The Difference Between a VPN, a Proxy, and a Tor Node

When you connect directly, the website sees the public IP address your ISP assigned. A VPN, a proxy and Tor each insert a relay between you and the destination, so the destination sees the relay's address instead. That is where the similarity ends. They differ in what gets encrypted, how much of your traffic is covered, who runs the relay and can see what, and how the resulting address looks in an IP lookup.

A VPN client encrypts all traffic from your device and sends it through a tunnel to a server run by the VPN provider. The server decrypts it and forwards it to the destination, which sees the server's address. Your ISP and the local network see only encrypted traffic to the VPN server.

The trade-off is that the provider now sits where the ISP used to. It can see your real address and every destination, so its logging policy and jurisdiction matter. Because VPN servers live in datacenters, an IP lookup on a VPN exit typically returns a hosting or cloud ASN and, for known providers, an explicit VPN flag. The location shown is the server's registered location, which may differ from the city the provider advertises.

A proxy forwards requests on behalf of a single application or connection, usually configured in a browser, a scraper or an operating system setting. HTTP proxies handle web traffic; SOCKS proxies handle arbitrary TCP connections. Traffic that is not routed through the proxy leaves your device with your real address.

A proxy adds no encryption of its own. If the connection to the destination is HTTPS, the content stays encrypted end to end and the proxy sees only the host you are connecting to; if it is plain HTTP, the proxy operator can read everything. Datacenter proxies look like hosting networks in a lookup. Residential and mobile proxies route through consumer connections, so the lookup shows an ordinary ISP or carrier, which is exactly why fraud and scraping operations pay for them.

Tor wraps traffic in layers of encryption and sends it through a circuit of three volunteer relays. The entry relay sees your address but not your destination; the exit relay sees the destination but not your address; the middle relay sees neither. The destination sees the exit relay's address.

Exit relays are public. The Tor Project publishes the list, so any site can recognise Tor traffic, and many treat it with suspicion or block it. Tor is slower than a VPN and traffic between the exit and a plain HTTP destination is readable by the exit operator, so HTTPS still matters. In an IP lookup, a Tor exit appears as a known Tor relay, usually with the operator's hosting ASN.

A VPN exit: a hosting or cloud organisation, frequently a VPN flag, and the server's registered city. A datacenter proxy: a hosting classification without a VPN flag, sometimes a proxy flag. A residential proxy: a consumer ISP or mobile carrier that looks like any home user, which is why detection relies on behaviour and reputation rather than the address alone. A Tor exit: a Tor flag drawn from the public relay list.

Use a VPN when you want everything from a device protected from the local network and ISP, or when you need to appear in another country for a service you are entitled to use. Use a proxy when one application needs a different route, such as testing a site from another region or running a crawler within a provider's terms. Use Tor when the goal is anonymity from observers and you can accept the speed and the blocks. Whatever you choose, logging into an account identifies you to that service regardless of the address it sees.