If I download a file through Tor, will it be any different than if I download a file through a normal internet browser? I've downloaded stuff through Tor but it's always really slow. I was wondering if I browse through Tor, but then download a file through a normal browser, will it practically be the same thing or completely different?

To be more specific, will it actually show my real IP address and my location if I download through Tor? If it does, then wouldn't downloading from a normal browser be the same?

  • That does not look like a duplicate to me.
    – Anders
    Feb 9 '18 at 10:27

There are a couple different answers to this depending on the circumstances...

Peer to peer downloads (like torrents or filesharing networks)

If you are talking about downloading data illegally (e.g. copyrighted data in many countries), you shouldn't be doing that in the first place. Be a man and download that movie over the normal internet. If you download lots of data this way, you are using up a lot of CPU and bandwidth from multiple servers around the world and basically clogging up the network. That, too, is something you shouldn't do because the network will cease to be possible if too many people do this.

If you need to download lots of data anonymously and you have a real purpose for being anonymous (e.g. you're a journalist writing a piece on child porn), be my guest and use those resources.
If you're someone wanting to play the latest games without paying, well, I think you know where this is going.

Downloads from websites

And you are NOT using https

When connecting over Tor to the open internet (any http:// or ftp:// address), Tor basically works as a proxy server. The website that you download from sends data, a few nodes in the Tor network forward it, and eventually it ends up with you. That is, if everything goes as it should.

What Tor also does is encrypt the traffic inside the Tor network. This means that any MITM attacks on your local network (for example an insecure WiFi network) are not possible. So this is an advantage for using Tor to download things.

On the other hand, you are willingly proxying your traffic through at least one other stranger on the internet that can modify the traffic as desired. That is also a risk to consider, so be sure to validate any checksums if available.

And of course like always, Tor also masks your IP address (and thereby the possibility to find your physical location), which works especially well when you are using the Tails OS or the Tor Browser Bundle.

If you are using https

The only added value of Tor in this case is that it will mask your IP address.

If you are visiting an .onion website and downloading from there

This works much the same as https, except that now it doesn't only mask your IP address, it also masks the server's IP address. Law enforcement and others basically can't monitor that anyone downloaded a file from that server at all. It makes the server anonymous as well as you.

Note that it may technically be possible to unmask people using Tor if someone really wants to spend millions (billions?) on it, but this is usually not the case. If this is a concern, read more about how Tor works, this answer is certainly not sufficient.

  • 2
    If you want to say "It's illegal," just say "It's illegal." All the manly chest beating about clogging the Internet pipes with cpu and bandwidth is specious, not provably correct, and discredits later technical points.
    – gowenfawr
    Feb 3 '14 at 15:33
  • 2
    @gowenfawr I disagree. If I merely said it's illegal, then then logical response is "but so is downloading child porn for research". I elaborated on my reasoning on purpose: illegal things are not always bad in the sense that they may still serve the common good. And misuse of Tor for filesharing really does use a load of cpu and bandwidth. I tried to host a Tor node myself, but my server can only handle a trickle of data because of CPU limitations (Intel Atom platform). If lots of people use Tor for such non-essentials, it clogs up that much more capacity.
    – Luc
    Feb 3 '14 at 21:58
  • "Law enforcement and others basically can't monitor that anyone downloaded a file from that server at all." Not necessarily true. See for example Researchers find over 100 spying Tor nodes that attempt to compromise darknet sites. Also Bruce Schneier.
    – user
    Sep 5 '16 at 12:34

Tor works just like any other network interface. The site serving the data is unaware that a Tor node is requesting it. If you're getting the same file from the same location, they'll both have identical contents.

But you will lose all the anonymity Tor offers. You can give yourself away just by browsing to the same site - you don't have to download for your activity to be tracked.

  • If I use whonix gateway and download using wget then is there any possibility of divulge of anonymity?
    – SIslam
    Feb 20 '19 at 13:04

1 Malicious exit node can modify the files downloaded through it in malicious way. TorProject has a bot to detect and ban such nodes, but it won't help if exit node acts maliciously with low frequency.

2 HTTPS can help and cannot help, it depends on your threat model. If you try to avoid NSA or similar powerful agencies, https is not enough in most cases: the websites could be forced to disclose their private or/and and ephemerial keys to such agencies, and even public key pinning won't help. In the case if an adversary doesn't have access to the keys of websites, but has access to keys of CAs or are given intermediate CA certificate, it can reissue the certificates. In this case pkp will help.

3 You can download and verify gpg keys and then verify the files supplyed with the signature, if you beleive that the public key is not compromised.

  • Tor isn't even designed to protect against an adversary that can monitor the network on a large scale in real-time, looking at both ingress and egress points. Protecting against that is a far harder problem to solve. Tor provides anonymity, VPNs provide confidentiality; confuse the two at your own peril.
    – user
    Sep 5 '16 at 12:35
  • Yes, but installing malware using MiTM doesn't require adversary to be global, it requires him to compromise trusted parties, s.a. CAs, CDNs or web services itself.
    Sep 5 '16 at 23:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.