Finding Mirror Sites for Tor Browser

Live Status of Tor Browser Mirror Sites

Official Tor Browser Mirror Sites

The Tor Project provides several verified mirror sites to facilitate access to the Tor Browser, particularly for users in regions where the main website is blocked. The official mirrors include:

• tor.eff.org (Electronic Frontier Foundation) - Primarily serves users in North America and Europe.
• tor.calyxinstitute.org (Calyx Institute) - Focuses on users in North America and provides additional privacy resources.

These mirrors are secured using HTTPS, ensuring that downloads are protected from tampering². Users can also verify the integrity of the downloaded Tor Browser by checking the digital signatures provided with the software. The Tor Browser Developers maintain a signing key with the fingerprint EF6E286DDA85EA2A4BA7DE684E2C6E8793298290, which is essential for verifying downloads⁴.

For those unable to access these mirrors, the GetTor service offers an alternative method. Users can send an email to gettor@torproject.org, specifying their operating system, to receive download links hosted on platforms like Dropbox or Google Drive²³. The response includes a cryptographic signature and key fingerprint to verify the integrity of the downloaded files³.

The following table outlines the current official mirror sites, their geographic distribution, and their last update status:

It is advisable to regularly check the status of these mirrors, as accessibility can vary depending on local censorship measures. This is particularly relevant in regions with stringent internet regulations, where mirrors may be blocked or accessible at different times.

How to Verify Authentic Tor Mirrors

Verifying the authenticity of Tor mirror sites is crucial to ensure a secure download of the Tor Browser. Follow these steps to confirm the integrity of a mirror site.

Check SSL Certificates

First, ensure that the mirror site uses HTTPS. An SSL certificate protects against tampering during the download process. For example, the official Tor Project website is secured with HTTPS to prevent such issues². If a mirror site lacks HTTPS, it may indicate a potential security risk.

Verify PGP Signatures

When downloading the Tor Browser, users should always check the PGP signature associated with the download. To verify this, import the signing key using the command:

gpg --auto-key-locate nodefault,wkd --locate-keys torbrowser@torproject.org

A successful verification will display a message indicating a good signature from the Tor Browser Developers⁴. The signing key fingerprint is EF6E286DDA85EA2A4BA7DE684E2C6E8793298290, which can be checked against the downloaded file⁴.

Compare File Hashes

It is essential to compare the SHA256 hash of the downloaded file with the official checksums provided by the mirror site. After downloading, run the following command:

sha256sum <filename>

Ensure that the output matches the official checksum listed on the mirror site. This step helps confirm that the file has not been altered.

Warning Signs of Fake Mirrors

Be cautious of potential red flags when accessing mirror sites. These include:

• Missing HTTPS: A site without HTTPS is not secure.
• Suspicious Domains: Check for unusual domain names that do not match official mirror sites, such as variations or misspellings.
• No Digital Signatures: Legitimate downloads should always include a PGP signature for verification.

By following these steps, users can significantly reduce the risk of downloading a compromised version of the Tor Browser and ensure their online safety.

Alternative Download Methods: GetTor Service

GetTor is an email-based service designed to assist users in downloading the Tor Browser, particularly in regions where access to the main site is restricted. To use GetTor, send an email to gettor@torproject.org, including the name of the operating system in the email body. Accepted operating systems are Windows, macOS, and Linux²³.

Requesting Tor Browser via Email

1. Open your email client and create a new message.
2. Address the email to gettor@torproject.org.
3. In the subject line, include “Tor Browser”.
4. In the email body, specify your operating system, for example:
   • For Windows: “windows”
   • For macOS: “mac”
   • For Linux: “linux”
5. Optionally, you can specify a language by adding a code, such as “windows zh_CN” for Chinese⁵.

Once sent, users can expect a response within a few minutes to several hours, depending on server load and network conditions. The response will contain download links from reputable sources such as Dropbox, Google Drive, or GitHub. Each response also includes a cryptographic signature, key fingerprint, and package checksum to verify the integrity of the downloaded files³.

Using GetTor through Other Platforms

In addition to email, GetTor can be accessed via Telegram or Twitter direct messages. Users can send a message to the official Tor Project accounts on these platforms, requesting the Tor Browser by specifying their operating system and preferred language. The process is similar to the email method but may vary slightly based on the platform's character limits.

For Twitter:

• Send a direct message to the Tor Project account with the same format as the email request.

For Telegram:

• Message the Tor Project's official channel, including your operating system and language code.

By utilising GetTor, users can navigate censorship circumvention effectively and obtain the Tor Browser securely, even when traditional download methods are unavailable.

Accessing Tor Mirrors Through Censorship Circumvention

Users encountering blocks on both the main Tor site and its mirror sites can employ several methods to access the Tor Browser. One effective approach is to use a Virtual Private Network (VPN), which encrypts internet traffic and routes it through a server in a different location. This method can bypass local censorship, allowing users to access blocked sites. It is essential to choose a reliable VPN that does not log user activities and supports connections to various countries.

Proxy servers offer another alternative for accessing Tor mirrors. These servers act as intermediaries between the user and the internet, masking the user's IP address. However, the effectiveness of proxies can vary, and they may not provide the same level of security as VPNs. Users should select trusted proxy services to mitigate risks associated with data interception.

Domain fronting is a technique that allows users to disguise the true destination of their web requests. By routing traffic through a legitimate domain, users can access blocked content without raising suspicion. This method requires some technical knowledge to implement correctly and may not work in all scenarios.

Specific tools designed for circumventing censorship include Psiphon and Lantern. Psiphon is a free tool that combines VPN, SSH, and HTTP proxy technologies to bypass restrictions. Users can download and install Psiphon, then select the “VPN” option to connect. Lantern operates similarly, offering peer-to-peer connections to access blocked content. To use Lantern, download the application, and it will automatically attempt to connect to the internet while bypassing restrictions.

For those who still struggle to reach mirror sites, bridge relays provide a preliminary access method. Bridge relays are Tor nodes not listed publicly, making them harder to block. Users can obtain bridge addresses from the Tor Project by sending an email to gettor@torproject.org. This method allows users to connect to the Tor network securely and access the necessary mirrors².

By employing these techniques, users in censored regions can enhance their chances of successfully downloading the Tor Browser and maintaining online privacy.

Platform-Specific Mirror Access

Accessing the Tor Browser through mirror sites varies based on the operating system. Below are the direct download links and file sizes for each platform:

Windows

• Download Link: tor.eff.org
• File Size: Approximately 80 MB
• System Requirements: Windows 7 or later

macOS

• Download Link: tor.calyxinstitute.org
• File Size: Approximately 70 MB
• System Requirements: macOS 10.12 (Sierra) or later

Linux

• Download Link: tor.eff.org
• File Size: Approximately 100 MB
• System Requirements: A modern Linux distribution with GTK 3 support

Android

• Download Link: Available on the Google Play Store or via F-Droid
• File Size: Approximately 30 MB
• System Requirements: Android 4.1 (Jelly Bean) or later

iOS

• Download Link: Limited availability, primarily through the App Store
• File Size: Approximately 40 MB
• System Requirements: iOS 13.0 or later

The limited options for iOS stem from Apple's strict app guidelines, which may restrict the availability of certain applications, including those related to privacy and security. Users seeking the Tor Browser on iOS may need to rely on the official App Store, which can have fewer features compared to other platforms.

For further assistance, users can utilise the GetTor service by sending an email to gettor@torproject.org with their operating system specified. This service provides alternative download links hosted on platforms like Dropbox or Google Drive, along with necessary verification information for ensuring the integrity of the downloads²³.

Verifying the authenticity of the downloaded files is essential. Users should check the provided cryptographic signatures, which can be done using the command line to ensure that the downloaded files have not been tampered with³⁴.

GitHub and Third-Party Tor Mirrors

Community-maintained mirror sites, such as Project516 on GitHub, offer alternative access to the Tor Browser, especially when official sources are blocked. While these unofficial mirrors can provide a way to obtain the software, they come with inherent risks. The primary benefit is accessibility; however, the potential for downloading compromised or outdated versions exists, making it essential to exercise caution.

When considering third-party mirrors, users should verify the authenticity of the source. To do this, follow these steps:

1. Check for HTTPS: Ensure the mirror site uses HTTPS to secure the connection. This protects against tampering during the download process.
2. Verify PGP Signatures: Always check the PGP signature associated with the Tor Browser download. Users can import the signing key using the command gpg --auto-key-locate nodefault,wkd --locate-keys torbrowser@torproject.org⁴. A successful verification will display a message confirming a good signature from the Tor Browser Developers⁴.
3. Compare File Hashes: After downloading, compare the SHA256 hash of the file with the official checksums provided by the mirror site. This ensures the file has not been altered.

Trusting a third-party source is appropriate if it adheres to these verification steps. For example, if a GitHub mirror provides a valid PGP signature and HTTPS connection, it may be considered reliable. Conversely, users should avoid mirrors lacking these security measures, as they may pose significant risks.

In summary, while GitHub and other third-party mirrors can facilitate access to the Tor Browser, users must perform thorough verification to mitigate potential dangers. By adhering to security protocols, users can confidently navigate the complexities of downloading the Tor Browser from unofficial sources.

Evolution of Tor Mirror Infrastructure

The evolution of the Tor mirror infrastructure has been a crucial response to increasing censorship challenges from 2010 to 2025. In the early years, the primary focus was on establishing official mirror sites to ensure users could access the Tor Browser when the main site was blocked. By 2012, the Tor Project partnered with organisations like the Electronic Frontier Foundation (EFF) and Calyx Institute to maintain reliable mirror sites, making it easier for users in censored regions to download the software¹.

In 2015, the introduction of the GetTor service marked a significant milestone. This email-based system allowed users to request download links from various cloud platforms, such as Dropbox and Google Drive, ensuring access even when traditional methods were unavailable². By 2020, the Tor Project had expanded its use of obfuscated bridges and domain fronting techniques to counteract blocking attempts, particularly in countries like China and Iran where censorship is stringent. These methods made it more challenging for authorities to detect and block Tor traffic³.

Throughout this period, the Tor Project adapted its infrastructure to address specific challenges in countries with aggressive censorship strategies. For instance, in Russia, where the government has attempted to block access to the Tor network, the implementation of bridge relays became essential. These nodes are not publicly listed, making them harder to block and allowing users to connect to the Tor network without detection³.

By 2025, the ongoing development of alternative access methods, such as digital signature verification and enhanced security protocols, has further strengthened the mirror infrastructure. Users are now encouraged to verify the integrity of their downloads through cryptographic signatures and SHA256 hashes, ensuring that they can trust the sources from which they obtain the Tor Browser²³. This comprehensive evolution of the mirror network reflects the Tor Project's commitment to maintaining user access in the face of evolving censorship tactics.

Troubleshooting Mirror Connection Issues

Users may encounter various connection issues when attempting to access Tor Browser mirror sites. Common error messages include connection timeouts, which often occur when the server is unreachable due to high traffic or network restrictions. In such cases, it may be beneficial to try accessing the mirrors during off-peak hours or switching between different mirror sites, such as those maintained by the Electronic Frontier Foundation or Calyx Institute¹.

Certificate errors can also arise, particularly if the HTTPS certificate of the mirror site is not recognised. To address this, verify that the URL begins with "https://" and that the browser's security settings allow for secure connections. If issues persist, consider using a different browser or clearing the cache before attempting to connect again.

Download failures can occur due to interruptions in network connectivity or server issues. Users should ensure a stable internet connection and retry the download. If the problem continues, utilising the GetTor service to obtain alternative download links from cloud platforms like Dropbox or Google Drive may provide a solution². When using GetTor, users must specify their operating system in the email request to receive the appropriate links³.

In regions with stringent censorship, DNS-level blocking may prevent access to known mirrors. Users can detect this by attempting to reach the mirrors via different networks, such as mobile data instead of Wi-Fi. If all known mirrors are inaccessible, employing obfuscated bridges can help circumvent these blocks. These bridges are Tor nodes that are not publicly listed, making them harder to block. Users can request bridge addresses from the Tor Project to facilitate access to the Tor network³.

For those still facing difficulties, exploring alternative methods such as VPNs or proxy servers may enhance connection reliability. These tools can help bypass local restrictions and provide access to blocked content. However, choosing reputable services is critical to maintaining online security and privacy.

Security Checklist for Mirror Downloads

When downloading the Tor Browser from mirror sites, it is crucial to follow a security checklist to ensure the integrity and safety of the download. Here are the essential steps:

Pre-Download Verification

1. Verify HTTPS: Ensure that the mirror site uses HTTPS to prevent tampering during the download process. The official Tor Project website employs HTTPS for this purpose².
2. Check for Official Mirrors: Use only verified mirror sites, such as those maintained by the Electronic Frontier Foundation and Calyx Institute¹.

Download Verification

1. Check Signature: After downloading, verify the PGP signature of the downloaded file. This can be done by importing the signing key using the command gpg --auto-key-locate nodefault,wkd --locate-keys torbrowser@torproject.org⁴. A successful verification will display a message confirming a good signature⁴.
2. Compare Hash: Calculate the SHA256 hash of the downloaded file and compare it with the official checksum provided on the mirror site to ensure the file has not been altered.
3. Verify Version Number: Ensure that the version number of the downloaded file matches the latest release from the Tor Project.

Post-Download Security Steps

Before running the Tor Browser for the first time, perform the following actions:

• Scan for Malware: Use trusted antivirus software to scan the downloaded file for potential malware.
• Check for Updates: Ensure that the Tor Browser is updated to the latest version, as updates often include crucial security patches.

Common Mistakes to Avoid

• Ignoring HTTPS: Downloading from non-secure sites can lead to tampered files.
• Skipping Signature Verification: Failing to verify the PGP signature can result in running compromised software.
• Using Unverified Mirrors: Relying on unknown or unofficial mirror sites increases the risk of downloading malicious versions of the Tor Browser.

By adhering to this checklist, users can significantly reduce the risks associated with downloading the Tor Browser from mirror sites, ensuring a safer online experience.

Common Mistakes and Misconceptions

Trusting Mirrors Without Verifying Cryptographic Signatures

Many users assume that downloading from any mirror site labelled "official" guarantees safety, skipping the verification step entirely. This oversight can result in installing compromised software, as attackers may create convincing fake mirrors or intercept downloads on unsecured networks. To protect against this, always verify the PGP signature using the command gpg --auto-key-locate nodefault,wkd --locate-keys torbrowser@torproject.org and confirm the fingerprint matches EF6E286DDA85EA2A4BA7DE684E2C6E8793298290⁴. A successful verification displays "Good signature from Tor Browser Developers" in the output⁴.

Assuming All HTTPS Mirrors Are Equally Trustworthy

Users often believe that HTTPS alone guarantees a mirror's legitimacy, overlooking the need to verify the source's authenticity. While HTTPS prevents tampering during transmission², it does not confirm that the mirror itself is operated by the Tor Project or a trusted partner. Attackers can obtain valid HTTPS certificates for malicious domains that mimic legitimate mirrors. The correct approach involves cross-referencing mirror URLs with the official list maintained by the Tor Project, specifically those operated by EFF (https://tor.eff.org) and Calyx Institute (https://tor.calyxinstitute.org)¹, and always checking cryptographic signatures regardless of the connection security.

Using Outdated Signing Keys for Verification

Some users retain old copies of the Tor Browser signing key and fail to refresh it, leading to verification failures or false confidence in outdated security measures. The Tor Project rotates signing key subkeys periodically, meaning an old key may not validate newer releases⁴. This results in either rejecting legitimate downloads or, worse, accepting files signed with compromised older keys. Users must refresh the GPG key regularly using gpg --refresh-keys EF6E286DDA85EA2A4BA7DE684E2C6E8793298290 to ensure they possess current subkeys⁴.

Choosing GetTor Over Mirrors Without Understanding Trade-offs

Users in censored regions sometimes request GetTor links via email to gettor@torproject.org without considering whether direct mirror access might be faster and more reliable²³. GetTor provides download links hosted on Dropbox, Google Drive, and GitHub, which can be slower and subject to their own access restrictions or rate limits. The appropriate choice depends on the specific censorship scenario: if only the Tor Project domain is blocked but cloud platforms remain accessible, GetTor works well; if broader DNS filtering affects multiple domains, obfuscated bridges may be necessary instead. Evaluate which services are accessible in your region before defaulting to email-based retrieval.

Ignoring Language-Specific Download Options

Users frequently download the English version of Tor Browser and attempt to change the interface language afterwards, unaware that GetTor supports direct requests for localised versions. This creates unnecessary complexity and may result in incomplete translations or configuration errors. GetTor accepts language codes in email requests, such as "windows zh_CN" for the Chinese version on Windows⁵. Requesting the correct language variant from the start ensures proper localisation and reduces the risk of misconfiguration.

Failing to Compare File Hashes After Signature Verification

Even after successfully verifying PGP signatures, some users skip comparing SHA256 hashes with official checksums, assuming the signature check alone is sufficient. While signature verification confirms the file was signed by the Tor Project, hash comparison provides an additional layer of protection against partial downloads, storage corruption, or sophisticated attacks that might exploit weaknesses in older GPG implementations. GetTor responses include package checksums specifically for this purpose³. Calculate the SHA256 hash of your downloaded file and compare it with the checksum provided by GetTor or the mirror site to ensure complete file integrity.

Your questions, answered

How to access .onion sites?

To access .onion sites, download and install Tor Browser from the official Tor Project website or verified mirrors maintained by EFF and Calyx Institute²¹. Once installed, launch Tor Browser and enter the .onion address directly into the address bar; the browser automatically routes traffic through the Tor network to reach these hidden services. Standard browsers cannot access .onion domains, as they require Tor's onion routing protocol to resolve and connect to these sites.

How do I know if a Tor mirror is authentic?

Verify a Tor mirror's authenticity by cross-referencing its URL with the official list on torproject.org, specifically checking for mirrors operated by EFF (https://tor.eff.org) and Calyx Institute (https://tor.calyxinstitute.org)¹. After downloading, import the signing key using 'gpg --auto-key-locate nodefault,wkd --locate-keys torbrowser@torproject.org' and verify the fingerprint matches EF6E286DDA85EA2A4BA7DE684E2C6E8793298290⁴. A legitimate download displays 'Good signature from Tor Browser Developers' when you run signature verification⁴.

Can I use Tor mirrors on mobile devices?

Tor mirrors provide download links for desktop versions of Tor Browser (Windows, macOS, Linux), which are not directly compatible with mobile devices³. For mobile access, download Tor Browser for Android from the Google Play Store or use GetTor to request Android APK files by emailing gettor@torproject.org with 'android' in the message body. iOS users must use Onion Browser, a separate application available through the App Store, as Tor Browser is not officially available for iOS.

What's the difference between Tor mirrors and dark web sites?

Tor mirrors are standard HTTPS websites that host copies of Tor Browser installation files, accessible through any regular browser without using Tor²¹. Dark web sites, by contrast, are .onion services only reachable through Tor Browser itself, using onion routing to conceal both the server's location and the user's identity. Mirrors serve as download distribution points to bypass censorship, whilst dark web sites operate as hidden services within the Tor network for anonymous communication and content hosting.

Do Tor mirrors log user activity?

Official Tor mirrors operated by EFF and Calyx Institute follow privacy-respecting policies typical of these organisations, though specific logging practices vary by mirror operator¹. Mirrors only facilitate the initial download of Tor Browser installation files via standard HTTPS connections; they cannot monitor subsequent Tor network activity once the browser is installed and running. For maximum privacy during the download phase, users can employ GetTor to obtain links via email, which distributes files through Dropbox, Google Drive, and GitHub rather than direct mirror access²³.

Can the FBI track Tor?

In Operation Torpedo (2012), the FBI used a Flash-based Network Investigative Technique (NIT) to deanonymise Tor users by exploiting browser vulnerabilities, successfully identifying 25 users in the US⁶. The NIT consisted of an exploit targeting the Tor browser (customised Firefox), a payload for deanonymisation, and server infrastructure with unique identifiers⁷. However, by 2011 the Tor Browser Bundle had made such security blunders more difficult, with virtually everyone visiting deanonymisation test sites passing anonymity tests⁶. Modern Tor Browser versions disable Flash and other plugins by default, significantly reducing vulnerability to such attacks.

Is Tor 100% untraceable?

Tor is not 100% untraceable, as demonstrated by research on the Torben deanonymisation attack, which detected web page markers transmitted over Tor with an accuracy exceeding 91% and no false positives in tests with 60,000 web pages⁸. The FBI's Network Investigative Technique in Operation Torpedo successfully deanonymised 25 users by exploiting browser vulnerabilities to reveal real IP addresses⁶. Whilst Tor provides strong anonymity when used correctly with up-to-date software and proper operational security, sophisticated adversaries with sufficient resources can potentially compromise user anonymity through traffic analysis, browser exploits, or endpoint attacks.

Key Takeaways

• Always verify cryptographic signatures: Download the Tor Browser signing key using gpg --auto-key-locate nodefault,wkd --locate-keys torbrowser@torproject.org, confirm the fingerprint matches EF6E286DDA85EA2A4BA7DE684E2C6E8793298290, and check for "Good signature from Tor Browser Developers" in the verification output⁴.
• Use only documented official mirrors: Rely exclusively on mirrors operated by EFF (https://tor.eff.org) and Calyx Institute (https://tor.calyxinstitute.org) listed on torproject.org, as these organisations maintain verified infrastructure¹.
• Match your download method to censorship conditions: Choose direct mirror access when only the Tor Project domain is blocked; request GetTor links via email to gettor@torproject.org when cloud platforms remain accessible; deploy obfuscated bridges when broader DNS filtering affects multiple domains²³.
• Compare SHA256 hashes after signature checks: Calculate file hashes and cross-reference with checksums provided by GetTor or mirror sites to detect partial downloads or storage corruption³.
• Refresh signing keys regularly: Run gpg --refresh-keys EF6E286DDA85EA2A4BA7DE684E2C6E8793298290 periodically to obtain current subkeys, as the Tor Project rotates these to maintain security⁴.

Once you've successfully installed Tor Browser from a verified mirror, learn how to troubleshoot common connectivity issues when accessing .onion services.