Onion Routing

Every time you visit a website, your traffic flows through routers that can see exactly where it came from and where it is going. For most browsing that is fine — but for dissidents, journalists, and anyone who needs genuine privacy, that transparency is a threat.

Onion routing, invented by US Naval Research Laboratory researchers Paul Syverson, Michael Reed, and David Goldschlag in the mid-1990s and later refined into Tor (The Onion Router) in 2002 by Roger Dingledine, Nick Mathewson, and Syverson, solves this by wrapping a message in nested layers of encryption — one per relay in the path. Each relay decrypts only its own outer layer, learns only the next hop, and forwards what remains. No single node in the chain sees both the original sender and the final destination.

The name is no accident. Like peeling an onion, each relay removes exactly one layer and passes the core onward — never seeing what is inside the layers it did not peel.

Below, a message is wrapped in three encryption layers — one for each relay — and then forwarded hop by hop. Click Wrap to build the onion, then Next Hop to peel one layer at each relay.

<p class="hint">{{hint}}</p>
<div id="circuit">
  <div class="node" id="node-you">
    <div class="node-label">{{label_you}}</div>
    <div class="node-ip">192.168.1.42</div>
  </div>
  <div class="arrow" id="arrow-0">→</div>
  <div class="node relay" id="node-0">
    <div class="node-label">{{label_guard}}</div>
    <div class="node-ip">Relay A</div>
  </div>
  <div class="arrow" id="arrow-1">→</div>
  <div class="node relay" id="node-1">
    <div class="node-label">{{label_middle}}</div>
    <div class="node-ip">Relay B</div>
  </div>
  <div class="arrow" id="arrow-2">→</div>
  <div class="node relay" id="node-2">
    <div class="node-label">{{label_exit}}</div>
    <div class="node-ip">Relay C</div>
  </div>
  <div class="arrow" id="arrow-3">→</div>
  <div class="node" id="node-dest">
    <div class="node-label">{{label_server}}</div>
    <div class="node-ip">example.com</div>
  </div>
</div>
<div id="packet-wrap">
  <div id="packet"></div>
</div>
<div class="log-box">
  <div id="log-title">{{log_title}}</div>
  <div id="log"></div>
</div>
<div class="btns">
  <button id="btn-wrap" type="button">{{btn_wrap}}</button>
  <button id="btn-hop" type="button" disabled>{{btn_hop}}</button>
  <button id="btn-reset" type="button" class="ghost">{{btn_reset}}</button>
</div>

* { box-sizing: border-box; }
body { font-family: system-ui, sans-serif; color: #222; margin: 0; font-size: 14px; }
.hint { font-size: .88rem; color: #444; margin: 0 0 .7rem; line-height: 1.45; }
#circuit { display: flex; align-items: center; gap: 4px; flex-wrap: wrap; margin-bottom: .6rem; }
.node { display: flex; flex-direction: column; align-items: center; justify-content: center;
        width: 68px; min-height: 54px; border-radius: 10px; border: 2px solid #bcc5d0;
        background: #eef2f6; padding: 4px; transition: background .3s, border-color .3s; }
.node.relay { background: #dde8f4; border-color: #94b4d6; }
.node.active { background: #1d3557; border-color: #1d3557; color: #fff; }
.node.done   { background: #c3e6cb; border-color: #2c8c4e; }
.node-label { font-weight: 700; font-size: .8rem; }
.node-ip    { font-size: .72rem; opacity: .75; }
.arrow { font-size: 1.3rem; color: #8899aa; padding: 0 2px; }
#packet-wrap { min-height: 64px; display: flex; align-items: center; justify-content: center; margin: .4rem 0; }
#packet { font-size: .78rem; font-family: ui-monospace, monospace; text-align: center;
          border-radius: 8px; padding: 6px 10px; max-width: 100%; word-break: break-all;
          background: #f0f4f8; border: 1px solid #c5d0dc; min-height: 48px;
          display: flex; align-items: center; justify-content: center; color: #1d3557; }
.log-box { background: #f8f9fb; border: 1px solid #d5dde5; border-radius: 8px;
           padding: 8px 12px; margin-bottom: .6rem; min-height: 60px; }
#log-title { font-weight: 700; font-size: .82rem; margin-bottom: 4px; color: #445; }
.log-entry { font-size: .81rem; margin: 2px 0; line-height: 1.4; }
.log-entry .who { font-weight: 700; color: #1d3557; }
.log-entry .sees { color: #444; }
.btns { display: flex; gap: .5rem; flex-wrap: wrap; }
button { font: 600 14px system-ui, sans-serif; padding: .4rem .85rem;
         border: 1px solid #1d3557; background: #1d3557; color: #fff;
         border-radius: 8px; cursor: pointer; }
button.ghost { background: #fff; color: #1d3557; }
button:disabled { opacity: .4; cursor: default; }

// Code not found

Notice what each relay sees: only the layer it is allowed to peel, and only the address of the next hop. The entry relay (Guard) knows your real IP but not the destination. The exit relay knows the destination but not who you are. The middle relay knows neither. Only by compromising all three relays simultaneously — and correlating traffic timing — could an adversary link sender to destination.

Onion routing gives provable anonymity under standard cryptographic assumptions — but "provable" comes with important caveats.

What it hides well:

• Sender identity from the destination: the exit relay presents its own IP, not yours.
• Destination from intermediate nodes: the guard and middle relay only see the next hop.
• Content from all relays: the message is encrypted end-to-end until it reaches the exit.

Where it is genuinely weak:

• Traffic analysis by a global adversary: if an attacker controls or can observe both the entry and exit of the circuit, timing correlations can de-anonymize you. This is the hardest known attack on Tor and motivated later work on traffic-analysis-resistant protocols.
• Malicious exit relay: the exit decrypts the final layer before forwarding — it sees the plaintext unless the underlying connection uses TLS. This is why HTTPS matters even inside Tor.
• End-to-end correlation: the volume and timing of packets entering the network can be matched to packets leaving it. Tor's design paper (Dingledine, Mathewson & Syverson, 2004) acknowledges this is not fully solved.
• Sybil attacks: an adversary who runs many relays raises the chance of controlling both ends of a circuit.

The formal security model is computational anonymity: an adversary running in polynomial time cannot link sender to destination with probability significantly better than chance, assuming the underlying public-key cryptography is secure. This is the same assumption behind factoring and discrete log problems — hard, but not proven impossible.

Onion routing is the backbone of a broad class of privacy-preserving systems:

• Tor browser: the most widely deployed anonymity network, used by journalists, activists, and ordinary people in censored regions. Roughly 2 million daily users as of 2024.
• SecureDrop: the anonymous whistleblowing platform used by major news organizations runs over Tor, allowing sources to submit documents without revealing their identity.
• I2P (Invisible Internet Project): an alternative layered-routing network, optimized for internal hidden services rather than access to the public web.
• Mixnets: a related family of designs (dating to David Chaum's 1981 paper on Mix networks) that add batching and reordering of messages to defeat timing attacks — the idea behind modern proposals like Loopix and Nym.
• Blockchain privacy: protocols like Dandelion++ use onion-routing-inspired propagation to hide which node first broadcast a transaction, making it harder to link transactions to IP addresses.
• Private messaging: Signal's Sealed Sender and similar designs borrow the "no single point knows everything" principle to hide sender metadata.

Wherever surveillance is a threat and privacy matters, the core insight of onion routing — split knowledge across relays — keeps reappearing in new forms.

Onion routing captures a deceptively simple idea: if no single participant has the full picture, no single participant can betray you. By nesting encryption layers — one per relay — sender and destination are kept apart without requiring anyone to be fully trusted.

It is not perfect. A powerful adversary who can watch the whole network can correlate traffic patterns and unravel anonymity. The exit relay sees plaintext. Timing attacks remain an open research problem. But for the threat model it was built for — hiding who talks to whom from local observers and network-level surveillance — it remains one of the most elegant and widely deployed privacy techniques ever devised.

The deeper lesson is that cryptographic splitting — dividing a secret across parties so that no subset knows the whole — is a fundamental technique that shows up in factoring-based cryptography, secret sharing, and the ongoing search for stronger anonymity guarantees.