Tor, short for The Onion Router, is free software and a network of volunteer-run relays that protects privacy online. It stops someone watching a connection from learning which sites a user visits, and it stops those sites from learning the user’s physical location. Most people use it through Tor Browser, a web browser built by the Tor Project for privacy.

How it works

• The client builds a circuit of encrypted connections through several relays, one hop at a time.
• Each relay only knows the previous and the next hop, never the full path.
• Data is wrapped in layers of encryption, one for each hop, which gives onion routing its name.
• Onion services use .onion addresses and can only be reached inside the Tor network, which also hides the server’s location.

Why it matters for dark web monitoring

Tor has many legitimate uses, from protecting sources to avoiding censorship. The same anonymity also makes it the main home of the dark web, where criminal forums, shops and data leak sites run as onion services. Defenders cannot simply block or search this space with normal tools. Monitoring services therefore collect content from onion services in a controlled way, so that leaked company data and stolen credentials can be found without visiting criminal sites directly.

Sources: Tor Project: What is Tor?, Tor Project: How Tor works, overview