Yes — Tor exit IPs come from a public relay list, so sites match them instantly. See how detection works at the IP and browser layers, and what bridges hide.
Yes, a website can usually tell that you are using Tor, and it does so far more reliably than it can spot a VPN. The reason is structural: Tor clients need a public list of relays to build circuits, so the addresses of exit relays are published by design. A destination site only has to compare your connecting IP against that list. This guide explains what a website can see, which signals give Tor away at the IP layer and at the browser layer, why sites block or challenge Tor traffic, and why hiding Tor from your network is a different problem from hiding it from the website.
Key Takeaways
- Detecting Tor is a lookup, not a guess. Exit relays are listed publicly so clients can find them; a site checks your IP against that list and gets a near-certain answer.
- Bridges and WebTunnel protect you from your network, not from the destination. They make your connection to Tor look like ordinary HTTPS, but traffic still leaves through a public exit relay that the website can recognise.
- Not all Tor traffic comes from Tor Browser. The Tor Project's Android Tor VPN Beta gives each app its own circuit, so a site may see a Tor exit IP paired with an ordinary phone environment.
- The browser layer is a second tell. Tor Browser makes users look alike; that uniformity can itself be recognisable.
- Being flagged is not the same as being suspected. Blocks on Tor mostly reflect shared-IP abuse concentration, not a judgement about you.
Why detecting Tor is easier than detecting a VPN
Detecting a VPN is a game of heuristics: datacenter ranges, geolocation mismatches, leaks and confidence scores. A VPN provider can rotate addresses, buy residential ranges and stay ahead of the lists, so detectors are always guessing.
Tor works differently. To build a circuit, your client must learn which relays exist and which are allowed to act as exits. That directory is public by design, since a secret relay list would be useless to the volunteers and users the network depends on. The consequence is that the set of IPs your traffic can emerge from is enumerable by anyone. A website that wants to know whether a visitor is on Tor does not need machine learning; it downloads the list and matches the connecting address. The Tor Project itself publishes relay data for exactly this kind of transparency, which is also what lets site operators make their own decisions about Tor traffic.
You can see the practical result yourself: your exit IP will typically show up as hosting or proxy infrastructure with an unrelated country and ASN. Run the VPN/proxy check or IP intelligence while connected to see what your current exit IP looks like to a website. Note that BrowserInsight reports proxy and hosting classification and ASN ownership; it does not issue a dedicated "this is Tor" verdict.
The IP layer: what an exit relay tells a site
When you browse through Tor, the website never sees your address. It sees the exit relay: the last of the three hops your traffic passes through. That single address reveals several things:
- It is on the public exit list. This is the decisive signal, and it is essentially binary. The main caveat is freshness: a list is only as current as its last update, so a relay that has only just started serving as an exit can briefly be missed.
- It belongs to a hosting network. Most relays run in datacenters, so the ASN looks like a cloud provider rather than a home ISP, the same class of signal covered in how sites detect VPNs.
- It is shared. Thousands of people can leave through one exit at the same time, so its reputation is the pooled behaviour of everyone using it.
- Its location is unrelated to you. Country-level geolocation reflects the exit, not your real location, which can also cause a timezone or locale mismatch if your browser is not configured to hide it.
What the site does not learn is your real IP, or which other sites you visited over the same circuit. That is what Tor is for.
The browser layer: uniformity as a signature
Tor Browser adds a second layer of recognisability. Its anti-fingerprinting design deliberately makes users look identical: standardised window sizes through letterboxing, a fixed reported timezone, a uniform User-Agent and reduced access to high-entropy APIs, as covered in resistFingerprinting explained. The goal is to put every Tor Browser user in one large anonymity set.
The side effect is that the set is identifiable as a set. A visitor whose window is exactly a stock size, whose timezone is fixed and whose canvas and font surface look generic can be classified as "probably Tor Browser" even before the IP is checked. Two signals that agree, an exit IP and a Tor Browser profile, make detection very confident. When they disagree, for example a Tor exit IP with a normal mobile fingerprint, the site has to decide which one to believe.
That disagreement is exactly the situation the Tor VPN Beta creates.
What Tor VPN changes (and what it doesn't)
On 9 September 2026 the Tor Project described its Android Tor VPN Beta, built on Arti, its Rust implementation of Tor. Its notable design choice is that each app on the device gets its own Tor circuit rather than sharing one tunnel, so activity from one app cannot easily be linked to another.
For detection, the consequence is worth stating carefully:
- The IP still says Tor. Traffic leaves through the same public exit relays, so the IP-layer lookup works exactly as before.
- The environment says "ordinary phone". An app or system WebView is not Tor Browser, so it does not carry Tor Browser's uniform fingerprint. A site sees a Tor exit IP alongside a normal Android device profile.
So Tor traffic is not always Tor Browser traffic, and when the browser layer looks ordinary, the exit IP is the signal that still gives Tor away. This does not make you invisible; it only changes which signal identifies you.
Bridges and WebTunnel: hiding from your network, not the website
People often conflate two different observers, which means two different questions:
- Can my ISP or a censor tell I am connecting to Tor?
- Can the website tell my traffic came out of Tor?
Bridges answer only the first. Ordinary Tor connections go to publicly listed entry relays, so a network that wants to block Tor can block those addresses. Bridges are unlisted entry points. WebTunnel, announced in March 2024, wraps the connection in a WebSocket-like HTTPS session so it looks like a visit to an ordinary web server. The Tor Project notes it can even share a domain, IP and port with a real website. The Tor VPN Beta post says WebTunnel bridges were prioritised because they help Tor traffic look like regular encrypted web traffic in heavily censored regions.
Here is what that does not touch: the far end. After the bridge, the entry relay and the middle relay, your traffic still exits through a public exit relay, and the destination website sees that exit address. A bridge protects the first hop; the exit list applies to the last one. That is why someone can be undetectable to their ISP as a Tor user and still be recognised as Tor by every website they visit.
| Observer | Sees your real IP? | Can tell you use Tor? | What limits it |
|---|---|---|---|
| Your ISP or network | Yes | Yes for normal connections; much harder with a bridge such as WebTunnel | Bridge hides the entry connection |
| The destination website | No | Yes, by matching the exit IP to the public list | Nothing on your side changes the exit address |
| A tracker across sites | No | Often, via exit IP plus browser signals | Tor Browser's uniformity or per-app circuits |
Why sites block or challenge Tor
Detection is one step; what a site does afterwards is a policy choice, and the reasons are mostly about shared addresses:
- Abuse concentrates on exits. Because many users share few exit IPs, a scraper, spammer or credential-stuffer using one exit taints it for everyone, and reputation systems score the address, not the person.
- Fraud systems treat anonymising IPs as risk. A proxy or hosting flag raises a risk score even when the account is legitimate.
- Rate limits are per IP. A shared exit hits per-address limits faster, producing repeated CAPTCHAs or challenges, similar to the behaviour described in why Cloudflare shows a challenge.
The result can feel personal, but it is not. If you are legitimate and still flagged, the same mechanism explains false VPN flags: your address inherited a reputation you did not earn. The right response is to understand what your traffic looks like, not to search for ways around a site's policy.
What to check yourself
To see your side of this from a website's point of view:
- Look at your exit IP. Use the VPN/proxy check and IP intelligence to see whether the address is classified as hosting or proxy infrastructure and which network owns it.
- Compare your browser signals. Check whether your browser language, timezone and fingerprint tell a consistent story with your apparent location. See VPN vs fingerprinting for why changing your IP does not change your fingerprint.
- Separate the two questions. Decide whether you are trying to hide from your network or from the sites you visit; a tool that solves one does not solve the other. Privacy tools compared maps each tool to the observer it addresses.
Frequently Asked Questions
Can websites detect Tor?
Usually yes. Exit relays are publicly listed so clients can build circuits, and a website can match your connecting IP against that list. Detection is far more dependable than for VPNs, which rely on heuristics.
Can websites see my real IP if I use Tor?
No. The site sees the exit relay's address, not yours. What it can tell is that the traffic came through a Tor exit, and Tor Browser's uniform fingerprint can be a second hint.
Do Tor bridges hide Tor from websites?
No. Bridges and WebTunnel hide your connection to Tor from your ISP or a censor by making it look like ordinary HTTPS. Your traffic still leaves through a public exit relay, which the website can recognise.
Does Tor VPN on Android make me undetectable?
No. Each app gets its own Tor circuit, but the traffic still exits through a Tor exit relay, so the IP still identifies Tor. What changes is that the browser or app environment looks like an ordinary phone rather than Tor Browser.
Why do so many sites show CAPTCHAs or blocks for Tor?
Exit IPs are shared by many users, so abuse from one person affects everyone's reputation on that address, and per-IP rate limits trigger sooner. It is a shared-address effect, not a judgement about you.
Conclusion
Tor detection is a lookup against a list that Tor publishes on purpose, backed at the browser layer by the uniformity that Tor Browser creates. Bridges and WebTunnel solve a different problem, keeping the connection to Tor from being blocked or noticed by your network, and do nothing about the exit address a website sees. New entry points such as the Tor VPN Beta shift which signal identifies you, but the exit IP remains public. Knowing which observer you are dealing with is the first step to choosing the right tool.
Recommended Reading:
