Home / Tor Browser Security Levels

Tor Browser Security Levels Explained

Q: What is the default security level in Tor Browser?

Standard. Tor Browser ships with JavaScript and other web features enabled so most sites work out of the box. You raise the level manually when you want a smaller browser attack surface and accept that some pages may break.

Standard, Safer, and Safest turn off browser features that enlarge your attack surface — JavaScript, remote fonts, media, and on Safest some images. Higher levels break more sites. They are not a ladder from "not anonymous" to "fully anonymous."

Last updated: October 7, 2026 · Reviewed on: October 7, 2026 · By Admin

Standard, Safer, and Safest Compared

The table below follows the Tor Project's security levels documentation as checked on October 7, 2026. Wording may shift slightly in future Tor Browser releases — confirm in Settings if something looks different on your build.

Level	JavaScript	Fonts / math symbols	Images / icons	HTML5 audio / video	Typical compatibility
Standard (default)	Enabled on all sites	Enabled	Enabled	Allowed (not restricted to click-to-play)	Most modern sites work; largest attack surface
Safer	Disabled on non-HTTPS sites	Some fonts and math symbols disabled	Generally still shown	Click-to-play	Many sites work; HTTP-only pages lose scripts
Safest	Disabled on all sites by default	Some fonts, icons, and math symbols disabled	Some images disabled	Click-to-play	Static and basic sites; dynamic apps often fail

Change the level from the shield icon in the toolbar → Settings, or through Privacy and Security in the main settings panel. Tor Browser asks you to save and restart so the restrictions apply consistently.

Tor Browser toolbar showing the shield icon used to open security and connection settings — The shield icon leads to security level controls alongside connection status.

Why These Controls Exist

Websites are not plain text files. JavaScript runs code in your browser. Font and media parsers handle untrusted data. SVG and canvas features add more code paths. Each enabled feature is surface an attacker can try to reach your Tor Browser process or fingerprint your session.

Law-enforcement operations have used browser exploits against Tor users in the past — a documented example is the 2013 Freedom Hosting case, where JavaScript delivered through a compromised service was used to deanonymize visitors. You do not need to memorize every case; the takeaway is that scriptable web content has been a realistic vector, which is why Tor Browser exposes a slider at all.

Separately, Tor Browser already limits fingerprinting in ways the security slider does not touch — standardized window sizes, blocked plugins, and other defenses described in the Tor Project's fingerprinting protections guide. Security levels stack on top of that baseline; they do not replace it.

How to Choose a Level

Pick based on what you are about to open, not on a badge you want to wear all day.

Everyday reading on familiar sites: Standard or Safer keeps news pages, documentation, and HTTPS forums usable. Safer adds friction on legacy HTTP links you should not trust anyway.
Unknown or high-risk pages — unfamiliar onions, paste sites, random downloads: Safest removes most script and media attack paths before you load the content. Expect captchas, login forms, and rich layouts to fail until you consciously lower the level.
Mostly static onion pages — text announcements, simple indexes: Safest often works well because the page does not depend on JavaScript. If icons or images vanish, the text may still be enough to read the message.

No level is mandatory for everyone. Researchers on clearnet Tor metrics might stay on Standard; someone clicking an unverified onion link might jump to Safest for that session only.

When a Site Breaks

Symptoms map fairly cleanly to disabled features:

Blank page or missing buttons → JavaScript is off (Safer on HTTP, or Safest everywhere).
Video/audio never starts → media is click-to-play at Safer and Safest; look for a play control in the page or toolbar.
Wrong fonts, missing icons, or garbled math → font and symbol restrictions at Safer/Safest.
Missing images at Safest → image restrictions for non-essential graphics.

Temporarily lowering the level for one task is a valid trade-off if you trust the specific page and need functionality back. Raise it again when you are done. Do not treat about:config tweaks or extra extensions as a permanent workaround — they change your fingerprint and are hard to undo cleanly. The Tor Project's plugins guidance applies the same logic: avoid add-ons that distinguish you from other Tor Browser users.

Common Misconceptions

"Safest makes me immune to browser and OS bugs.": It removes major web features attackers love, but kernel, graphics, and font bugs outside the slider still exist. Keep Tor Browser updated and treat downloads as hostile.
"If JavaScript is off, I cannot deanonymize myself.": You can still log into a named account, paste personal details, or upload EXIF-filled photos. The slider limits passive web attacks; it does not stop voluntary disclosure.
"Standard turns off Tor.": Standard only affects browser features. Your traffic still routes through Tor when Tor Browser is connected. Check check.torproject.org if you are unsure.
"I should tweak NoScript separately from the slider.": Tor Browser integrates NoScript with the security level system. Random old tutorials that describe manual NoScript whitelists may fight current defaults and create a fingerprint unlike other Tor users. Start from the slider; deviate only when you understand the cost.

Android Uses the Same Three Levels

Tor Browser for Android exposes Standard, Safer, and Safest with the same conceptual trade-offs. As of the Tor Project docs checked October 7, 2026, the path is: menu (three dots) → Privacy and security → Security Level → choose a level → Save and restart.

Menu labels move between releases. If your build looks different, search settings for "Security Level" rather than following a screenshot from an older version.

Sources and Further Reading

Frequently Asked Questions

What is the default security level in Tor Browser?

Standard. Tor Browser ships with JavaScript and other web features enabled so most sites work out of the box. You raise the level manually when you want a smaller browser attack surface and accept that some pages may break.

Does Safer disable JavaScript on every site?

No. At Safer, JavaScript is disabled on non-HTTPS sites only. HTTPS sites still run JavaScript unless you move to Safest. That split reflects Tor Browser's attempt to block risky clearnet behavior while keeping many encrypted sites usable.

Why do images or fonts disappear at higher levels?

Safer disables some fonts and math symbols. Safest goes further and may disable some fonts, icons, math symbols, and images because those features pull in parsers and remote resources attackers have targeted. Static text-heavy pages survive; image galleries and icon fonts often do not.

Can I set a different security level for one website?

The Security Level slider is global — it applies to the whole browser after you save and restart. Tor Browser does not offer per-site security profiles in the way some extensions do. You can temporarily lower the level for a session, but that is a deliberate compromise for all open tabs, not a fine-grained rule for a single domain.

Do I need Safest for .onion sites?

Not automatically. Onion routing and security level solve different problems. A static onion page you trust might work fine at Safer; an unknown onion forum with heavy JavaScript might warrant Safest. Judge the page content and scripts, not the .onion suffix alone.