The Tor network is great for surfing the dark web and enjoying extra security — that’s because it encrypts your data multiple times, and it also prevents all the sites you connect to from seeing your real IP address.
That said, Tor still has its fair share of security flaws, mostly because the network might suffer leaks that reveal your real IP address. Also, malicious actors might operate Tor servers, which means they could spy on and log your traffic and IP address.
The solution is to use Tor with a VPN, and this is called an Onion over VPN connection. I’ll explain more in-depth how this type of connection works in this article. I’ll also cover how to use such a connection, when to use it, and which VPNs are best to use for Onion over VPN connections (ExpressVPN is my #1 pick).
Important: Accessing the Tor network in certain countries is against the law, so I strongly recommend researching the local laws and regulations of your country to make sure it’s 100% safe and legal to use Tor. Also, neither I nor nobody else at SafetyDetectives condones using the dark web for illegal activities.
Editors' Note: ExpressVPN and this site are in the same ownership group.
What Is Onion Over VPN?
To understand this term, you first need to know what “Onion” and “VPN” refer to. If I just start explaining what an Onion over VPN connection is, you’ll probably only be confused.
The term “Onion” refers to the Tor network, which is a privacy network that encrypts your traffic (making it unreadable) and changes your IP address. People often use the term “onion” when talking about the Tor network because it encrypts your traffic multiple times — so it envelops your traffic in multiple “layers” of encryption. Also, “Tor” is the acronym for “The Onion Router.” The Tor network is run by volunteers, and you can access it for free via the Tor browser.
A VPN is an online app that also encrypts your traffic and changes your IP address. But unlike the Tor network, it only encrypts your data once. VPN services are provided by different companies through subscription-based plans — though, there are also some VPNs that provide access to a free plan.
An Onion over VPN connection is when you access the Tor network over a VPN connection. Basically, you first connect to a VPN server and then use the Tor browser to access the Tor network. Plus, an Onion over VPN connection is also referred to as a Tor over VPN connection.
Quick summary of the best VPNs for using Onion over VPN:
- 1. 🥇 ExpressVPN — Best overall VPN for Onion over VPN connections (works 100%).
- 2. 🥈 NordVPN — Reliable VPN with dedicated Onion over VPN server network.
- 3. 🥉 Proton VPN — Best free option for Onion over VPN connections.
How Does Onion Over VPN Work?
This type of connection means you’re routing a Tor connection over a VPN connection. Your data first goes through the VPN server and then is sent over the Tor network — due to this, it’s encrypted at least 4 times.
Here’s a quick step-by-step explanation of what goes on in front of you and behind the scenes when you use an Onion over VPN connection:
- You connect to the VPN. First, you open the VPN app and connect to a VPN server. When you do this, the VPN server encrypts your traffic and changes your IP address (only the VPN server’s IP address is visible online).
- You connect to the Tor network. Next, you use the Tor browser to access the Tor network. When you do this, your VPN connection is sent through at least 3 Tor servers, and each server encrypts your data once. Also, neither of the Tor servers will see your real IP address — the first server will only see the VPN server’s IP address, while the other 2 servers will only see the IP of the previous Tor server.
- You start surfing .onion sites. Once you’re connected to the Tor network, you can start browsing .onion links. The last Tor server your connection goes through decrypts your data and forwards your traffic to the website you’re connecting to.
Pros & Cons of Using Onion Over VPN
The main reason to use Onion over VPN connections is to safely browse the dark web. The VPN prevents the Tor network from seeing your real IP address, which reveals your location. This is important because the Tor network might suffer IP leaks — also, sometimes, hackers might run Tor servers, so they might log your IP address.
In addition, with an Onion over VPN connection, you get extra security — instead of just encrypting your data with a VPN once, you also encrypt it multiple times via the Tor network.
What’s more, with an Onion over VPN connection, you also enjoy additional privacy. That’s because your internet service provider (ISP) won’t be able to see that you’re using the Tor network — they’ll only see the VPN connection.
Finally, this connection allows you to access Tor in countries where it’s blocked. As long as the VPN works in censorship-heavy countries (not all of them do), it’ll let you freely and securely browse the dark web via the Tor network. But please make sure that it’s illegal to do so in your location — some restrictive countries legally prohibit using the Tor browser or accessing the dark web.
However, you’ll experience massive slowdowns via these connections. VPNs already cause slowdowns on their own due to the encryption process, and the Tor network is notorious for being really slow. That’s because Tor’s servers are run by volunteers, and there aren’t enough servers to meet the bandwidth needs of all Tor users. So, mixing a VPN with Tor will usually cause really noticeable slowdowns.
Plus, an Onion over VPN connection might prevent you from visiting certain sites. Many websites (including top streaming ones) actually block Tor server IP addresses, so you won’t be able to connect to them this way.
Finally, changing your Tor IP address is pretty difficult — you can’t just choose which server location you connect to. Instead, you have to refresh the Tor connection for each website inside the browser. When you do that, the servers you reconnect to are picked at random, so getting the exit IP address you want just comes down to sheer luck.
When to Use Onion Over VPN
- When you need extra privacy on the dark web. If you’re worried that the Tor network might leak your real IP address, or that hackers might be running Tor servers and collecting user data, you should use an Onion over VPN connection. With it, only the VPN’s IP address is exposed, while your real IP remains hidden.
- When you’re sharing very sensitive data. Many whistleblowers, journalists, and political activists use VPNs or the Tor network to share sensitive documents. In such a situation, combining a VPN with Tor provides extra security and privacy.
- When you want additional encryption. If just encrypting your data with a VPN once is not enough, an Onion over VPN connection is a good (and free) way to add layers of encryption to your connection.
How to Use Onion Over VPN (Step-by-Step Guide)
1. Get a VPN That Supports Tor Traffic
First, you need to get a VPN that supports Tor traffic on its servers. Pretty much all of the top VPNs on the market allow Tor traffic on all of their servers — my favorite one is ExpressVPN because it allows Tor traffic on servers in 105 countries.
After you sign up, download and install the VPN app on your device — this is really easy to do, and it shouldn’t take you more than 2 minutes.
2. Download & Install the Tor Browser
Next, head to the Tor network’s site and download its Tor browser. The app is 100% free to download and use. Wait for the download to finish, then install the browser — just follow the on-screen instructions.
3. Open the VPN App & Connect to a Server
After that, open the VPN app you just installed and connect to a server. Just scroll through the list of available servers, pick the one you like (and make sure it supports Tor traffic), and connect to it.
4. Open the Tor Browser & Connect to the Tor Network
After you connect to the VPN, open the Tor browser and connect to the Tor network. Wait for the connection to the network to be established — since Tor is a bit slow, it could take a few seconds.
5. Start Surfing the Dark Web
Once you successfully connect to the Tor network, you can start browsing the dark web. Just start accessing any .onion links you want, and you’ll be able to access them securely. Just keep in mind they might take longer to load than normal, as Onion over VPN connections are pretty slow.
6. (Optional) Change the Tor Exit Server IP Address
If you need to change your Tor exit server IP address for a site, there’s a way to do it, though it’s a bit inconvenient. In the URL bar, to the left of the .onion link, hit the colored circuit icon. Next, click “New Tor circuit for this site” to reload your Tor connection. Unfortunately, you’ll have to keep doing that until you connect to an exit server in your desired location.
Editors' Note: ExpressVPN and this site are in the same ownership group.
Onion Over VPN vs. VPN Over Tor
With an Onion over VPN connection, you connect to the VPN and then to the Tor network. This ensures that the VPN secures your traffic and hides your IP address before you connect to the Tor network. So the first Tor server you connect to will only be able to see the VPN’s IP address. To use an Onion over VPN connection, you need to use a VPN that supports Tor traffic on its servers — luckily, pretty much all top VPNs do that.
Basically, an Onion over VPN connection looks like this:
Your device → ISP → VPN Server → Tor Network → Internet
With a VPN over Tor connection, you first connect to Tor, and then to the VPN. Doing this would ensure that the VPN wouldn’t be able to see your real IP address (in case it keeps IP logs) — it would only see the IP address of the last Tor server your connection goes through. That said, your data would still be exposed to the Tor network, which is bad for your privacy. In addition, very few VPNs support VPN over Tor connections.
This is how a VPN over Tor connection looks like:
Your device → ISP → Tor Network → VPN Server → Internet
Safety Tips for Using Onion Over VPN
- Make sure to use a secure VPN. It’s important to only use a VPN that provides strong security — so it should be able to protect you from traffic leaks, and it shouldn’t log your data. Basically, the VPN should use military-grade encryption, come with a kill switch, provide strong leak protection, and have a strict no-logs policy. Pretty much all top VPNs support Tor traffic, but ExpressVPN is my favorite.
- Always use an antivirus. You’re very likely to come across malicious links and content on the dark web. Unfortunately, a VPN can’t protect you against malware threats — that’s what an antivirus is for. The best antivirus program I can recommend at the moment is Norton 360.
- Tweak the Tor browser’s security levels. The browser uses the Standard security level by default, which allows all features on a website. If you upgrade to the Safer or Safest levels, the browser will disable on-site features that might endanger your privacy — though, keep in mind that might “break” certain websites.
- Only use safe .onion sites. I only recommend visiting legit dark web sites, which don’t put your data at risk (like the ones mentioned in this list). Also, avoid HTTP websites at all costs — they don’t encrypt on-site data, so if malicious actors are running the last Tor server your data goes through, they will be able to spy on it.
- Don’t give away personal information. Some dark web sites might ask you for your name and email address — it’s safer to just use a fake name and a throwaway or secure email address (like ProtonMail). Otherwise, if hackers are running those sites, they will steal your data.
- Only pay using cryptocurrencies. If you want to buy something on the dark web (I strongly advise not doing this), make sure you pay using cryptocurrencies instead of your credit/debit card. Cryptocurrencies provide much better privacy — plus, paying with a credit/debit card on the dark web means hackers could steal that data.
Editors' Note: ExpressVPN and this site are in the same ownership group.
Frequently Asked Questions
What’s the best VPN for Onion over VPN connections?
My top pick for Onion over VPN connections is ExpressVPN — it allows Tor traffic on all of its servers, which are located in 105 countries, it provides very good Onion over VPN speeds (most Tor links load in around 7–8 seconds), it’s really easy to use, and it comes with high-end security and privacy features that secure your dark web browsing.
Is Onion over VPN the same as a double VPN?
No. An Onion over VPN connection means you are first connecting to a VPN server and then accessing the Tor network. So, your data is encrypted at least 4 times (once by the VPN and several other times by the Tor network). On the other hand, a double VPN connection means you are first connecting to a VPN server and then connecting to another VPN server — so your data is only encrypted twice, but by the same VPN.
Are Onion over VPN connections slow?
Yes, these types of connections will cause noticeable slowdowns. VPNs already cause slowdowns on their own, and the Tor network is also pretty slow — that’s because it encrypts your data multiple times and also because its servers (which are run by volunteers) can’t keep up with how many people use the Tor network.
Is an Onion over VPN connection safe?
Yes, but only as long as the VPN you’re using is secure. An Onion over VPN connection will stop the Tor network from seeing your real IP address — but if the VPN you’re using keeps traffic and IP logs, your privacy will still be at risk. That’s why it’s important to only use highly secure VPNs that come with military-grade encryption, a strict no-logs policy, and other essential security features (like a kill switch and strong leak protection).
