Orbot

Free, open-source Tor proxy for Android and iOS. Routes your mobile traffic through the Tor network to mask your identity and location. Built by the Guardian Project.

Personal security

Open source

Strong

https://orbot.app · Reviewed 2026-04-11 · Editorial assessment by Mike Schneider — not an independent security audit

What should journalists know about Orbot?

Orbot does one thing well: it puts the Tor network between your mobile device and the internet. On Android, it can route all device traffic or selective per-app traffic through Tor using Android's VPN interface. On iOS, it provides a VPN-mode tunnel for all traffic. The result: your real IP address is hidden from the websites and services you access, your ISP sees only encrypted Tor traffic, and you can reach .onion services that are otherwise inaccessible. The Guardian Project — the team behind Orbot — has been building privacy tools for journalists and activists since 2009. Nathan Freitas and team have deep roots in the press freedom community. Orbot integrates with other Guardian Project tools and has been recommended by CPJ, EFF, and Reporters Without Borders for journalists in restrictive environments. The honest limitations: Tor is slow. Routing traffic through three relays adds significant latency — expect 2-10x slower connections depending on circuit quality. Many services block Tor exit nodes (Google CAPTCHAs become relentless, some banking apps refuse to load, streaming services block access). On iOS, per-app routing is not possible — it is all-or-nothing VPN mode. Battery drain is real on mobile devices. And Tor protects network-layer metadata but does nothing if you log into an account tied to your real identity — Tor anonymity requires behavioral discipline, not just technical setup. Orbot also supports Tor bridges (obfs4, Snowflake) for users in countries that actively block Tor (China, Iran, Russia, Turkmenistan). This is critical for journalists in those environments — standard Tor connections are fingerprinted and blocked, but bridges disguise the traffic. For journalists who need mobile Tor access — whether to research sensitive topics without revealing their IP, access blocked sites, or communicate via .onion services — Orbot is the standard tool. There is no credible alternative on mobile.

Best for

Hiding your IP address and location from websites you visit on mobile. Accessing .onion services (SecureDrop instances, darknet research) from a phone. Circumventing internet censorship in restrictive countries. Protecting your browsing from local network surveillance (hotel Wi-Fi, airport networks, compromised ISPs). Research on sensitive topics where you do not want your IP in server logs.

Not for

Everyday browsing — the speed penalty makes it impractical for routine use. High-bandwidth activities (video streaming, large downloads). Situations where Tor exit node blocking makes services unusable. Protection against sophisticated state actors who can perform traffic correlation attacks. Anonymity if you then log into accounts linked to your real identity. iOS users who need per-app routing (not supported).

Security & Privacy

Encryption in transit Yes

Data is scrambled while being sent to their servers

Encryption at rest Partial

Data is scrambled when stored on their servers

Data jurisdiction No central server. Orbot is a local application that connects to the decentralized Tor network. The Guardian Project (US-based nonprofit) develops the app but operates no data-collecting infrastructure. Tor traffic passes through volunteer-operated relays worldwide — no single entity controls or monitors the full path. Your traffic exits from a random Tor exit node, so the destination sees that node's IP, not yours.

Where servers are located — affects which governments can request your data

Security rating Strong

Orbot collects no user data. There is no account, no registration, no telemetry, and no central logging. The Guardian Project does not operate Tor relays and has no visibility into your traffic. The app connects to the public Tor network — the same infrastructure used by Tor Browser. Your ISP sees encrypted Tor traffic but not its content or destination. The destination sees a Tor exit node IP but not your real IP. No single party in the chain can see both who you are and what you are doing.

How to protect yourself:

Do not assume Tor alone makes you anonymous — if you log into Gmail or Facebook over Tor, those services still know who you are. Use Tor Browser for web browsing when possible (stronger fingerprinting protection than Orbot + a regular browser). On Android, use per-app VPN mode to route only sensitive apps through Tor rather than all traffic. Enable Tor bridges (Settings > Bridges) if you are in a country that blocks Tor. Be aware of DNS leaks — ensure your device is not resolving DNS outside the Tor tunnel. Expect slower connections and plan accordingly. Do not torrent over Tor (it deanonymizes you and degrades the network for others). Combine with a hardened browser (Firefox with strict settings, or Tor Browser's Android version) for strongest protection. Check the Tor Project's documentation on operational security — the technology is only one layer of anonymity.

Orbot is the mobile implementation of Tor — the most studied and battle-tested anonymity network in existence. The Guardian Project has a 15+ year track record building privacy tools for journalists and activists. The code is fully open source, the Tor network itself undergoes continuous academic scrutiny, and the tool is recommended by CPJ, EFF, RSF, and Freedom of the Press Foundation. The 'strong' rating reflects the tool's provenance, transparency, and the maturity of the underlying Tor network. It does not mean Tor provides absolute anonymity — traffic correlation attacks by nation-state adversaries remain theoretically possible, and operational security mistakes can deanonymize users regardless of the technology. Orbot is strong infrastructure used correctly; it is not a magic cloak.

Who Owns This

Owner Guardian Project (US-based open-source nonprofit)

Funding Guardian Project is funded through grants from organizations including the Open Technology Fund, the Ford Foundation, and other press freedom and digital rights funders. Orbot development is supported by community donations. No commercial revenue, no advertising, no data monetization.

Business model Free and open source. No revenue from users. Guardian Project operates as a grant-funded nonprofit building privacy and security tools for journalists, activists, and human rights defenders. Orbot's development is sustained by institutional grants and individual donations.

Known issues

Tor's fundamental limitation applies: a global passive adversary (a state actor monitoring both the entry and exit of your Tor circuit) can theoretically perform traffic correlation attacks to deanonymize users. This is a known Tor network limitation, not an Orbot-specific bug. iOS support is more limited than Android — no per-app routing, VPN-only mode. Some Tor exit nodes are operated by malicious actors who can intercept unencrypted (non-HTTPS) traffic exiting the network — always use HTTPS. Speed is consistently slower than direct connections (2-10x latency increase). Many commercial services actively block Tor exit node IPs, making the tool impractical for certain websites. Battery consumption is higher than normal network usage. The app occasionally loses connection to the Tor network and requires manual reconnection. In some countries, merely using Tor (even with bridges) may attract unwanted attention from authorities — assess your local risk before enabling.

Pricing

Free

This is an editorial assessment based on publicly available information as of 2026-04-11, using our published methodology. Independent security review is pending. Security posture can change at any time. This is not a guarantee of safety.

Something wrong or outdated? Report it.