From everything I've seen and read about Tor, it seems like the exit nodes are the single point of potential failure if one is using Tor as a client. Stated differently, from what I understand the exit nodes are the only way for someone to see a user's traffic and pinpoint it back to the Tor client.

How safe are they exactly, or how likely is it they could be compromised and watching traffic without anyone ever knowing?

4 Answers 4


If you are only a Tor client (e.g. you're using Tor Browser to browse the web), you are not an exit node, or any node at all, and you are fine. Nobody will be able to tell where your traffic is going, except of course the exit node. Granted, some exit nodes might do some shady things, so HTTPS over Tor is your best option for maximum security and privacy.

If you're actively running a Tor node (i.e. you're listed as a possible route by the Tor directory authorities), that's different from just being a user. You can't be a node by accident; you have to set some stuff up. If you're not an exit node, then everything that goes through your server is encrypted, and no web service is going to know you were even involved.

If you're an exit node, then web services know traffic is going through you. Then you could get into a little trouble. The most notable thing that will happen is that you will be deluged in DMCA notices. Fortunately, that's not your fault, and Tor prepared a response letter for you. Your ISP might not be alright with you running an exit node (or any kind of proxy), and some might just disconnect you. There is a list of good and bad ISPs in this regard. Because of that, and because of warrant/seizure laws, running an exit node from your home computer(s) is almost certainly a bad idea. You'll also run into legal problems if you snoop on the outgoing traffic, but hopefully you're a good guy and aren't doing that anyway. Further reading: Legal FAQ for relay operators.

In summary, Bad ThingsTM will probably only happen if you're explicitly set up as an exit node, and even so, you'll probably be alright if you take the appropriate precautions as outlined in Tor documentation. If you don't run an exit node, you're good.

  • You kind of hit the nail on the head for part of what I'm looking for - "Nobody will be able to tell where your traffic is going, except of course the exit node." So..... this is what I'm trying to get at.... how safe is the exit node, considering that's the only person who can see what I'm doing?
    – SomeGuy
    Commented Jul 13, 2018 at 14:26

well nobody will be able to tell you "How safe are they exactly", especially as long as you don't describe exactly what you mean with "see a user's traffic".

but to make it easily understandable and not jump deeper into advanced technical details - as skarz partly mentioned, just using HTTPS and HSTS will do the trick. so usually exit nodes will only see, that some Tor-user is surfing on site "www.domain.tld", but nothing else.

i'm pretty sure this site is very interesting for you and playing a little bit around with it will make things clear:

if you are still interested into a little bit more details, this is a still not techy more detailed answer to a more concrete question.

  • The last link showed me what I was looking for.
    – SomeGuy
    Commented Jul 16, 2018 at 0:38

I think the exit nodes can’t see anything if you are using an onion site. I think they can see your traffic and modify it if your using a website with http and not https. However, if your using https then they can’t modify it, but they can see the website domain. To avoid using an insecure on clear net, make sure https everywhere is set to E.A.S.E. Darknet is always more secure then clear net because the exit node can’t see or modify anything regardless of http or https.

  • you are right, but to make it more clear: if you are surfing on onion-sites (with no gateway) you are staying in the darknet and don't even use an exit node. Commented Mar 22, 2019 at 18:09
  • @DJCrashdummy did not know that.... it makes perfect sense, but I never would have thought about it.
    – SomeGuy
    Commented Mar 22, 2019 at 20:04

What is important to understand is that Tor is not tunneling your packets like a VPN. The Exit-Node builds the TCP connection! It can redirect you to an arbitrary server. Read all the traffic. Redirect you to any port, etc. ... Furthermore it resolves your DNS request. The only thing you can do is using TLS. But even TLS certificates can be compromised. It would be very intersting if DANE and DNSSEC could be used to solve all this stuff.

  • There is not too many globally accepted CA, and the chance that a tor exit node owner would have control over one of them, is practically negligible. Maybe various... "services" might ask things from universally accepted CA providers and also use intermediary entities to drive so many tor exit nodes as possible. I think, that would work. What can happen more likely: user users tor browser and feel himself safe, gets some cert warnings and clicks "ignore warnings, go to the site" reflexively.
    – peterh
    Commented Jan 29 at 18:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .