So when you connect to tor it gives you a specific IP right, who's IP is this exactly? And when you visit an open website who's IP is visible to the site, mine or the exit node. And while you're connected to end to end untrusted hidden service if the website tracks you with cookies is my original IP visible or the one assigned to me by tor?

  • I use orweb on android for hidden services and I use different browser for google, Yahoo,etc so I'm not exposed by ad cookies.

3 Answers 3


The cookie usually doens't hold IP information. And your browser isn't -as far as I know- able to determine your IP address and pass this on. Even when it would be, through a plugin/activeX control, it may be the RFC1918 IP address which is fairly useless.

A cookie, however, can identify your browser. A website can set a unique value which your browser remembers when it visits that site. If you don't clear your cookies (and there's more ways to do it, see evercookies) - and you connect using a different node. The target site will see a new IP address, a new country even, but it's the same browser/session, and hereby the site owner may derive that you are the same person. But as a general rule of thumb, installing plugins could compromise your privacy.

So they may see that you (your session) logged in from China, an hour later from Belgium, then from Ohio. Assuming you are using some sort of routing network such as Tor.

From an IP point of view, it will be the IP address of the final Tor node.

  • when you're using .onion sites what happens? and can you please explain the rfc1918 part. Jul 7, 2014 at 7:54
  • The hidden services is in my other comment, it seems to be anonimized. RFC1918 are internal addresses, like
    – ndrix
    Jul 7, 2014 at 8:40
  • On another note, using JS people could find out if you're using Tor or not by linking resources from the "deep web".
    – ndrix
    Jul 9, 2014 at 6:33

When you browse to a .onion website the web server sees the connection coming from the hidden service operator's Tor client. It is common (though not the most secure configuration) that this instance of the Tor software is running on the same machine as the web server, in which case the web server's access logs will show all traffic originating from ("localhost", every computer's address for itself). It is better to insulate the hidden service on a private network so that if the web server is compromised it cannot learn its own location; in this case, the web server will see all connections coming from some private IP address where the operator is running their tor client.

On a more technical level, if the hidden service operator were to look inside of their tor process (such as by modifying their copy of tor, or using a debugger) the closest machine to the .onion visitor which they can identify is the "rendezvous point". This is some regular Tor relay, chosen by the visitor/user, which both the hidden service and the visitor have built full 3-hop tor circuits to. A network observer at either end should not be able to identify the rendezvous point, but both the hidden service and the user know where it is.

There do not need to be any exit nodes involved in a connection to a hidden service (although, any of the nodes might also happen to be exit nodes). The rendezvous point plays a similar role to that of an exit node, but it doesn't require the relay operator to configure it specially (as being an exit does) because there isn't the risk of abuse complaints that comes with being an exit to the internet at large.

As previous answers have said, cookies do not by themselves reveal IP addresses. But, they can be used to "link" subsequent visits (perhaps from different IPs) - meaning, identify them as being from the same browser. Tor Browser clears all cookies whenever it is closed or you click the "New Identity" button. It also disables 3rd party cookies, so the facebook button on site A doesn't know you're the same person as the facebook button on site B (unless you go there at around the same time, in which case they can guess you might be) because facebook can only see your facebook cookies on requests where facebook is the site in your URL bar (the "first party" site).

HTH HAND and happy hacking


I know the IP addresses come from anyone running a tor node. Individuals that believe in the tor concept will run tor nodes from their computers at work or home. This can be in any country also so the IP address will change to another tor node. Im not sure on the exact times your node will change. Hope this helps a little.

  • So who's IP is seen when you visit a hidden service? Jul 7, 2014 at 3:24
  • What's a hidden service?
    – ndrix
    Jul 7, 2014 at 6:13
  • @m1ke, .onion links Jul 7, 2014 at 7:46
  • this paper indicates that .onion sites are accessed through a rendez-vous point and is anonymized.
    – ndrix
    Jul 7, 2014 at 8:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .