Exit Node
Definition
The third relay in a Tor circuit, which forwards decrypted traffic to the public internet destination. The destination server sees the exit node's IP address, not the user's. Exit node operators can read unencrypted traffic passing through them, which is why HTTPS is still required when using Tor.
- Circuit position
- Third and last relay in a Tor circuit
- Visible IP
- Destination sees the exit node's IP, not the user's
- Traffic exposure
- Operator can read unencrypted (non-HTTPS) traffic
- Investigative use
- Exit IP alone does not identify the originating user
Common questions
Can investigators trace a user from the exit node IP alone?+
No. The exit node IP belongs to a volunteer relay operator, not the sender. Identifying the originating user requires a compromised entry guard, traffic correlation analysis across relays, or evidence obtained elsewhere in the investigation.
Is an exit node operator automatically liable for illicit traffic passing through it?+
Generally not. Most jurisdictions treat a relay operator as a mere conduit carrying traffic it did not originate and cannot control, similar to an ISP. Liability analysis focuses on knowledge and control, not simply on illicit traffic transiting the node.
Does using Tor guarantee end to end anonymity?+
No. Tor anonymizes routing between user and destination, but an exit node can still read unencrypted content, and correlating traffic timing across both ends of the circuit can, in principle, help deanonymize a user.
Related terms
- Blockchain Analysis
- The forensic examination of a cryptocurrency's public transaction ledger to trace the flow of funds between addresses, cluster addresses controlled by the...
- I2P (Invisible Internet Project)
- A peer-to-peer anonymity network that routes traffic through a distributed mesh of volunteer nodes using unidirectional tunnels. Unlike Tor, I2P is primarily...
- Onion Routing
- A technique in which a message is encrypted in multiple layers, one per relay node, so that each relay decrypts only its...
- Onion Service (Hidden Service)
- A server reachable through Tor using a .onion address derived from its public key. The server's real IP address is never exposed...
- Traffic Correlation Attack
- A deanonymisation technique that compares timing patterns and traffic volume at the entry point of a Tor circuit and at the destination,...