Skip to main content

VPNs & Tor for UK Journalists

VPNs and Tor solve different problems. Understanding which one you need — and what each one cannot protect you from — is essential before you rely on either.

General guidance, not professional security advice. For high-risk threat models involving state actors or organised crime targeting, consult a qualified security professional or the Access Now Digital Security Helpline.

Last reviewed: Next review due:

VPN vs Tor: the core difference

VPN — Privacy

Hides your traffic from your ISP. Replaces your IP with the VPN server’s IP. Your VPN provider can see everything. Useful for preventing passive surveillance and ISP data collection. Does not provide anonymity.

Tor — Anonymity

Routes traffic through three encrypted nodes. No single entity can see both who you are and what you are doing. Much slower. Best for high-anonymity browsing, SecureDrop access, and sensitive open-source research.

When each helps

Use a VPN when:

  • Working from a public Wi-Fi network (hotel, cafe, conference)
  • You want to prevent your UK ISP from logging your browsing
  • You are accessing geo-restricted research resources
  • You want to obscure your employer/newsroom’s IP from story subjects during research

Use Tor when:

  • Accessing a SecureDrop .onion address
  • Conducting sensitive OSINT research you cannot link to your IP
  • Your threat model includes adversaries who could compel a VPN provider to produce records
  • You need to access whistleblower resources without leaving a network log at your ISP

Audit-verified VPN providers

Mullvad VPN

Swedish, accepts cash, no account required (just a number), independently audited no-logs infrastructure, RAM-only servers. Strong privacy credentials.

ProtonVPN

Swiss, operated by the Proton organisation (also behind ProtonMail), independently audited, open-source clients, free tier available. Well-established journalism-friendly provider.

IVPN

Gibraltar-registered, independently audited, supports anonymous payment, privacy-focused, smaller provider with strong transparency record.

Avoid: free VPN services, VPNs based in Five Eyes countries without independent audits, and any VPN that cannot demonstrate a no-logs policy with third-party verification.

Red flags

  • Using a free VPN — free VPNs often monetise user data.
  • Believing a VPN makes you anonymous — it does not.
  • Using Tor without understanding that exit node traffic is unencrypted (unless the destination uses HTTPS).
  • Logging into personal accounts (Google, Facebook) over Tor — this re-identifies you.
  • Using a VPN provider headquartered in a country with mandatory data retention laws and no independent audit.

VPN & Tor checklist

  • I have chosen an audit-verified, no-logs VPN provider appropriate to my threat model.
  • I enable my VPN whenever working on public Wi-Fi.
  • I use Tor Browser (not a regular browser over Tor) for anonymised research.
  • I access SecureDrop only via Tor Browser.
  • I do not log into personal accounts while using Tor.
  • For high-risk work: I connect to my VPN before launching Tor Browser (Tor over VPN).
  • I understand that a VPN does not encrypt end-to-end — HTTPS still matters.

Story risk register

Log network security decisions alongside other story risks.

Story Risk Register

Common mistakes

  • Using a VPN and believing you are now anonymous — you are not.
  • Using Tor but logging into accounts that identify you.
  • Running Tor inside a regular browser rather than Tor Browser — your browser fingerprint can identify you.
  • Choosing a free VPN for cost reasons — the true cost is your data.
  • Not keeping Tor Browser updated — older versions have known vulnerabilities.

Related guides

SecureDrop for Newsrooms
Accessing SecureDrop over Tor Browser.
Threat Modelling
Deciding whether a VPN or Tor (or both) fits your threat model.
Travel Security & UK Border
VPN use at borders and on travel networks.
State-Actor Threats
When Tor and VPNs are relevant to the IPA 2016 threat model.

Primary sources

Frequently asked questions

Does a VPN make me anonymous?
No. A VPN hides your browsing from your ISP and from the sites you visit (which see the VPN server's IP, not yours). But the VPN provider can see all your traffic. If the provider keeps logs and is served a legal demand, your activity can be revealed. A VPN provides privacy from your ISP and from passive network observers — not anonymity. For anonymity, use Tor.
Which VPN providers are trustworthy for journalists?
Choose providers that have undergone independent audits of their no-logs claims and infrastructure. Mullvad, ProtonVPN, and IVPN are among the most respected options for privacy-conscious users. They accept anonymous payment (cash, cryptocurrency), have undergone third-party audits, and have published transparency reports. Avoid free VPN services — many monetise user data.
When should I use Tor instead of a VPN?
Use Tor when you need strong anonymity rather than just privacy. Tor routes traffic through three volunteer-operated nodes, encrypting at each hop. No single node knows both who you are and what you are doing. Use Tor Browser when accessing SecureDrop .onion addresses, conducting sensitive open-source research you do not want attributed to your IP, or when your threat model includes adversaries who could compel a VPN provider to produce records.
What does combining VPN + Tor achieve?
Running Tor over a VPN (connecting to a VPN first, then launching Tor Browser) prevents your ISP from knowing you use Tor at all, which can be useful in contexts where Tor usage is monitored. Your VPN provider sees that you are connecting to Tor but cannot see your Tor traffic. The exit node cannot see your VPN IP. This is a sensible configuration for high-risk journalism, but adds complexity and slows your connection further.

Related guides

Digital SecuritySecureDrop for NewsroomsRead →Digital SecurityState-Actor Threats: IPA 2016 & RIPARead →InvestigativeProtecting Sources: Network AnonymityRead →Media LawLegal Source Protection in the UKRead →SafetyJournalist Wellbeing Under Surveillance PressureRead →

Primary sources