Tor Browser is a free, privacy-focused browser that hides who you are online by bouncing your traffic through several volunteer-run servers before it reaches a website. It is the main tool people use to reach the dark web, the hidden part of the internet that ordinary search engines do not index. Tor itself is legal to use in most countries, including Malaysia, and serves many legitimate purposes. The risk comes from what a person does with it, not the browser alone.
This guide explains how Tor works through onion routing, the real difference between the surface web, deep web, and dark web, the legitimate and criminal uses, and the practical safety steps that matter most before you open it.
Tor Browser is software built to keep you anonymous while you browse. The name stands for The Onion Router, which describes how it works: it wraps your data in several layers of encryption and routes it through a chain of relays so no single point sees both who you are and where you are going. This makes it hard for trackers, internet providers, hackers, or surveillance systems to connect your identity to your activity. Journalists, activists, researchers, and privacy-conscious users rely on it for that reason.
Tor began in the mid-1990s as a project at the U.S. Naval Research Laboratory to protect government communications. It later became open-source, and The Tor Project was founded in 2006 as the non-profit that maintains it today. As of 2025, the network runs on roughly 8,000 volunteer relays and serves an estimated 2 to 2.5 million daily users worldwide, according to Tor Project metrics.
Tor is best known for its link to the dark web, where it is used to reach hidden services. That association makes it controversial, even though most Tor traffic is ordinary, lawful browsing.
Tor works on a principle called onion routing. Your data is wrapped in layers of encryption, like the layers of an onion, and each relay in the path can peel back only one layer. Each relay knows just enough to pass the data to the next hop, never the full route or your identity.
When you browse through Tor, your request does not travel straight to the website. It passes through three volunteer-operated relays, also called nodes:
This split is the whole point: no single relay can link your identity to your browsing. The Tor Project's own documentation describes the same three-hop circuit design.
Think of sending a parcel sealed inside three nested boxes. You hand it to courier A, who can open only the outer box and finds an instruction to pass it to courier B. Courier B opens the next box and is told to hand it to courier C, who opens the last box and delivers the parcel. No courier knows both the original sender and the final contents. That is how a Tor circuit protects you.
People often confuse these three terms. They describe different layers of the internet, and only the last one depends on Tor.
| Layer | What it is | How you reach it |
|---|---|---|
| Surface web | Public pages indexed by Google and Bing | Any standard browser |
| Deep web | Legitimate content behind logins or paywalls: email inboxes, bank portals, academic databases, internal company systems | Standard browser plus credentials |
| Dark web | Hidden services on .onion domains, not indexed anywhere, deliberately anonymous | Tor Browser (or similar networks) |
The deep web is large and mostly harmless. The dark web is a small slice of it. As Kaspersky notes, the dark web is reached through specialised browsers like Tor and hosts both privacy-protecting services and criminal marketplaces. For a fuller comparison, read our guide to the dark web versus the deep web.
Most dark web sites use the .onion domain, which only resolves inside the Tor network. Because Tor hides IP addresses, it is difficult for authorities to trace who runs or visits these sites. That same anonymity protects whistleblowers and also shields criminals. Both legitimate and illicit uses sit on the same network.
To understand how stolen records change hands after a breach, read our breakdown of how dark web black markets operate.
Using Tor Browser is legal in most countries, including Malaysia, the United States, and the United Kingdom. Downloading and running it is not a crime. What can be illegal is the activity carried out through it, such as buying stolen data, drugs, or weapons. As LegalVision explains, the browser is lawful but the dark web exposes users to illegal marketplaces they may stumble into.
In Malaysia, accessing leaked personal data, dealing in it, or using it for fraud can fall foul of the Personal Data Protection Act 2010 (Act 709) and the Computer Crimes Act 1997. The takeaway is simple: the tool is legal, but what you do on the dark web can carry real legal consequences.
Tor hides your identity, but it does not make every action safe. The dark web is unregulated, and malware, phishing, and scams are common. These steps reduce the most common risks.
One limitation stands out: the exit node can see unencrypted traffic. Always look for HTTPS, and treat anything you send through Tor as potentially observable at that last hop.
For organisations, the dark web is where stolen credentials end up after a breach. A single reused employee password traded on an .onion market can open the door to a full account takeover. This is why dark web monitoring and strong security habits matter beyond individual privacy.
SiberMate helps companies reduce this human risk through security awareness training, phishing simulation, and breach monitoring, so a leaked password is caught before it becomes an incident. Building that awareness across a workforce is the practical defence against threats that begin on the dark web. Learn more in our guide to why dark web monitoring is important.
Yes. Tor Browser is the main way to reach .onion dark web sites, because those addresses only resolve inside the Tor network. Using Tor for the dark web is not illegal by itself, but many dark web pages host scams or illegal content.
Visiting the dark web is generally not illegal in most countries, including Malaysia. The crime is in specific actions, such as buying stolen data or illegal goods. Users can also encounter illegal content unintentionally, which is why caution matters.
No. Tor strongly protects anonymity, but the exit node can see unencrypted traffic, and logging into personal accounts or downloading files can expose you. Combining Tor with safe habits, such as the "Safest" setting and HTTPS-only sites, gives better protection.
No. Tor Browser is a privacy tool. The dark web is a set of hidden sites you can reach with it. Most Tor use is ordinary, lawful browsing, not dark web activity.
Your internet provider can see that you are connecting to Tor, even if not what you do. A no-logs VPN before Tor hides that fact from your provider and adds a layer of privacy, though it is not required for Tor to work.
Tor Browser is a powerful anonymity tool with genuine value for privacy, free expression, and security research. It is also the gateway to the dark web, where stolen data and illegal goods are traded. The browser is legal in Malaysia and most countries; the legal risk lies in what people do with it.
For individuals, safe use comes down to downloading from the official source, locking down security settings, and never sharing real information. For businesses, the deeper lesson is that the dark web is where breaches are monetised, which makes cybersecurity awareness across your team the strongest line of defence.