How Tor Works
Tor routes your traffic through three volunteer-operated nodes (called relays): an entry node, a middle relay, and an exit node. Each relay knows only the previous and next hop, not the full path. The exit node sees your traffic going to its destination but does not know who you are. This architecture means no single relay can identify both the user and the destination simultaneously.
Tor traffic is slow because of the three-relay chain. Video streaming is generally impractical. Tor Browser, the standard way to use Tor, has fingerprinting protections that most VPNs lack: all Tor Browser users appear identical to websites, making browser fingerprinting ineffective.
How a VPN Works
A VPN routes your traffic through a single server operated by the VPN company. The VPN server sees all your traffic and knows who you are (you paid for the service and connected from your IP address). Your ISP cannot see your traffic, but the VPN provider can. A VPN's privacy protection is only as strong as the provider's no-logs policy and its legal jurisdiction.
Threat Model: Who Are You Hiding From
Tor is better if you are hiding from a powerful adversary who can compel your ISP to hand over records or who operates at a national surveillance level. The three-relay architecture means a single compromised point does not expose you. Tor was designed specifically for this threat model. Journalists, activists in repressive regimes, and whistleblowers use Tor for this reason.
A VPN is better if you are hiding from your ISP, your employer's network, or local network monitoring. It is also better for all activities where speed matters, since a VPN adds 10-50ms of latency vs. Tor's several hundred milliseconds. For everyday privacy from commercial tracking and ISP monitoring, a reputable VPN is the more practical choice.
Using Both Together
Some users route traffic through a VPN first, then through Tor (VPN over Tor). This prevents the Tor entry node from seeing your real IP, providing an extra layer if the Tor entry guard is compromised. The practical speed penalty is significant. This setup is appropriate only for high-stakes use cases where both ISP-level and Tor-level surveillance are concerns.
The Short Answer
For most users protecting everyday privacy: a VPN. For users facing serious adversarial surveillance where identifying the source of communications is the primary threat: Tor. For users who want to access the dark web: Tor. For users who want fast, private browsing for normal activities: VPN.