Is there any way to decrypt tor traffic from an exit node or relay? I know it's possible to analyze the traffic using something like tcpflow or tcpdump, but it comes back as encrypted giberish. Is there any way to decrypt it?

  • 2
    If there was a way to "decrypt tor traffic," TOR would not be a very useful thing. TOR encryption is well documented and you can read up on it. Basically, the answer is no, but the question isn't very useful. Commented Jun 23, 2015 at 1:08
  • 4
    The question isn't useful to anyone that already knows the answer. It's perfectly useful if you don't. Commented Jun 23, 2015 at 1:19
  • Are you good at factoring? Commented Jun 23, 2015 at 4:33
  • how about dns sniffing?If client isn't encapsulate DNS-requests traffic into tor network and requested only internet (not tor internal) resources you can capture network packets between client and DNS-server,also note that works only througth tor network,will encapsulated DNS-requests. Commented Jun 23, 2015 at 9:55
  • Traffic out of an Exit node or relay is already completely decrypted with the Tor session keys. Tor never guarantees security, only anonymity.
    – RoraΖ
    Commented Jun 23, 2015 at 11:09

1 Answer 1


If you sniff on the exit node and the connection is not https/hidden service, then you will have the traffic in clear but you will not be able to know from who it came. Unless the traffic itself is revealing the identity.

In other cases, as far as we know, you can't decrypt tor. As other said, tor will be useless if it was possible.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .