Tor (The Onion Router) routes your traffic through a chain of three volunteer-run relays before it exits to the internet. Each relay only knows the previous and next hop — never the full path. This means no single relay can connect your IP address to your destination.
What Tor does protect: your IP address from websites you visit, your browsing from your ISP, and your location from exit nodes.
What Tor does not protect: your identity if you log into accounts, your traffic content if you use HTTP (not HTTPS), or your anonymity if your browser leaks fingerprint data.
Every Tor connection uses exactly three relays:
The encryption is layered like an onion — hence the name. You encrypt your data three times, one layer per relay. Each relay peels one layer and passes it on. Only the exit node can read the final request, and only the guard node knows where the traffic originated.
When you connect to a .onion site, the exit node is eliminated entirely. The traffic never leaves the Tor network. The server's real IP is hidden from you, and your IP is hidden from the server. Both sides are anonymous. This is why GhostLayer runs as a .onion — not because it has something to hide, but because it respects yours.
Most Tor deanonymization doesn't exploit the protocol — it exploits user behavior:
The "Tor over VPN vs VPN over Tor" debate is nuanced. In most cases, using a VPN before Tor (so your ISP sees VPN traffic, not Tor traffic) provides a meaningful benefit if your threat model includes ISP-level monitoring. In most other cases, a VPN adds complexity without proportional benefit — and may actually reduce anonymity if the VPN provider logs...
The complete Tor Network Deep Dive covers: Tor circuits in depth, guard node selection, stream isolation, browser hardening, bridge configuration, hidden service architecture, and a full threat model section with worked examples.