VPN vs Tor: which one do you actually need?

Tor and a VPN solve different problems. Tor is built for anonymity: it sends your traffic through three volunteer relays so that no single party knows both who you are and what you are visiting, and it pays for that with speed that makes video and most apps impractical. A VPN is built for privacy from the network you are on: it encrypts everything to one server run by a provider you have chosen, at close to normal speed, but that provider can see your traffic. If you need to be unlinkable from what you do online, Tor. If you need your traffic private on Wi-Fi and your address hidden from sites, a VPN.

How each one routes your traffic

A VPN opens one encrypted tunnel from your phone to one server. Everything the phone does goes through it. The server decrypts the traffic and sends it to its destination from the server's address. One hop, one operator, one point of trust.

Tor wraps each packet in three layers of encryption and sends it through three relays chosen from thousands run by volunteers. The first relay knows your address but not your destination. The last, the exit, knows the destination but not your address. The middle one knows neither. No single relay can connect you to what you are doing, and the path changes regularly. That design is why Tor is the tool people reach for when the threat is someone with the power to watch several networks at once.

What a VPN does that Tor does not

Speed and coverage. A VPN adds a few milliseconds and carries the whole phone: messaging, games, background sync, banking apps, video. Tor on Android covers the Tor browser and whatever else you route through it, and every connection crosses three relays with whatever bandwidth their operators can spare. Loading a page is fine. A video call is not.

A VPN also gives you a stable, ordinary-looking exit address. Sites see a commercial server in a known city and treat you as a normal visitor. Tor exit addresses are public and heavily used, and many sites present extra checks or refuse them.

What Tor does that a VPN does not

A VPN moves trust; it does not remove it. The provider can see the address you connected from and the traffic you sent, and whether that matters depends on how the provider handles it. Culvert VPN does not log the sites you visit, your DNS queries or the contents of your traffic; its servers see only an opaque connection id; and it keeps your client IP address for up to 30 days for abuse handling, as described in its privacy policy. That is a statement of what one provider does, and you are trusting it.

Tor is built so that no party is in that position. There is nobody to trust with the whole picture, because no relay has it. That is a stronger property, and it is the reason Tor is slow: the three-hop design is the cost of not needing to trust anyone. Does a VPN make you anonymous? explains why the answer for a VPN is no, and the same reasoning shows what Tor is for.

Neither tool does anything about being signed in. A site you log into knows who you are over Tor as surely as over a VPN or a plain connection.

Using both

With a VPN on, starting the Tor browser sends its connection to the first relay through the tunnel. The Wi-Fi network sees only the VPN. The VPN sees that you connected to Tor, not where you went afterwards. Tor sees the VPN server's address as your entry point instead of your real one. It is slower than either alone, and for most people it is more layers than the situation calls for, but it is a sensible arrangement on a network where Tor connections are noticed and a VPN connection is not.

The reverse, a VPN inside Tor, is rarely worth doing on a phone and is easy to get wrong.

Choosing

Ask what you are protecting against.

• Someone on the same Wi-Fi, or the network's owner. A VPN. Tor does this too, but at a cost you do not need to pay. What your ISP can see with a VPN covers the network side.
• Sites logging your home address. Either. A VPN gives you a shared address that sites accept; Tor gives you one that sites often challenge.
• Being linked, by anyone at all, to what you read or publish. Tor. A VPN provider knows both halves, and however it handles that, it is one party holding it.
• Everyday use on every app. A VPN. Tor is not designed to carry a phone's whole traffic at usable speed.

Culvert VPN is the everyday case: one tap, every app on the phone in one encrypted tunnel at near-normal speed, on Google Play.