Explainer

Proxy vs VPN vs Tor: Who You Have to Trust, and What Each One Hides

Proxy, VPN and Tor are different trust models, not points on one scale. Who sees what, and when to use which.

HProxy Team··10 min read
HProxy.Explainer

Skip the dead lists.

Our free proxy list re-checks every exit every few minutes across 100+ countries, with a live last-checked time, so you copy IPs that worked moments ago, not a stale text dump.

Open the free proxy list

Search for any pair of these three and you get a ranking, as though proxy, VPN and Tor were three grades of the same product with hiding as the score. That framing is where most of the bad advice starts, because it treats a trust decision as a performance metric.

They are three different answers to one question: when you stop letting your own network see your traffic, who sees it instead? A proxy hands that visibility to one operator for the apps you point at it. A VPN hands it to one operator for everything your device does. Tor arranges three operators so that no single one holds both halves of the secret. Once the question is framed that way, choosing takes about thirty seconds, and it stops depending on which one a review site called the most private.

The only comparison that matters

Every other difference follows from this one. Ask, for each option, what a party in the path could learn if it wanted to.

Who can see what, assuming you use HTTPS

A proxy or a VPN

  • The operator sees your real IP

    you connected to it directly

  • It sees which sites you visit

    the destination host, on every request

  • It does not see page contents

    TLS still runs end to end

  • One party holds both halves

    who you are, and where you went

Tor

  • The entry relay sees your IP

    and nothing about your destination

  • The exit relay sees the destination

    and nothing about who you are

  • The middle relay sees neither

    it only joins the two

  • No single party holds both

    that separation is the entire design

Source: Tor Project documentation, and the standard proxy and VPN trust model

The left column is not a criticism. Moving visibility from your internet provider to a company you chose is a real improvement when you chose well, and it is the correct trade in plenty of situations. It is simply a transfer of trust rather than a removal of it, and the marketing for both products tends to describe it as the second thing.

What each one actually is

A proxy is a relay that specific applications use. You configure it in a browser, a scraper or a tool, and only that traffic goes through it, which is exactly why automation uses proxies: you can run many of them at once, each application with its own exit address, without touching the rest of the machine. The what is a proxy explainer covers the mechanics, and the difference between types is covered in datacenter vs residential.

A VPN is a relay at the operating-system level. An encrypted tunnel carries everything the device sends, which is its main advantage: nothing has to be configured per application and nothing leaks because you forgot a setting. The cost is the mirror image. One operator now sees the whole picture instead of a slice, and one exit address covers everything you do, so it is a poor fit for anything that needs many identities.

Tor routes each connection through three relays run by unrelated volunteers, wrapped in layers of encryption so each relay can peel exactly one. The entry knows you, the exit knows the destination, and neither knows the other half. That structure is what makes it genuinely different in kind rather than in degree, and it is also the reason it is slow: three hops across the world, chosen for diversity rather than speed.

Path length, and what each hop knows
  1. Proxy or VPN

    one hop, which knows both who and where

  2. Tor entry

    knows who, not where

  3. Tor middle

    knows neither

  4. Tor exit

    knows where, not who

Source: HProxy

Where each one genuinely wins

Use a proxy when the unit of work is a task, not a person. Scraping, price monitoring, ad verification, testing what a page looks like from another country, running tools that each need their own address. This is the only one of the three built for scale and concurrency: a pool gives you many exit addresses at once, which is a requirement no VPN and no Tor circuit satisfies. Our use cases hub covers the shapes this takes.

Use a VPN when the unit is the device. Untrusted wifi, a network whose operator you would rather not have reading your DNS queries, or simply wanting one setting that covers the whole machine including the apps you forget about. It is the right tool for personal browsing, and it is the wrong tool for anything that needs more than one identity.

Use Tor when the adversary is powerful and the stakes are real. Journalism, research, activism, or living somewhere that treats what you read as evidence. Tor is the only option here, because it is the only one that does not ask you to bet everything on a single company keeping its promises, staying uncompromised and not being compelled.

What each one encrypts, which is not what people assume

The most common misunderstanding in this comparison is that all three encrypt your traffic. They encrypt different legs, and on a hostile network the difference is the whole point.

A plain HTTP proxy encrypts nothing of its own. Your connection to the proxy is ordinary traffic. If the site you are visiting uses HTTPS then the contents are protected end to end by that, not by the proxy, and the local network can still see which host you asked for. If the site is plain HTTP, everyone between you and the proxy sees the lot. This is why a proxy is a poor answer to coffee-shop wifi, and it is the same reason free proxies are dangerous with anything sensitive: the operator sits in the same position as the network you were worried about.

A VPN encrypts the first leg unconditionally. Everything from your device to the VPN server is inside the tunnel, including DNS lookups and the traffic of applications you never thought about, so the local network learns only that you are talking to a VPN. Past the server it is back to ordinary internet, protected by whatever the site itself uses.

Tor encrypts in layers as far as the exit. Each relay removes one layer, so the path is protected all the way to the exit relay. From there to the destination it is again whatever the site uses, which is why an exit relay can read plain HTTP and why using Tor without HTTPS was historically how people got caught out.

Read those three together and one rule falls out: none of them protect content the site itself leaves unprotected, and only the VPN protects the leg between you and the first hop. If the threat you care about is the network you are sitting on right now, that last sentence is the whole decision.

Speed, and why the ordering is structural

Latency here is not a quality difference between products, it is a consequence of geometry, which means no vendor can optimise its way out of it.

A proxy adds one hop, and if that hop is near either you or the destination the cost is small. Datacenter proxies are the fastest of the family because they sit on server-grade connections; residential ones vary with the home line they exit through, which is a trade you accept for the trust that a consumer address carries.

A VPN also adds one hop, plus the work of encrypting everything the device sends rather than one application's traffic. In practice it feels similar to a proxy, and the same rule applies: distance to the server dominates everything else.

Tor adds three hops chosen for independence rather than proximity, so a single request may cross several continents before it arrives, and the circuit is shared with other people's traffic. Slowness is therefore not a defect to be fixed in a future version. It is the price of the property that makes Tor worth using, and any service claiming to give you Tor's anonymity at a proxy's speed is claiming to have solved geometry.

Where each one is the wrong tool

A proxy is wrong for whole-device privacy. Configure it in a browser and everything else on the machine, including the operating system's own chatter, still goes out on your real address. If your goal is that nothing on this laptop touches the network directly, a proxy does not do that job.

A VPN is wrong for automation and for defended sites. Commercial VPN address ranges are well known and widely categorised, so on a site with any bot management a VPN address is frequently a worse starting position than the home address you were trying to hide, which is one of the signals we cover in how websites detect proxies. It also gives you one address, and scale needs many.

Tor is wrong for scraping, and this deserves more than a shrug. Practically, the exit relay list is public and updated continuously, so any site that cares will challenge or block it and your success rate falls through the floor. Ethically, that bandwidth is donated by volunteers and maintained for people who use it to stay safe, and pointing a scraper at it takes capacity from those people while contributing nothing. There is a whole industry of proxies built for automated traffic. Use it.

Tor is also wrong for streaming and for logins. You do not choose your exit country, the circuit changes, and a service that sees a login arrive from a different continent every few minutes will treat the account as compromised, which is the same rotation problem covered in sticky vs rotating sessions.

The part all three share

None of them help once you identify yourself.

Log into an account and the network path becomes almost irrelevant, because the site now has a name attached to the session and the IP is a detail. The same is true of a browser fingerprint that is unique enough to follow across circuits, of cookies that survive a network change, and of behaviour that is recognisable regardless of where it arrives from. The network layer is one of several, and it is the only one any of these three touch.

This is why "which is most anonymous" is usually the wrong question and "what am I actually trying to hide, and from whom" is the right one. Hiding your home address from a website you have never logged into is a network problem, and any of the three can do it. Hiding your identity from a service you have an account with is not a network problem at all.

Picking in thirty seconds

  1. Is the traffic automated, or does it need more than one address at a time? Proxy. Nothing else does concurrency.
  2. Do you want one setting covering the whole device on a network you do not trust? VPN.
  3. Would being identified cause you real harm? Tor, and take the time to read the Tor Project's own guidance rather than a comparison article, this one included.
  4. Are you trying to look like an ordinary visitor to a defended site? A residential proxy, because that is the only option of the three whose address is registered to a consumer internet provider rather than to a hosting company or a public relay list.

We sell the first one, so treat the recommendation with the appropriate suspicion and note where it points against us: for personal browsing on hostile wifi, buy a VPN instead, and for anything where identification is dangerous, use Tor and do not let a proxy vendor talk you out of it.

Where a proxy is genuinely the answer, you can test the idea before spending anything. Our free proxy list is live and re-checked every few minutes across a hundred-plus countries, and the proxy checker shows what any address really looks like from the other side: the exit country, the network that owns it, and the anonymity grade a site will read. When a job outgrows free, residential proxies start at $0.50/GB for one gigabyte with no subscription, which is a cheap way to find out whether the network layer was ever your problem.

Frequently asked questions

What is the difference between a proxy, a VPN and Tor?
A proxy relays traffic for the applications you point at it, and the operator can see where you are going. A VPN relays everything the whole device sends, and its operator can see the same thing across all of it. Tor relays through three independent hops arranged so that no single one knows both who you are and where you are going. The first two move your trust to a company. Only the third is designed so that nobody has to be trusted individually.
Is Tor safer than a VPN?
Against surveillance, yes, because its design does not require you to trust any single operator, while a VPN concentrates every piece of your traffic at one company. Against everyday problems it is often worse: Tor is slow, its exit addresses are published and widely blocked, and a misconfigured browser leaks identity through the application rather than the network. Safer depends entirely on what you are hiding from.
Can I use a proxy and a VPN at the same time?
Yes, and it is common in automation, where the VPN covers the machine and the proxy covers a specific tool. It adds latency and one more operator to trust, so it is worth doing only when each layer has a job. Stacking them for extra anonymity does not work the way people expect, because the weakest link is usually the browser fingerprint rather than the network path.
Why not use Tor for web scraping?
Two reasons, one practical and one ethical. The exit relay list is public, so major sites challenge or block it on sight and your success rate collapses. And the network is donated bandwidth maintained by volunteers for people who need it to speak safely, which a scraper consumes without contributing. Use residential or datacenter proxies for automation; that is what they exist for.
Does a VPN hide me from websites?
It hides your home IP address and shows the VPN's instead. That is one signal out of many. Sites still read your browser fingerprint, cookies, timing and any account you log into, and commercial VPN address ranges are well known and frequently treated with suspicion, so it can make you more conspicuous rather than less on defended sites.
Which one should I use for accessing content in another country?
A proxy for one app or one task, a VPN for the whole device, and not Tor, because exit location is not something you choose and most streaming services block it. If the task is automated or you need many different addresses, the answer is a proxy, because that is the only one of the three built for running many identities at once.

Get proxies that are alive right now

Our free list re-checks every exit every few minutes and shows a last-checked time, so you copy IPs that worked moments ago, not a stale text dump. When the location has to survive a real check, the paid network holds up.

129M+ proxy checks run · 100+ countries · HTTP / HTTPS / SOCKS · re-checked every few minutes · no signup