How They Differ
A VPN encrypts your traffic and routes it through a single server operated by the VPN provider. Your ISP cannot see your traffic, but the VPN provider can -- you are trusting the VPN provider instead of your ISP. Tor routes your traffic through three volunteer-operated nodes (entry, middle, exit) with each node knowing only the previous and next hop. No single node knows both who you are and what you are accessing. Tor is slower (three hops, volunteer bandwidth), but provides stronger anonymity because it is decentralized and no single party sees the full picture.
When a VPN Is Enough
For most privacy needs -- hiding browsing from your ISP, accessing region-locked content, using public WiFi safely, preventing tracking -- a reputable VPN with a no-logs policy is sufficient. You are trusting the VPN provider, but a provider with an audited no-logs policy and a history of resisting law enforcement requests (ProtonVPN, Mullvad) is a reasonable trust level for everyday privacy. VPN is also practical: speeds are acceptable for streaming, video calls, and general use.
When Tor Is Appropriate
Tor is designed for situations where you cannot trust any single party with your identity or traffic. Journalists communicating with sources. Activists in countries with active surveillance. Whistleblowers accessing SecureDrop. Anyone for whom being identified carries serious risk. Tor also provides access to .onion sites (the Tor network's hidden services) which VPNs do not. The practical cost: Tor is 5-10x slower than a VPN and unsuitable for streaming, video calls, or large downloads.
Tor Over VPN
Tor over VPN (connecting to a VPN first, then using Tor) hides the fact that you are using Tor from your ISP -- in some countries, Tor usage itself is flagged or blocked. Your VPN provider sees that you are using Tor but not what you are doing with it. The entry Tor node sees the VPN server IP, not your real IP. This combination is recommended for journalists and activists in restrictive environments who need Tor but cannot afford to have Tor traffic visible to their ISP. ProtonVPN offers a dedicated Tor over VPN feature that routes all traffic through Tor automatically.
VPN Over Tor
VPN over Tor (connecting to Tor first, then to a VPN) is far more complex, rarely recommended, and provides questionable security benefits for most users. Avoid this configuration unless you have a specific technical reason for it.