Tor and privacy for nodes

Privacy marketing sells nodes as invisibility cloaks. Reality is narrower: a Bitcoin node helps you verify rules locally; Tor optionally hides your IP from peers. That is useful for some threat models and irrelevant for others. This guide stays honest about both.

What Tor changes for your node

With Tor configured, Bitcoin Core can reach peers over onion services and route outbound connections through a local Tor proxy (127.0.0.1:9050). Peers you connect to via Tor see a Tor exit or onion address instead of your home ISP IP.

What Tor does not change:

• Public on-chain transaction graph
• Exchange know-your-customer records
• Wallet software phoning home to vendor servers
• DNS or browser leaks on the same machine

When Tor is worth the complexity

• You run a node from a fixed home IP and worry about surveillance or harassment
• You want inbound connections without revealing your residential IP (onion service)
• You already operate Tor for other self-hosted services

When to skip Tor

• You need the fastest possible initial sync on slow hardware
• Your threat model is "don't expose RPC" — solved without Tor
• You primarily use a hardware wallet with third-party servers anyway

Threat model worksheet

Before enabling Tor, write down who you are hiding from:

• Random peers — default Tor outbound helps
• Your ISP — Tor encrypts traffic to the Tor network; they see volume, not Bitcoin protocol details
• Blockchain analysts — Tor does nothing; on-chain patterns remain
• Wallet vendors — fix wallet connection, not just Core

If only one row applies, Tor may be worth it. If the last two are your main worry, start with wallet and address reuse habits instead.

Performance expectations

Tor circuits rotate; bandwidth is unpredictable. Initial sync over Tor can take multiples of clearnet time on the same hardware. That is not a disk problem — do not disable verification to "speed up." If time matters more than peer IP hiding, run clearnet sync first, enable Tor after catch-up, accepting that early peers saw your real IP during IBD.

DNS and leak hygiene

Bitcoin Core resolves peer hostnames via your system resolver. On a Tor-only mindset machine, consider:

• Disabling IPv6 if your tunnel does not cover it and leaks are a concern
• Using onlynet=onion in advanced configs when you want strict onion-only peering (fewer peers, slower sync)
• Keeping browsers and wallets on the same host from leaking non-Tor traffic alongside your node

We do not document exotic multi-hop setups — get the basics working on setup guide first.

Minimal Tor config (optional)

Install Tor from your distro, ensure it listens on 9050, then uncomment in bitcoin.conf:

proxy=127.0.0.1:9050
listenonion=1

Full install context lives in the setup guide. Test with bitcoin-cli getnetworkinfo and inspect peer entries for .onion addresses.

VPS + Tor

Running Tor on a VPS hides your traffic from peers, not from the VPS provider. They still see your metal, disk, and billing identity. For provider-level privacy you need legal jurisdiction choices and payment hygiene — outside this site's scope. Read bandwidth notes on VPS comparison before routing 750GB IBD over Tor.

Wallet privacy is separate

Even with a perfect Tor node, a mobile wallet querying Trezor's servers leaks metadata. Electrum connected to your own Electrs over LAN/Tor is the classic improvement path — but that is extra software, RAM, and disk beyond bare Core.

Managed nodes (Start9/Umbrel)

Appliances often ship Tor toggles in their UI. Convenient, but you still trust their image and update channel. Compare total cost against DIY on the hardware page if Tor alone is your trigger.

Honest limits summary

Combining Tor with home network layout

Many users run Core on a LAN server while wallets live on laptops. Tor on the server does not automatically tunnel wallet traffic. Options:

• Wallet connects to Electrs on LAN — Tor on Core hides server IP from peers, not laptop IP from ISP
• Full tunnel VPN on laptop — separate concern from Core Tor
• Mobile wallets — usually still query vendor APIs; your home Tor node does not fix that

Draw a simple diagram of who talks to whom before buying hardware for "privacy."

When regulators and exchanges already know you

KYC exchanges link your identity to on-chain deposits. A Tor node at home does not unlink those coins. Privacy tools change future behavior and network metadata — they do not erase past KYC. Honest expectations prevent expensive placebo setups.

Start with do you need a node? if you have not committed yet. Lock down RPC and updates via security basics before obsessing over Tor.

FAQ