Tor and privacy for nodes

A node helps you verify the chain on your own machine. Tor optionally hides where that machine is, which is a separate question about network privacy.

What Tor changes and what it does not

With a Tor proxy configured, Core makes outbound connections through Tor. Peers you reach over onion addresses never see your IP; clearnet peers see a Tor exit instead of your ISP address. Optionally Core also publishes your node as an onion service so others can connect to you without learning your IP.

It does not change the public transaction graph, exchange KYC records, what your wallet tells its servers, or DNS and browser leaks on the same machine.

Is it worth it?

• Worth it: you do not want your home IP tied to a Bitcoin node, or you already run Tor for other services.
• Skip it: your threat is an open RPC port (fix that first, see security basics), or you need the fastest sync on slow hardware.
• Fix first: if the worry is who sees your addresses, the exposure is your wallet's server. See connect your wallet to your own node.

Outbound through Tor

Install Tor from your distribution and make sure it listens as a SOCKS proxy on 9050 (the usual default; Tor Browser uses 9150). Then in bitcoin.conf:

proxy=127.0.0.1:9050

That one line sends all outbound connections through Tor, clearnet peers included, and also lets Core reach onion peers. To refuse clearnet peers entirely, add onlynet=onion. It limits automatic outbound connections only, so you will have fewer peers and a slower sync.

DNS lookups are only proxied when you use a plain proxy= setting; if you configure just onion=, they can go out over your normal connection. Read the details before relying on this for anything serious: doc/tor.md.

Optional: accept connections as an onion service

Using proxy= turns listening off by default. To publish an onion service, enable listening; Core then creates one automatically through Tor's control port. listenonion is already on by default when Core is listening, so it only needs to be set to turn it off.

proxy=127.0.0.1:9050
listen=1
bind=127.0.0.1:8334=onion

Keep the bind line. Without any bind, listen=1 also opens TCP 8333 on all interfaces, so clearnet peers can connect to your IP. bind=127.0.0.1:8334=onion is the form doc/tor.md gives. It limits listening to a loopback address that Core treats as incoming Tor traffic, so only Tor reaches the node. A Tor-only node therefore needs no port forward and no firewall rule for 8333.

Core must be able to authenticate to Tor's control port. In /etc/tor/torrc enable (or uncomment):

ControlPort 9051
CookieAuthentication 1
CookieAuthFileGroupReadable 1
DataDirectoryGroupReadable 1

Then restart Tor and add the user running bitcoind to Tor's group (debian-tor on Debian and Ubuntu), so it can read the cookie. Without that, the debug log shows Authentication cookie ... could not be opened (check permissions).

$ sudo usermod -aG debian-tor bitcoin
$ sudo systemctl restart tor bitcoind

Check it works

$ bitcoin-cli getnetworkinfo | grep -E -A3 '"onion"|localaddresses'
      "name": "onion",
      "limited": false,
      "reachable": true,
      "proxy": "127.0.0.1:9050",
--
  "localaddresses": [
    {
      "address": "exampleonionaddressexample.onion",
      "port": 8333,

A .onion entry under localaddresses means the onion service is up. If it is missing, set debug=tor and read journalctl -u bitcoind. Core supports Tor v3 addresses only.

Costs

• Speed. Tor bandwidth varies. Sync over Tor alone can take several times longer. A common compromise: finish the sync on clearnet, then enable Tor. Peers saw your IP during that sync.
• VPS. Tor hides you from peers. The hosting provider still sees everything on the machine. See VPS.
• Wallets. Your wallet is separate. A mobile wallet that queries its vendor's servers leaks metadata no matter what your node does. Pointing Sparrow or Electrum at your own node or Electrum server fixes that, with or without Tor.

Claims and reality

Not sure a node is for you? Do you need a node? Appliances such as Start9 and Umbrel offer Tor as a toggle; see hardware. Install steps: setup.

FAQ