Tor Bridge Distribution Channels: How Bridges Reach Users in 2026

BridgeDB is the Tor Project's central bridge address database and distribution system. It stores bridge addresses and distributes them via multiple sub-channels. BridgeDB's design principle: distribute bridges in a way that prevents a censor from bulk-downloading all bridges and blocking them all. Rate limiting and access controls prevent bulk enumeration. BridgeDB sub-channels: HTTPS (bridges.torproject.org), email (send email to bridges@torproject.org), and Tor Browser's built-in selection. BridgeDB knows which bridges are healthy (recently checked) and categorizes them by transport type (obfs4, Snowflake, WebTunnel). It rate-limits bridge distributions per IP/email to slow down censors attempting to enumerate all bridges. Despite rate limiting, sophisticated censors (Great Firewall) have still enumerated and blocked significant portions of the public bridge pool.

The email bridge distribution channel is often accessible when HTTPS to bridges.torproject.org is blocked. To use: send an email from a Gmail or Riseup account to bridges@torproject.org with the subject line 'get transport obfs4' (or 'get transport webtunnel' for WebTunnel bridges). You receive an automated reply with 3 bridge addresses within minutes. This channel works because email is harder to selectively block (blocking all email would be unacceptable collateral damage). Tip: send from Gmail or Riseup specifically - BridgeDB only accepts requests from these providers to limit abuse. The bridge addresses you receive are different from what other users receive (varied distribution reduces the value of each set of addresses to censors).

Tor Browser includes Snowflake bridges built-in with no configuration needed. When you select 'Use a bridge -> Built-in bridge -> Snowflake' in Tor Browser's Connection settings, it uses Snowflake's broker (accessed via domain fronting) to find volunteer proxies dynamically. No static bridge address is needed - the Snowflake protocol dynamically discovers proxies. Built-in obfs4 bridges are also included in Tor Browser for initial connection, but these public bridges are more commonly blocked in the most restrictive environments. The priority for new users: try Snowflake first (built-in, no configuration), then email-distributed obfs4 bridges, then private bridges from trusted sources.

Private bridges (bridges not registered in BridgeDB) are distributed through informal trusted networks. Advantages: a private bridge address shared with a small group of trusted users is much harder for censors to discover and block. Disadvantages: the operator must manually manage distribution and keep the address current. Distribution networks: Signal groups for specific communities (Iranian journalists, Russian activists, Cuban diaspora), Telegram channels (some public, some private), and personal networks of trust. Operating a private bridge for a specific community: set up an obfs4 or WebTunnel bridge, do NOT register it with BridgeDB, and share the bridge line directly with your intended recipients via encrypted channels. The bridge's long-term effectiveness depends on keeping the address within a trusted circle - if it leaks to censors, it will be blocked.

The Tor Project operates a Telegram bot (@GetBridgesBot) that distributes bridge addresses via Telegram. Users in censored countries who can access Telegram (often because Telegram's wide use makes blocking costly) can get bridge addresses through the bot. The Tor Project also distributes bridges via Twitter DM (@torproject) for users who can access Twitter. These channels complement BridgeDB by providing access when the primary HTTPS channel is blocked. Emerging distribution: mesh network distribution (passing bridge addresses device-to-device via Briar or other mesh tools when internet is unavailable), radio broadcasts (shortwave radio has been used in some cases for bridge address distribution), and print media (printing bridge addresses in newspapers distributed in censored countries). Each channel adds redundancy and reaches different user populations who may have different access limitations.