- The Tor Project says its Android VPN beta gives each app its own Tor circuit, and that testing showed its exit-selection menu confused users who needed bridges.
- The project rebuilt the app on Arti, a Rust version of Tor. It reports fewer crashes, but some performance features from the older C code are not yet available.
- Ask vendors what their tool assumes about the user's situation, which options can defeat its purpose, when users see them, and whether builds can be verified.
A security setting can look like control and work like a detour. The Tor Project says it ran into this while building a VPN for Android. The lesson applies to anyone who buys or deploys security tools for people working under pressure.
What the Tor Project reports
In a post on its blog, the Tor Project describes the first year of Tor VPN Beta. The idea dates to 2021, when user research showed people wanted Tor's protection across their whole device, not only inside a browser. A limited Android release followed last fall.
Once people started using it, the main purpose became clear: unblocking the internet. The team says early adopters included users in Iran and Turkmenistan, where censorship is heavy. It adds that Tor Browser for Android draws more users from the Global North. For Tor VPN Beta, it sees deeper engagement from the Global South.
How the design works
Most VPNs push all of a phone's traffic through one tunnel. Tor VPN Beta does not. The Tor Project says each app gets its own Tor circuit, which is the chain of relays that carries traffic. Because apps do not share a circuit, activity in one app cannot easily be tied to another. The team says Tor Browser's way of keeping websites apart inspired this choice.
Where censors block Tor, users need another way in. The team prioritised WebTunnel bridges, added in the early 1.4.0 beta. A bridge is an entry point that is not publicly listed. The Tor Project says WebTunnel dresses Tor connections up as everyday secure web browsing, so a censor has a harder time spotting and blocking them.
When more control meant more mistakes
Tor VPN Beta includes exit selection, a feature common in VPNs. It lets users choose where their traffic leaves the Tor network. The team first explored giving users broader control over it. The idea looked attractive.
Usability testing and early feedback told a different story. The Tor Project says people trying to get past censorship were choosing exit locations when they needed bridges. Their picture of how Tor works did not match how it actually works.
The feature stayed in the beta, but the order changed. The current design asks users to connect to Tor first and pick an exit afterwards. The team says it wants to explore exit selection more fully later. Any fuller version, it says, has to avoid causing user error in high-risk situations.
The price of a new foundation
Tor VPN is built on Arti, the project's next-generation Tor implementation written in Rust. The team says this gives it a fresh footing instead of working around an older design. It reports fewer crashes and better handling of network conditions.
There is a cost. The Tor Project says some performance features from Tor's older C implementation, such as congestion control, are not yet in Arti. It also says the app is not built for speed the way commercial VPNs are. Stability came first; the team says bringing more performance features into Arti is next.
The team also made its builds reproducible. This lets anyone check that the app they run matches the published source code. It added F-Droid, so users can install and update the app without Google Play. The beta is still available as an APK and on Google Play. The project says its Arti and Onionmasq components can be reused across apps, which it expects to cut duplicated work and long-term upkeep risk.
Questions to put to your team
This is one project's account of one beta. The Tor Project points readers to its threat model for known limitations. It reports confusion in testing and early feedback, not measured harm. It is not a verdict on the wider VPN market. It does give leaders useful questions.
First, what situation does the tool assume its user is in? A tool built for privacy may not fit someone trying to get around a block. Second, which settings can pull users away from the tool's own purpose, and at what point do they see them? Third, can the vendor show that the software you run matches its source code? Fourth, if the vendor has rebuilt on a new foundation, which older capabilities are still missing?
The lesson here, in our view, is about sequence and restraint. A menu shown before the user has taken the essential step can lead them away from the tool they needed. Tor's testing points to that risk with its exit menu. Tor did not remove the feature. It moved the choice behind the first step and kept the fuller version for later. Good security design decides what to ask, and when.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: blog.torproject.org.
