Imagine the following police investigation: Investigators request information from, for example, Facebook, from a certain profile. Facebook delivers the IP address associated with the profile, and leads investigators to an exit node from Tor. If the node stored the IP addresses, the police could pull the thread: they would request information about the stored IPs from the appropriate agencies, such as Internet access providers, and they would go as far as an intermediate node, and then to the entry node, which does know the clients' IP.

I know that this assumption is very complex, because nodes handle many connections (researchers could find thousands of IPs to analyze) and, in addition, the nodes of a connection are usually in different countries. But the question is the same: Do the Tor nodes, by default, store the IP of the incoming connections?

Translated with www.DeepL.com/Translator

1 Answer 1


Only the Guard node would ever see your IP. The exit node would not see it and the middle node would not see it and the Guard node does not cache it in any way. Furthermore your connection changes every 10 minutes and most of the time each hop is in another country. The police would have to break Tor encryption multiple times through multiple servers in multiple countries and work their way back through each node to even find the Guard node. This is so unlikely that it has never been proven to be possible.

A much more likely scenario: The website uses a javascript vulnerability that hasn't been patched and your browser calls directly to the police and says "hey look at me!"

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .