Tor Browser Configuration for Dark Web Access

Tor Browser has three security levels (Standard, Safer, Safest) accessible via the Shield icon. Standard enables all browser features - JavaScript runs everywhere, WebGL is enabled, all media plays. This is the lowest security level and appropriate only for clearnet browsing via Tor. Safer disables JavaScript on non-HTTPS sites, blocks some fonts, and disables some media features. Appropriate for visiting clearnet sites via Tor. Safest disables JavaScript entirely on all sites, blocks most fonts and media. The most secure setting and strongly recommended for accessing .onion sites. JavaScript on .onion sites has historically enabled de-anonymization attacks (browser exploits, WebRTC IP leaks). Setting security to Safest eliminates the JavaScript attack surface entirely. The trade-off: many .onion sites require JavaScript for functionality. Those sites are incompatible with maximum security. For security-critical activities (whistleblowing, sensitive research), this trade-off is correct: avoid JavaScript-dependent .onion services rather than enabling JavaScript.

Browser fingerprinting identifies users by combining unique browser characteristics: screen resolution, installed fonts, canvas rendering, time zone, and dozens of other signals. Tor Browser implements fingerprinting resistance by standardizing these characteristics: all Tor Browser users present the same fingerprint. Font enumeration is blocked (returns a standard set). Canvas API is sandboxed (canvas element access shows a permission prompt). Screen resolution is masked to standard sizes. User-agent string is standardized. Time zone is reported as UTC regardless of system time zone. Do not attempt to customize Tor Browser's appearance or install extensions (beyond what comes pre-installed) - customization breaks the standardized fingerprint and makes your Tor Browser instance uniquely identifiable. Do not resize the Tor Browser window (the default window size is standardized to prevent screen resolution fingerprinting). The letterboxing feature (white borders around the viewport) maintains standard window sizes internally even when the actual window is resized.

Technical browser security is insufficient without operational security (opsec). Critical opsec practices: (1) Never log into personal accounts (Gmail, social media, bank) while Tor Browser is open, even if those tabs are on clearnet - session isolation is not perfect and the association can be logged. (2) Do not open downloaded files (PDF, Word, video) while connected to Tor - these applications can make clearnet connections revealing your real IP. (3) Do not torrent via Tor - BitTorrent announces real IP addresses. (4) Do not enable or install browser plugins (Flash is dead, but other plugins could reveal real IPs). (5) Clear cookies and site data after each sensitive browsing session. (6) Use a dedicated device for sensitive .onion access if possible - a device that does not have personal accounts, personal files, or software that could phone home. (7) Use Tails OS instead of installing Tor Browser on a personal computer for the highest security - Tails routes all traffic through Tor at the OS level and leaves no traces on the computer.

The HTTPS requirement on .onion is debated. Arguments for using HTTPS on .onion: (1) Defense-in-depth - Tor provides transport security, HTTPS adds an application layer. (2) Some browser features (Service Workers, secure cookies) require HTTPS even on .onion in some browsers. (3) Protects against a compromised Tor exit or circuit (though .onion services have no exits). Arguments against requiring HTTPS on .onion: (1) Tor already provides end-to-end encryption for .onion services - HTTPS is redundant for transport security. (2) .onion HTTPS requires DigiCert certificates (expensive, identity-revealing) or self-signed certificates (which generate browser warnings). (3) Tor Browser's security model is designed for .onion HTTP to be secure. Practical recommendation: for .onion-only services (no clearnet access), HTTP is acceptable and the browser does not show security warnings. For services accessible both as clearnet and .onion, offer HTTPS on both. For highest security: use Safest security level in Tor Browser, which limits JavaScript regardless of HTTPS status.

Tor Browser provides two key tools for managing Tor circuits. New Circuit for This Site (access via the lock icon in the address bar): creates a new circuit for the current tab only. Useful when the current circuit is slow or you suspect the circuit may be compromised. New Identity (Tor Browser menu > New Identity or Ctrl+Shift+U): closes all tabs, clears all browser state (cookies, localStorage, cached data), and creates a new Tor identity with entirely new circuits. This is the nuclear option for a fresh start. Use New Identity: before starting a new sensitive activity that should not be linked to previous activity, when you suspect your current circuits are slow or compromised, and at the end of any sensitive browsing session before switching to less sensitive activities. Do not use New Identity between activities you want linked (sequential steps of the same task) as it creates a break in the session that would prevent account logins from persisting.