Tor Browser Hardening Setup
Accept the route, then reset between compartments. The acceptance sequence for Tor Browser 15.0.19: verify the build and route, avoid unique customization, then clear session state with New Identity between compartments.
Data behind this diagram
| Step | Verify condition | Source |
|---|---|---|
| Write session rule | One allowed and one forbidden identity class are recorded | Tor Browser safe-use guidance |
| Verify download | Good signature and published fingerprint match | Tor Project verification guide |
| Install | No imported browser profile or user data | Tor Browser scope |
| Connect | Tor Check confirms Tor and exit IP differs | Tor Project check |
| Security level | Safer remains selected after restart | Tor security levels |
| Preserve fingerprint | No user extensions or about:config changes | Tor fingerprinting guidance |
| New Identity | All windows close and prior session cookie is absent | Tor identity management |
| Final test | All acceptance checks pass after reboot | Tor Project guidance |
This procedure installs Tor Browser 15.0.19 on a desktop, verifies the download, selects one documented security level, and establishes a repeatable session routine. It is for a reader who wants websites to see a Tor exit address and a browser configured to resemble other Tor Browser users. It is not a way to make an identified account anonymous or to protect traffic from other applications.
- FOR
- Desktop web
- Tor Project release
- THREAT
- IP + fingerprint
- Tor Browser design
- TIME
- 25-40 min
- Cunicula procedure
- COST
- $0
- Tor Project
COST SOURCES: Tor Browser download (retrieved 10 August 2026); Tor Browser 15.0.19 release (retrieved 10 August 2026).
Before you start
- A supported Windows, macOS, or Linux desktop with current security updates.
- Enough access to download Tor Browser and its signature from the Tor Project.
- A password manager if this compartment will use accounts, and a written rule for which identities may be used.
- A separate browser for ordinary identified activity. Do not turn Tor Browser into the default place for every account.
Tor Browser is free. The relevant costs are the reader's normal network data and time. This walkthrough is fixed to stable Tor Browser 15.0.19, released on 21 July 2026. Do not apply these menu paths to an alpha build or to another Firefox-based browser.
STOP CONDITION: do not add extensions, change about:config preferences, maximize the window to force a unique layout, or import an existing Firefox profile. Those actions move the browser away from the shared Tor Browser configuration.
1. Write the session rule
Decide whether this installation is for unlogged research, a named account used only through Tor, or a pseudonymous compartment. Write one of those choices. A login still tells the site which account is present even when the site sees a Tor exit IP. Do not use the same session for a personal mailbox and an identity you expect to remain separate.
Add two forbidden crossings: never open a downloaded document in an external networked application while online, and never paste a personal address, phone number, payment record, or cloud-storage link into the protected compartment.
VERIFY: The rule names one allowed identity class, one forbidden identity class, and the files or accounts that must never cross between Tor Browser and the ordinary browser.
SOURCES: Tor Browser safe-use guidance (retrieved 10 August 2026); Tor Browser scope (retrieved 10 August 2026).
2. Download Tor Browser and the signature
Open the Tor Browser provider page and continue to torproject.org/download. Select the stable desktop build for the current operating system. Download the installer or archive and select the adjacent Signaturelink to save its .asc file. Do not use a search advertisement, app-wrapper site, or a file copied by a third party.
Keep both files in an empty folder named tor-browser-15.0.19-verify. If the site offers a newer stable build, use its matching release notice and signature instructions and record that version before following any menu path below.
VERIFY: The browser archive or installer and its matching .asc signature are both present, their filenames name the same 15.0.19 build and operating system, and the download host is torproject.org.
SOURCES: Tor Project download page (retrieved 10 August 2026); Tor Browser signature verification (retrieved 10 August 2026).
3. Verify the download before installation
Follow the Tor Project's operating-system-specific OpenPGP instructions. Import the Tor Browser Developers signing key from the location in that guide, compare the complete fingerprint character by character, then verify the downloaded.asc file against the installer or archive. Replace example filenames only with the exact 15.0.19 filenames in your verification folder.
“Good signature” is necessary but not sufficient if the key fingerprint was not checked. A key downloaded from the same compromised mirror as a file could validate that file. If the fingerprint differs, the signature is bad, or the files do not name the same build, delete both and stop.
VERIFY: The OpenPGP tool reports a good signature from The Tor Browser Developers signing key and the fingerprint matches the value published in Tor's verification guide. A missing-key or bad-signature result is a failure.
SOURCE: Tor Project signature-verification procedure and fingerprint (retrieved 10 August 2026).
4. Install without importing another profile
Run the verified installer or extract the verified archive. Use the default Tor Browser profile location. Decline any operating-system or browser prompt to import bookmarks, history, passwords, extensions, or a Firefox profile. Start Tor Browser and open Menu → Help → About Tor Browser to record version 15.0.19.
Keep Tor Browser separate from the normal browser's taskbar icon and profile folders. A clear name such as TOR BROWSER, COMPARTMENT ONLY is functional labeling, not a security control.
VERIFY: Help → About Tor Browser reports 15.0.19, no bookmarks or history from another browser are present, and the first-run screen offers Connect rather than an imported Firefox session.
SOURCES: Tor Browser installation and first start (retrieved 10 August 2026); Tor Browser 15.0.19 release notice (retrieved 10 August 2026).
5. Connect to Tor and prove the route
On first run select Connect. If the local network blocks Tor, open Configure Connectionand use a bridge supplied through Tor Browser's documented bridge flow. Do not paste an unknown bridge from a forum or paid “Tor accelerator.” Wait for the browser window to open.
In the ordinary browser, record the public IP displayed by a site you already trust. In Tor Browser open check.torproject.org. Record the green Tor result and exit IP. A different IP alone is not the pass; the Tor Project check must also identify the Tor route.
VERIFY: The Tor Project check page says the browser is configured to use Tor and displays a public IP different from the ordinary browser's recorded IP.
SOURCES: Tor Browser connect workflow (retrieved 10 August 2026); Tor Project connection check (retrieved 10 August 2026).
6. Select the Safer security level
In Tor Browser 15.0.19 select the shield icon beside the address bar, choose Change, and select Safer. The equivalent full path is Menu → Settings → Privacy & Security → Security Level → Safer. Restart Tor Browser and check the setting again.
Safer disables potentially dangerous web features on sites that do not use HTTPS and disables some JavaScript features, so some sites will break. Use Safest when the threat justifies JavaScript disabled by default and you can tolerate more breakage. Do not lower the level for an entire compartment to fix one site without recording the reason.
VERIFY: The shield menu and Settings → Privacy & Security → Security Level both display Safer after a full browser restart.
SOURCE: Tor Browser security levels (retrieved 10 August 2026).
7. Preserve the shared fingerprint
Leave the browser window at the size Tor Browser chooses. Do not install an ad blocker, password-manager extension, theme, language pack, VPN extension, or alternate user-agent switcher. Tor Browser already includes its own protections and NoScript integration. Additional extensions and preference changes can make the browser's behavior differ from other Tor Browser users.
Open Menu → Add-ons and themes → Extensions. Confirm there is no user-installed item. Do not editabout:config. If an earlier test changed a preference, create a new Tor Browser installation rather than trying to remember every default.
VERIFY: The add-ons page contains no user-installed extension, the browser uses its default window behavior, and no about:config preference was changed.
SOURCES: Tor Browser fingerprinting protections (retrieved 10 August 2026); Tor Browser extension and plugin guidance (retrieved 10 August 2026).
8. Use New Identity between compartments
Finish one identity's work, save only the records required by that compartment, then selectMenu → New Identity. Confirm the prompt. Tor Browser closes all windows and tabs, clears session state, and establishes new circuits. This is stronger than opening another tab and different from New Tor circuit for this site, which changes the route for one site without clearing all identity state.
Test with a harmless site where you created a temporary session. After New Identity, return to the site and confirm that it does not retain the session. Do not use New Identity as a claim that files, external applications, account records, or remote server logs were erased.
VERIFY: New Identity closes every Tor Browser window and tab; after restart, the prior test site's signed-in state and session cookie are absent.
SOURCE: Tor Browser New Identity behavior (retrieved 10 August 2026).
9. Handle downloads without bypassing Tor
Prefer viewing content inside Tor Browser. A downloaded PDF, office document, torrent, or media file can launch another application that connects directly to the internet or reveals local data. Do not open such a file while online. BitTorrent is not protected by Tor Browser and must not be routed through it.
For a required document, finish the Tor session, close Tor Browser, disconnect the computer from networks, and inspect a copy in an isolated environment appropriate to the threat. Reconnecting later does not erase anything the external application stored locally.
VERIFY: The test download remains closed while online, its file type is known, and any offline inspection happens only after Tor Browser and the network connection are closed.
SOURCE: Tor Browser downloaded-document warning (retrieved 10 August 2026).
10. Run the final acceptance test
Restart the computer, open Tor Browser, connect, and repeat Tor Check. Recheck About, Security Level, and Extensions. Run New Identity after a temporary session and confirm that it clears. Record each pass. A setup that connects but lacks a verified installer or has an unknown extension is not accepted.
Keep the ordinary browser open only long enough to confirm it remains separate. No bookmark, account, or password should have appeared in both browsers. If one did, remove the cross-over from the wrong compartment and repeat the relevant test.
VERIFY: The setup record contains a good signature result, version 15.0.19, Tor Check pass, Safer level after restart, zero user extensions, New Identity session-clear pass, and a documented download rule.
SOURCES: Tor Project connection check (retrieved 10 August 2026); Tor Browser safe-use controls (retrieved 10 August 2026).
What this setup does not protect
- Tor Browser protects browser traffic. Other applications, updates, cloud clients, and downloaded files can connect outside Tor.
- Logging into an identified account identifies that account to the service. Tor changes the network route, not facts the reader submits.
- A compromised endpoint can read content before encryption or after decryption, capture keystrokes, and copy files.
- Tor does not guarantee protection against an adversary that can observe and correlate both ends of a connection over time.
- Exit relays can observe unencrypted application traffic. Use HTTPS and end-to-end encrypted protocols.
- Window, extension, language, behavior, timing, payment, and account changes can distinguish a session even when the default browser reduces fingerprinting.
LIMITATION SOURCES: Tor Browser safe-use guidance (retrieved 10 August 2026); Tor Browser fingerprinting protections (retrieved 10 August 2026); Tor Browser scope (retrieved 10 August 2026).
Maintenance
Install stable Tor Browser updates promptly from the in-browser update flow or the verified official distribution. After each update, record the new version and repeat Tor Check, security level, extension, and New Identity checks. Revisit the compartment rule when adding an account or download type. The safest default is to change no browser preference that the Tor Project did not instruct you to change.
Sources
- Tor Browser 15.0.19 release notice, retrieved 2026-08-10
- Tor Project connection check, retrieved 2026-08-10
- Tor Browser fingerprinting protections, retrieved 2026-08-10
- Tor Browser New Identity behavior, retrieved 2026-08-10
- Tor Browser extension and plugin guidance, retrieved 2026-08-10
- Tor Browser security levels, retrieved 2026-08-10
- Tor Browser installation and first start, retrieved 2026-08-10
- Tor Project signature-verification procedure and fingerprint, retrieved 2026-08-10
- Tor Browser downloaded-document warning, retrieved 2026-08-10
- Tor Browser official site · first-party source
- Tor Project download page, retrieved 2026-08-10