Search for any pair of these three and you get a ranking, as though proxy, VPN and Tor were three grades of the same product with hiding as the score. That framing is where most of the bad advice starts, because it treats a trust decision as a performance metric.
They are three different answers to one question: when you stop letting your own network see your traffic, who sees it instead? A proxy hands that visibility to one operator for the apps you point at it. A VPN hands it to one operator for everything your device does. Tor arranges three operators so that no single one holds both halves of the secret. Once the question is framed that way, choosing takes about thirty seconds, and it stops depending on which one a review site called the most private.
The only comparison that matters
Every other difference follows from this one. Ask, for each option, what a party in the path could learn if it wanted to.
A proxy or a VPN
The operator sees your real IP
you connected to it directly
It sees which sites you visit
the destination host, on every request
It does not see page contents
TLS still runs end to end
One party holds both halves
who you are, and where you went
Tor
The entry relay sees your IP
and nothing about your destination
The exit relay sees the destination
and nothing about who you are
The middle relay sees neither
it only joins the two
No single party holds both
that separation is the entire design
The left column is not a criticism. Moving visibility from your internet provider to a company you chose is a real improvement when you chose well, and it is the correct trade in plenty of situations. It is simply a transfer of trust rather than a removal of it, and the marketing for both products tends to describe it as the second thing.
What each one actually is
A proxy is a relay that specific applications use. You configure it in a browser, a scraper or a tool, and only that traffic goes through it, which is exactly why automation uses proxies: you can run many of them at once, each application with its own exit address, without touching the rest of the machine. The what is a proxy explainer covers the mechanics, and the difference between types is covered in datacenter vs residential.
A VPN is a relay at the operating-system level. An encrypted tunnel carries everything the device sends, which is its main advantage: nothing has to be configured per application and nothing leaks because you forgot a setting. The cost is the mirror image. One operator now sees the whole picture instead of a slice, and one exit address covers everything you do, so it is a poor fit for anything that needs many identities.
Tor routes each connection through three relays run by unrelated volunteers, wrapped in layers of encryption so each relay can peel exactly one. The entry knows you, the exit knows the destination, and neither knows the other half. That structure is what makes it genuinely different in kind rather than in degree, and it is also the reason it is slow: three hops across the world, chosen for diversity rather than speed.
Proxy or VPN
one hop, which knows both who and where
Tor entry
knows who, not where
Tor middle
knows neither
Tor exit
knows where, not who
Where each one genuinely wins
Use a proxy when the unit of work is a task, not a person. Scraping, price monitoring, ad verification, testing what a page looks like from another country, running tools that each need their own address. This is the only one of the three built for scale and concurrency: a pool gives you many exit addresses at once, which is a requirement no VPN and no Tor circuit satisfies. Our use cases hub covers the shapes this takes.
Use a VPN when the unit is the device. Untrusted wifi, a network whose operator you would rather not have reading your DNS queries, or simply wanting one setting that covers the whole machine including the apps you forget about. It is the right tool for personal browsing, and it is the wrong tool for anything that needs more than one identity.
Use Tor when the adversary is powerful and the stakes are real. Journalism, research, activism, or living somewhere that treats what you read as evidence. Tor is the only option here, because it is the only one that does not ask you to bet everything on a single company keeping its promises, staying uncompromised and not being compelled.
What each one encrypts, which is not what people assume
The most common misunderstanding in this comparison is that all three encrypt your traffic. They encrypt different legs, and on a hostile network the difference is the whole point.
A plain HTTP proxy encrypts nothing of its own. Your connection to the proxy is ordinary traffic. If the site you are visiting uses HTTPS then the contents are protected end to end by that, not by the proxy, and the local network can still see which host you asked for. If the site is plain HTTP, everyone between you and the proxy sees the lot. This is why a proxy is a poor answer to coffee-shop wifi, and it is the same reason free proxies are dangerous with anything sensitive: the operator sits in the same position as the network you were worried about.
A VPN encrypts the first leg unconditionally. Everything from your device to the VPN server is inside the tunnel, including DNS lookups and the traffic of applications you never thought about, so the local network learns only that you are talking to a VPN. Past the server it is back to ordinary internet, protected by whatever the site itself uses.
Tor encrypts in layers as far as the exit. Each relay removes one layer, so the path is protected all the way to the exit relay. From there to the destination it is again whatever the site uses, which is why an exit relay can read plain HTTP and why using Tor without HTTPS was historically how people got caught out.
Read those three together and one rule falls out: none of them protect content the site itself leaves unprotected, and only the VPN protects the leg between you and the first hop. If the threat you care about is the network you are sitting on right now, that last sentence is the whole decision.
Speed, and why the ordering is structural
Latency here is not a quality difference between products, it is a consequence of geometry, which means no vendor can optimise its way out of it.
A proxy adds one hop, and if that hop is near either you or the destination the cost is small. Datacenter proxies are the fastest of the family because they sit on server-grade connections; residential ones vary with the home line they exit through, which is a trade you accept for the trust that a consumer address carries.
A VPN also adds one hop, plus the work of encrypting everything the device sends rather than one application's traffic. In practice it feels similar to a proxy, and the same rule applies: distance to the server dominates everything else.
Tor adds three hops chosen for independence rather than proximity, so a single request may cross several continents before it arrives, and the circuit is shared with other people's traffic. Slowness is therefore not a defect to be fixed in a future version. It is the price of the property that makes Tor worth using, and any service claiming to give you Tor's anonymity at a proxy's speed is claiming to have solved geometry.
Where each one is the wrong tool
A proxy is wrong for whole-device privacy. Configure it in a browser and everything else on the machine, including the operating system's own chatter, still goes out on your real address. If your goal is that nothing on this laptop touches the network directly, a proxy does not do that job.
A VPN is wrong for automation and for defended sites. Commercial VPN address ranges are well known and widely categorised, so on a site with any bot management a VPN address is frequently a worse starting position than the home address you were trying to hide, which is one of the signals we cover in how websites detect proxies. It also gives you one address, and scale needs many.
Tor is wrong for scraping, and this deserves more than a shrug. Practically, the exit relay list is public and updated continuously, so any site that cares will challenge or block it and your success rate falls through the floor. Ethically, that bandwidth is donated by volunteers and maintained for people who use it to stay safe, and pointing a scraper at it takes capacity from those people while contributing nothing. There is a whole industry of proxies built for automated traffic. Use it.
Tor is also wrong for streaming and for logins. You do not choose your exit country, the circuit changes, and a service that sees a login arrive from a different continent every few minutes will treat the account as compromised, which is the same rotation problem covered in sticky vs rotating sessions.
The part all three share
None of them help once you identify yourself.
Log into an account and the network path becomes almost irrelevant, because the site now has a name attached to the session and the IP is a detail. The same is true of a browser fingerprint that is unique enough to follow across circuits, of cookies that survive a network change, and of behaviour that is recognisable regardless of where it arrives from. The network layer is one of several, and it is the only one any of these three touch.
This is why "which is most anonymous" is usually the wrong question and "what am I actually trying to hide, and from whom" is the right one. Hiding your home address from a website you have never logged into is a network problem, and any of the three can do it. Hiding your identity from a service you have an account with is not a network problem at all.
Picking in thirty seconds
- Is the traffic automated, or does it need more than one address at a time? Proxy. Nothing else does concurrency.
- Do you want one setting covering the whole device on a network you do not trust? VPN.
- Would being identified cause you real harm? Tor, and take the time to read the Tor Project's own guidance rather than a comparison article, this one included.
- Are you trying to look like an ordinary visitor to a defended site? A residential proxy, because that is the only option of the three whose address is registered to a consumer internet provider rather than to a hosting company or a public relay list.
We sell the first one, so treat the recommendation with the appropriate suspicion and note where it points against us: for personal browsing on hostile wifi, buy a VPN instead, and for anything where identification is dangerous, use Tor and do not let a proxy vendor talk you out of it.
Where a proxy is genuinely the answer, you can test the idea before spending anything. Our free proxy list is live and re-checked every few minutes across a hundred-plus countries, and the proxy checker shows what any address really looks like from the other side: the exit country, the network that owns it, and the anonymity grade a site will read. When a job outgrows free, residential proxies start at $0.50/GB for one gigabyte with no subscription, which is a cheap way to find out whether the network layer was ever your problem.