VPN vs proxy vs Tor: which one should you use?

You can hide your IP three serious ways: a VPN, a proxy, or Tor. People often use these terms interchangeably, but they're three quite different tools. Picking the wrong one for your goal usually means either wasting money or assuming privacy you don't actually have.

Here's the comparison, the honest tradeoffs, and the rule of thumb for picking one.

At a glance

	VPN	Proxy	Tor
Hides your IP	Yes	Yes (usually)	Yes
Encrypts traffic to the relay	Yes	Sometimes	Yes (3 layers)
Encrypts traffic to the destination	Only if HTTPS	Only if HTTPS	Only if HTTPS
Protects all device traffic	Yes	Per-app	Browser only (default)
Speed	Fast	Fast	Slow
Anonymity strength	Trust the provider	Trust the provider	Strong, no single point of trust
Cost	$3–12/mo	Free–$5/mo	Free
Recommended for	Everyday use	Specialized scraping/testing	Genuine anonymity

VPN — the everyday default

A Virtual Private Network wraps all your internet traffic in an encrypted tunnel to a server you choose. The server forwards your traffic to its real destination. Websites see the VPN server's IP, not yours. Your ISP sees only encrypted traffic going to one address.

What it's good at

One app, system-wide protection.
Fast — usually 10–30% slower than direct.
Lets you choose a virtual location (US, UK, Japan, anywhere your provider has servers).
Solves both "hide my IP" and "encrypt my traffic on public Wi-Fi."

What it's not good at

You're trusting one company. They could log everything you do, in theory. Pick providers with strong audited no-logs claims (Mullvad, Proton VPN, IVPN are well-regarded).
Doesn't anonymize you from accounts you've logged into. Google still knows it's you when you sign in.
Some sites block known VPN IPs.

Pick a VPN if you want general privacy improvement, want to access geo-blocked content, or use untrusted networks regularly. This covers ~95% of users asking "should I hide my IP."

Proxy — narrower, lighter

A proxy server is a single intermediary that forwards traffic on your behalf. It's older and simpler than a VPN. Several flavors exist:

HTTP/HTTPS proxy: handles web traffic only. Common in corporate environments.
SOCKS5 proxy: more flexible, handles any TCP traffic. Often used with specific apps.
Residential proxy: routes through real home connections (commercial product, $5–500/mo).
Datacenter proxy: bulk IPs from cloud providers (cheaper, easier to detect).

What it's good at

Per-app control — your browser uses the proxy, your other apps don't.
Can be very cheap or free.
Useful for scraping, testing geo-targeted ads, or appearing from many IPs (residential proxies).

What it's not good at

Many proxies don't encrypt the connection between you and the proxy. Your ISP can see what you're doing.
Free public proxies are often run by scammers logging traffic, or are slow, or both.
No "system-wide" coverage by default.

Pick a proxy if you have a specific narrow use case (testing, scraping, browser-only privacy with light overhead). For "normal privacy," a VPN is strictly better.

Tor — the strongest anonymity, the slowest experience

Tor is fundamentally different from a VPN or proxy. Instead of one trusted server, your traffic bounces through three random volunteer-run relays around the world. Each relay only knows the previous and next hop — none knows both who you are and where you're going. This is the "onion routing" the project's name comes from.

What it's good at

Real anonymity. No single party — including the Tor project itself — can correlate you to your traffic.
Free and open source.
Powerful for accessing the regular web, plus .onion hidden services.

What it's not good at

Slow. Bouncing through three global hops adds 200–1000ms latency. Pages take 5–30 seconds to load.
Many sites block Tor exits or hit them with aggressive CAPTCHAs.
The "exit node" can see your unencrypted traffic (so use HTTPS, which everyone does now anyway).
Doesn't anonymize traffic from non-browser apps unless you configure them carefully.
Not great for streaming, gaming, or large downloads.

Pick Tor if you specifically need anonymity for activism, journalism, accessing blocked content under repressive networks, or research where being identified would be a problem. Overkill for "I don't want Netflix to know my country."

Common confusions

"VPNs are encrypted, proxies aren't." Mostly true but not always — HTTPS proxies and SOCKS5-over-TLS exist. The bigger truth: VPNs always encrypt the first hop; many proxies don't.

"Tor is just a free VPN." No. A VPN gives you one trusted intermediary; Tor gives you three untrusted intermediaries with cryptographic mixing. They're solving different problems.

"I should chain a VPN through Tor for double protection." It's technically possible (called "VPN over Tor" or "Tor over VPN") but the marginal privacy benefit is small and the configuration mistakes can actually hurt your anonymity. If you understand the threat model where this matters, you don't need this article. If you don't, just use Tor Browser as-is.

"I'll just use Cloudflare WARP/iCloud Private Relay/free company X." These are real options, with their own tradeoffs. WARP and Private Relay don't hide your country well and may not be enough for region-spoofing. They're decent for casual privacy lift on mobile, less ideal for streaming or full-on IP hiding.

Whichever you pick, verify it's working

After turning on your VPN/proxy/Tor:

Check your IP — it should show the new IP, not your real one.
Run a WebRTC leak test — your browser can leak your real IP through WebRTC even when a VPN is on.
Check DNS leaks — DNS queries can bypass the tunnel. Compare the DNS resolver IP shown on a leak-test site against your VPN provider's known DNS servers.
Test under load. Some VPNs disconnect briefly under stress, exposing your real IP for seconds at a time. Use the "kill switch" feature most quality VPNs offer to prevent traffic when the tunnel drops.

TL;DR

VPN for everyday privacy. Pay $5–10/month, pick a known no-logs provider.
Proxy for specific narrow use cases (scraping, app-level routing).
Tor when you need genuine anonymity, not just IP hiding.

If you can only pick one and you're not sure which: pick the VPN.