A proxy changes your visible address for a single app and usually encrypts nothing. A VPN encrypts all traffic from the device and sends it through one server you trust. Tor sends traffic through three volunteer-run relays so that no single point knows both who you are and where you are going, at a heavy cost in speed. They solve different problems: a VPN is the everyday tool for privacy and public Wi-Fi, Tor is for anonymity against a determined observer, and a proxy is for changing an address in one program without touching the rest.
Who sees what
| Your ISP or Wi-Fi sees | The service sees | Websites see | |
|---|---|---|---|
| Nothing | every domain, timing, volume | — | your real IP |
| HTTP/SOCKS proxy | every domain (DNS often bypasses the proxy) | your IP and destinations | proxy IP |
| VPN | one encrypted connection to the VPN server | your IP and destinations | VPN IP |
| Tor | one encrypted connection to a Tor entry relay | entry knows your IP, exit knows destination, neither knows both | exit relay IP |
The row that surprises people is the proxy: DNS queries frequently go straight to the ISP even with a proxy configured, so the ISP keeps the list of sites while the sites see a different address. What the ISP sees in each case is broken down further in what can my ISP see.
Proxy
A proxy is a server that forwards requests on your behalf. HTTP proxies handle web traffic; SOCKS5 proxies forward any connection. Neither encrypts by itself: whatever leaves the app unencrypted crosses the network unencrypted. Proxies are configured per app, so everything else on the device goes direct.
Use a proxy when you need a different address in one program, on a server for automation, or when speed matters more than privacy. Do not use a plain proxy on public Wi-Fi expecting protection; it does not provide any.
Modern "proxy protocols" such as VLESS blur the line: they encrypt traffic with TLS and, in TUN mode, capture the whole device like a VPN. In that mode the difference from a VPN is naming, not effect.
VPN
A VPN creates a virtual network interface and routes every app through an encrypted tunnel to one server. The ISP and local network see nothing but an encrypted stream; websites see the server's address. It is fast, works for all apps at once, and includes practical features: kill switch, DNS inside the tunnel, split tunneling.
The trade-off is trust. The VPN server decrypts your traffic and forwards it, so the provider is in the position the ISP was in. Whether it records anything is a policy question, covered in what does no logs mean. A VPN protects you from the network and the ISP; it does not make you anonymous to a provider that keeps logs or to a website you log into.
Use a VPN for public Wi-Fi, privacy from the ISP, appearing from your home country while traveling, and any everyday situation where speed matters.
Tor
Tor routes traffic through three relays chosen from thousands run by volunteers. The entry relay knows your IP but not your destination; the exit relay knows the destination but not your IP; the middle relay knows neither. Each hop is separately encrypted. Tor Browser adds a hardened browser that resists fingerprinting, which a VPN cannot do, because fingerprinting happens in the browser, not the network.
The costs: speed is a fraction of a normal connection, many sites block or challenge Tor exit addresses, and the exit relay can see unencrypted traffic, so HTTPS is essential. Tor also stands out: the ISP can see that you are connecting to Tor, even if not what you do through it.
Use Tor when anonymity from a determined observer matters more than speed: research, whistleblowing, situations where linking your identity to your activity is the risk. It is the wrong tool for streaming, banking, or anything that needs your real identity anyway.
Combining them
VPN, then Tor (VPN over Tor's entry): the ISP sees only a VPN connection, not Tor, and the Tor entry relay sees the VPN's address instead of yours. This is the common combination and it works with any VPN plus Tor Browser. It does not make Tor faster.
Tor, then VPN: rare, mostly useful to reach services that block Tor exits, and it requires a VPN provider that accepts connections from Tor. Not recommended for most people.
Proxy plus VPN: pointless unless the proxy is needed for an application-specific reason; the VPN already covers what the proxy would do.
Choosing
- Banking, email, work, everyday browsing, public Wi-Fi: VPN.
- Anonymity against someone who can watch both ends: Tor, with HTTPS, and no logins to real identities.
- A different address in one program, speed first: proxy, ideally SOCKS5 with HTTPS destinations.
- Not sure: VPN. It covers the proxy's use cases and most everyday privacy needs, and you can layer Tor Browser on top when a task calls for it.
Whatever you choose, verify it: after connecting, check What Is My IP and the WebRTC leak test, because a browser can reveal your real address through WebRTC regardless of proxy, VPN or Tor settings.
404 VPN is a VPN in the sense above: VLESS or WireGuard tunnel for the whole device, DNS inside it, kill switch, split tunneling where you want exceptions, and a privacy policy that lists what is and is not kept. Get started here.