When you browse through Tor, your traffic is encrypted in multiple layers (like an onion) and routed through three random nodes:
- Entry node (Guard) - Knows your real IP but not your destination. Encrypts the first layer.
- Middle node (Relay) - Knows neither your IP nor your destination. Just passes encrypted traffic along.
- Exit node - Decrypts the final layer and connects to the destination website. Knows the destination but not your identity.
No single node in the chain knows both who you are AND what you're accessing. This is the core privacy guarantee of Tor.
.onion sites (hidden services) are even more private - traffic never leaves the Tor network at all. Both the client and server communicate through Tor rendezvous points, meaning neither party knows the other's real IP.