Onion over VPN is a method of combining Virtual Private Networks with the Tor Browser. Tor Browser is widely used to ensure users’ online activities cannot be traced to the original source. It is also used to access websites hosted solely on the onion network. Tor Browser is primarily an anonymity-oriented browser, while VPNs are cybersecurity and privacy protection applications. They can strengthen each other, but that’s beneficial only in some situations. In this article, I’ll explain how Onion over VPN works and when you should and shouldn’t use it.
How Does Onion Over VPN Work
To see what the VPN adds, it helps to start with how Tor works on its own. The Tor Browser encrypts your traffic and routes it through three volunteer-run servers, called relays: the guard, the middle, and the exit. Your traffic is wrapped in three layers of encryption, and each relay peels off one layer, like an onion.
- Guard relay. Receives your traffic and strips the outer layer of encryption, then passes it on. This is the only relay that knows your real IP address, which is the weak point a VPN later fixes.
- Middle relay. Strips the second layer to reveal the exit relay’s address. Crucially, it knows neither your IP address nor the site you’re visiting, it only sees traffic passing between the other two relays.
- Exit relay. Removes the final layer and forwards your traffic to the website. It knows the destination, but not who you are. This separation of “who” from “where” is what makes Tor a high-anonymity network.
Where the VPN comes in
Tor on its own leaves two gaps. The guard relay still sees your real IP address, and your ISP can still tell you’re connected to the Tor network. Onion over VPN closes both.
When you connect to the VPN first, it wraps the already thrice-encrypted packet in one more layer of encryption and sits between you and the Tor network as a forward proxy. The guard relay now receives traffic from the VPN’s IP address instead of yours, so it never sees your real one. Your ISP, meanwhile, only sees an ordinary VPN connection, not that you’re using Tor.
The payoff is resilience. Tor relays are run by volunteers, so some could be malicious. But even if the guard and exit relays are both compromised, your real IP stays hidden, because the VPN server is handling all communication on your behalf. You get Tor’s anonymity and the VPN’s protection at once, with strong cover from third-party surveillance.
How To Set up Onion Over VPN Step by Step
In NordVPN, you can find it by clicking ‘All locations’ from the main window to access specialty servers. Then choose the Onion over VPN option. Connect to one of the servers, and you can use any browser to access the Tor network. 
In ProtonVPN, simply locate the Tor option on the left side of the main menu and connect to one of the servers. 
In AirVPN, go to Preferences on the lower left and configure the Proxy/Tor section. 
AirVPN also handles it differently. Its method is to position the VPN server as the exit node. This way, users’ traffic goes through the Tor relays first, and is then forwarded to the AirVPN server, which sends it to the target destination. This is useful for browsing websites that block Tor connections. You must also have the Tor Browser installed on your device. For all other VPNs we have tested:
- Download Tor Browser from its website and install it.
- Connect to your preferred VPN’s server.
- Launch the Tor Browser and click Connect.
- Enter the website’s address and start browsing.
Here’s me accessing the Radio Free Europe .onion website via Surfshark on the Tor network. 
Benefits and Drawbacks of Onion Over VPN
Before wrapping up, I’ll summarize the benefits and setbacks of Onion over VPN in the table below.
| Advantages | Disadvantages |
| Hides IP address from the Tor guard relay | Expect a significant speed drop |
| Hides the Tor connection from your ISP | Still vulnerable to global traffic correlation attacks |
| Provides access to .onion websites | Still exposed to Tor relay corruption |
| Bypasses local Tor blocks | Does not fully prevent browser fingerprinting |
| Adds VPN cybersecurity benefits to Tor Browser | Relies on trusting your VPN provider |
Who Should Use Onion Over VPN (And Who Shouldn’t)
In reality, a VPN alone is more than enough to protect online privacy for casual internet users. However, users in the following groups benefit from the Onion over VPN feature. People living under authoritarian regimes who aim to avoid censorship. For example, accessing Western media and news sites in China, Russia, or Iran can call for this level of online anonymity and privacy. Political activists, whistleblowers, and journalists should, and do, use it to ensure safe communication. These are the highest-risk groups, as some governments proactively seek to monitor their online activities. Tor is also increasingly used by victims of domestic violence, cyberstalking, and abuse. They can seek help online while avoiding local network surveillance, where an abuser inspects router logs or checks browser history. Read more about that in this Vice report. On the other hand, a VPN on its own is sufficient if you just want to hide your browsing activities from your ISP. Likewise, if you only want extra conveniences such as ad blockers, malicious-website blocklists, and tracker disablers, the Tor Browser is unnecessary. Lastly, the best streaming VPNs provide excellent speed to unblock Netflix, HBO, Disney+, and other streaming libraries. Adding the Tor Browser to that would simply make things too slow for uninterrupted streaming.