How Tor Works: The Three-Hop Circuit, and Who Can See What at Each Point

The three-hop circuit

Tor's client software builds a path through three relays chosen from the network's public directory: a guard (entry) relay, a middle relay, and an exit relay.^{Tor Project specification} The guard relay is selected with more care than the others and stays fixed for two to three months at a time specifically to limit a longer-term profiling attack, while the middle and exit relays typically rotate with each new site you visit.^{Tor Project} Traffic is wrapped in three layers of encryption before it ever leaves your device — one layer per relay — and each relay removes exactly one layer as the data passes through, learning only enough to know where to forward it next.^{Tor Project specification} The structural guarantee this produces is simple to state and easy to underestimate: no single relay in the circuit ever knows both where the traffic originated and where it's ultimately headed, because the guard knows your identity but not your destination, and the exit knows the destination but not your identity.

What each point on the path can see

What "layered encryption" concretely means, and where it stops

Before your first byte of traffic leaves your device, your client negotiates a separate, distinct encryption key with each of the three relays on the circuit and wraps your data in three nested layers — like an onion, which is where the name comes from — encrypted first for the exit relay, then that whole package encrypted again for the middle relay, then that again for the guard.^{Tor Project specification} Each relay, on receiving a relay cell, removes exactly the one layer meant for it using the key it negotiated, revealing only the address of the next hop, and passes the remaining, still-encrypted package onward — the guard can't read what's meant for the middle relay, and the middle relay can't read what's meant for the exit.^{Tor Project specification} That layering stops at the exit relay by construction: the exit is, by design, the hop that removes the final layer and hands your request onward in the form the destination actually expects, whether that's a plain HTTP request or a TLS-wrapped HTTPS one. Layered encryption protects your traffic for exactly as long as it's traveling between Tor relays; the moment it leaves the exit relay toward the open internet, its protection depends entirely on whether the destination itself supports HTTPS, not on anything Tor added.

The sentence most guides skip: the exit relay can read your traffic

If the site you're visiting is plain HTTP rather than HTTPS, the exit relay — the last hop before your traffic reaches the open internet — can read the actual content of what you send and receive, because its job is specifically to unwrap the final layer of Tor's own encryption and forward your request onward in whatever form the destination expects.^{Tor Project specification} This is a basic, structural fact about how the exit position works, and it's the single most practically important consequence of Tor's design that official documentation states only obliquely — it's far more directly stated in community discussion than on Tor Project's own core explainer pages. What it does not mean: the exit relay cannot see who you are, since your real IP address was already stripped away two hops earlier. What it does mean: HTTPS is not optional if you want the content of your traffic protected end to end, and an operator running a malicious exit relay specifically to harvest unencrypted traffic is a documented, real category of attack, not a hypothetical one — Tor Browser's HTTPS-Only mode, on by default, exists specifically to close this gap wherever the destination supports encryption.

What an adversary running both the guard and the exit can do

This is the scenario Tor's whole design is built to make difficult, and it's worth naming plainly rather than leaving it implicit: if the same adversary controls both your guard relay and the exit relay for a given circuit, they can potentially correlate the timing and volume of traffic entering at the guard with traffic leaving at the exit, and infer the connection between you and your destination without ever decrypting anything — a timing and traffic-pattern correlation attack rather than a cryptographic break. Tor's relay selection is designed to make this improbable for any single circuit, since relays are chosen from a large, distributed pool of independently operated servers, and controlling a meaningful fraction of the network's total capacity is expensive and would itself be a detectable, notable event. It becomes a more realistic concern specifically for a global passive adversary — an entity capable of observing traffic at many points across the internet's backbone simultaneously, not merely running a few of Tor's own relays — which is a materially different and much larger threat than an ordinary ISP, a curious website operator, or even most single-country law enforcement agencies.

Traffic analysis: the threat Tor is actually built against

Tor's own explanation of its purpose is precise about the specific threat it defends against: traffic analysis, the practice of inferring who is communicating with whom by examining a connection's metadata — source, destination, size, and timing — rather than its encrypted content.^{Tor Project} Ordinary encryption, including HTTPS, hides what you're saying but not the header information revealing who you're talking to, which is exactly the gap traffic analysis exploits — an encrypted connection to a specific server still tells an observer that you connected to that specific server, at that specific time, for that specific duration. Tor's answer is distributing the connection across several relays specifically so "no single point can link you to your destination" — the project's own analogy is a deliberately hard-to-follow route meant to throw off anyone tailing you, with your tracks erased periodically as circuits rotate.^{Tor Project}

Why this matters beyond hiding wrongdoing

Tor Project's own framing of who actually uses the network is broader than the stereotype: individuals avoiding tracking by advertisers and family members, people in abuse-survivor or illness support communities who need to speak without their identity attached, journalists communicating with sources and whistleblowers, NGO workers connecting home without revealing their affiliation to everyone nearby, and even corporations protecting sensitive internal communications from competitors and eavesdroppers who could otherwise infer business patterns from traffic timing alone.^{Tor Project} The design point that follows from this directly: your own anonymity is a function of how many different kinds of people are using the network alongside you, not just of the cryptography itself — a large, diverse user base is what makes any single user harder to distinguish from the crowd, which is also the practical reason installing extensions or otherwise making your own browser instance unusually distinctive, covered on Tor Browser safety, works against the very protection the network provides.

Why circuits rotate roughly every ten minutes

Tor reuses the same circuit for connections happening within roughly a ten-minute window purely for efficiency — building a fresh three-hop encrypted path for every single request would be wasteful — and then switches to a new circuit for later requests specifically so that your earlier activity on the network can't be linked to what you do next by an observer watching relay-level patterns over time.^{Tor Project} This is separate from, and happens automatically without, the manual "New Identity" and "New Circuit for this site" options covered on the Tor Browser guide — those are reader-triggered actions for specific situations, while the roughly ten-minute rotation is a background property of how the network functions regardless of anything you click.