hack. In addition, I would recommend not using the same identity for longer periods of time, such as nicknames. If they can't connect your activities online, they can't combine information they gain to narrow down the options.
Thanks to ConorMancone for the links to the real life examples.
