Tor's own VPN for Android gives every app its own circuit
Photo: Иллюстрация vpnlab.io, логотип - The Tor Project, Inc. / CC BY 3.0 US
The Tor Project has published what it has learned from a year of running its own VPN for Android, and the app is now available three ways: as an APK, through Google Play and, newly, through F-Droid. It is not a commercial VPN with a different logo. The central design choice is that every app you select gets its own route through the Tor network instead of sharing one tunnel.
In short
- Tor VPN Beta routes Android apps through Tor. Each selected app gets its own circuit, so activity in one app is not easily linked to another.
- The team expected a privacy tool and got a circumvention tool: the heaviest use came from Iran and Turkmenistan.
- WebTunnel bridges make the connection look like ordinary encrypted web traffic, which is what matters where Tor itself is blocked.
- It is built on Arti, the Rust rewrite of Tor, with reproducible builds and an F-Droid channel that does not depend on Google.
A circuit per app, not one tunnel
A conventional VPN gives your whole device a single exit point. Everything you do arrives at the far end from the same address, which is fine against the network you are sitting on and useless against anyone correlating your activity across services. Tor Browser solved that for websites years ago by isolating circuits per site. Tor VPN applies the same idea to apps.
Ordinary VPN
- One tunnel for the whole device
- All apps share one exit address
- Provider sees which sites you reach
- Optimised for speed
Tor VPN Beta
- A separate Tor circuit per selected app
- Each app reaches the internet from a different exit
- No single party sees both who you are and where you go
- Optimised for getting through, not for speed
You choose which apps go through Tor and which do not, either app by app or for everything at once. The app list is now searchable, which sounds trivial until you try to find one messenger among two hundred installed packages on a phone you are configuring in a hurry.
The lesson from networks that block things
The interesting part of the write-up is where the team says it guessed wrong. Tor VPN was conceived in 2021 as a way to extend privacy protections past the browser. In practice the users who arrived wanted one thing: to reach blocked services. Adoption was strongest in Iran and Turkmenistan, and engagement skewed heavily towards the Global South, in contrast to Tor Browser for Android, whose users lean the other way.
That changed what the product had to get right. One example is the exit-country picker, which sounds like an obvious feature and turned out to be a trap. People trying to get around a block were choosing an exit country when what they actually needed was a bridge, which is a completely different mechanism at a completely different point in the connection. The interface now requires connecting to the Tor network before an exit can be selected, precisely so that the wrong tool is harder to reach for under pressure.
- The idea for a Tor VPN takes shape in user research; Android is chosen first.
- Tor VPN Beta soft-launches in a limited release.
- WebTunnel bridges are added after censorship becomes the dominant use case.
- The team publishes what it learned; the app is on Google Play, F-Droid and as a direct APK.
Bridges that look like ordinary web traffic
Where Tor is blocked outright, the problem is not routing but recognition: a censor that can spot a Tor handshake can drop it before it goes anywhere. WebTunnel wraps the connection so that it resembles regular HTTPS to a network that is watching. Prioritising it over more conventional VPN features was a direct consequence of who turned out to be using the app.
What changed under the hood
Tor VPN does not run the old C implementation of Tor. It is built on Arti, the project's rewrite in Rust, together with a networking daemon called Onionmasq that handles the per-app routing. The practical result the team reports is fewer crashes and better behaviour when the network drops in and out, which matters more on a phone than on a laptop.
The trade-off is honest and worth repeating: Arti does not yet have all the performance work from the C version, including congestion control. Tor VPN is not going to behave like a commercial VPN chosen for speed, and the project does not claim it will.
Two distribution details are easy to skip past and both matter for a tool used in hostile conditions. Builds are reproducible, so anyone can verify that the binary matches the published source. And F-Droid gives an install and update path that does not go through Google Play, which is the first thing to disappear in some of the places where this app gets used.
What it does not do
The project publishes a threat model for the app, and it is unusually blunt for a piece of privacy software. Tor VPN promises censorship circumvention to every app you route through it. Everything above that level depends on the app's own behaviour, the permissions it holds and how the phone is set up.
The same document lists concrete limitations rather than hiding them: push notifications can link accounts, multicast DNS and SSDP can leak on the local network, apps can reach the cellular network in ways that go around the VPN, a secondary user profile bypasses the VPN while starting, and the Google account and the advertising ID can tie identities together on a standard Android build. On a privacy-hardened Android the picture improves; on a stock phone signed into a Google account, several of these remain.
One caveat the threat model inherits
Tor VPN's leak safety rests on Android's own Always-on VPN lockdown, which the threat model names as the mechanism that keeps apps from going around the tunnel. That is the same guarantee that two research findings this year showed can be bypassed by any app, with Google declining to fix either. It does not undermine what Tor VPN is for, because a censor blocking a country is a different adversary from a hostile app you installed. It does mean the floor under every Android VPN, this one included, is lower than the setting implies.
Who it is for
If you want a faster Netflix, this is not it, and the project would tell you the same. If you are on a network that blocks messengers, or you want the apps on your phone to stop arriving at the internet from one shared address, it is worth installing. It is free, it is beta, and the people building it are unusually clear about where the limits are.
