Onion Over VPN: What It Is and When to Use It

How Onion Over VPN works

When you connect to an Onion Over VPN server, your traffic first goes, encrypted, to a NordVPN server, like any VPN connection. NordVPN then hands it to the Tor network, where it passes three volunteer-run relays before it reaches the site (NordVPN’s help page).

Each stop sees a different part of the trip:

• Your internet provider sees an encrypted connection to NordVPN, not that you use Tor.
• NordVPN sees your real IP address and knows that your traffic goes on to Tor.
• The first Tor relay sees NordVPN’s address instead of yours.
• The site sees the address of a Tor exit relay. Without HTTPS, that exit relay can also read what you send. Onion sites have no exit relay at all, because the connection stays inside Tor.

What changes is the browser. Since the Tor part runs on NordVPN’s server, Chrome, Edge or Firefox can open .onion addresses, and NordVPN says that makes Tor Browser unnecessary (feature page). It isn’t limited to the browser either. While you’re connected, the whole device’s traffic goes through Tor.

NordVPN’s server list showed five Onion Over VPN servers on November 5, 2026: two in Amsterdam, two in Stockholm and one in Zurich. Which one you pick hardly matters to the sites you visit, since they see a Tor exit that can be in any country.

Proton VPN runs the same kind of server under the name Tor over VPN. Its Tor servers carry “-TOR” in the name, such as FR#13-TOR, sit in “many countries” and come with paid plans only (Proton’s help page). Proton also notes that Tor only carries TCP traffic, so UDP traffic and ping can’t go through it.

Onion Over VPN or Tor Browser?

The two sides openly disagree. NordVPN’s feature page says Onion Over VPN gives you more security and privacy than Tor Browser alone. The Tor Project says it strongly recommends against using Tor in any browser other than Tor Browser, because other browsers aren’t built with Tor’s privacy protections in mind.

Both have a point, about different ends of the connection. NordVPN is right that your provider never sees Tor and the first relay never sees your address. The Tor Project is right about the end that faces the site. Tor Browser is built so that its users look alike, and it clears cookies when you close it. Your everyday browser arrives with its own fingerprint, the cookies it has collected and whatever accounts you’re signed in to, so a site can recognise you whether you come over Tor or not.

Onion Over VPN is fine for opening a link someone sent you. For anything you wouldn’t want traced back to you, use Tor Browser. If you also want to hide Tor from your provider, a bridge does that for free, without a VPN company that knows your address. Our VPN vs Tor comparison covers the few cases where a VPN in front of Tor Browser helps.

How to use Onion Over VPN

In the NordVPN app

1. Switch the protocol to OpenVPN (TCP or UDP) in the settings. NordVPN says Onion Over VPN only shows up with OpenVPN, so you won’t find it while NordLynx is on.
2. On Windows, macOS, Android and iOS, open All locations. On Linux and Android TV, open Specialty servers.
3. Pick Onion Over VPN and wait until the app shows you’re connected.
4. Open your browser and enter the .onion address.

If Onion Over VPN is still missing on OpenVPN, NordVPN puts it down to instability or limited capacity on the Tor side and asks you to contact support (server categories).

Firefox refuses .onion addresses until you change one setting. NordVPN’s help page tells you to type about:config in the address bar, accept the warning, search for network.dns.blockDotOnion and set it to false (NordVPN). Set it back to true when you disconnect. Outside Tor, an onion address means nothing, and the internet standard for them says programs shouldn’t look it up on an ordinary DNS server (RFC 7686).

In the Proton VPN app

Proton’s Tor servers have an onion icon in the server list, in every app except the Linux command-line tool. Connect to one and open your browser. Proton’s guide adds two notes:

• On a Mac, iPhone or iPad, turn on Proton’s kill switch first. Proton says an issue on Apple systems stops onion sites from opening without it.
• On Android, the regular Firefox doesn’t open onion links, so Proton suggests Chrome, Brave or Edge. Firefox on a computer needs the setting change above.

Whichever app you use, open onion sites in a private window and stay logged out of anything with your name on it. Copy onion addresses from the organisation’s own website rather than typing them.

Onion Over VPN vs Double VPN, Obfuscated and P2P servers

NordVPN lists Onion Over VPN among its specialty servers, which is why people compare it with the others. Only one of them has anything to do with Tor.

• Double VPN sends your traffic through two NordVPN servers and encrypts it twice. You never leave NordVPN’s network, so it opens no onion sites. NordVPN says it’s slower and not meant for everyday use (server categories).
• Obfuscated servers hide the fact that you’re using a VPN, for networks and countries that block VPNs. Where a VPN won’t connect at all, try these, not Onion Over VPN.
• P2P servers are gone as a separate category. NordVPN says every standard server now handles P2P traffic, since app version 8.0.0 on Windows, 10.0.0 on macOS and 9.0.0 on iOS and Android (NordVPN).

So if you’re asking “Onion Over VPN or P2P?” because you want to torrent, the answer is neither: use a standard server. The Tor Project calls torrenting over Tor unsafe and not recommended, and it puts load and legal risk on the volunteers who run exit relays.

When Onion Over VPN makes sense, and when it doesn't

It’s a convenience. It fits when you want to open an onion link once, say a news outlet’s onion site or DuckDuckGo’s onion search, on a device where you’d rather not install Tor Browser, and you don’t mind that the site could recognise your browser.

Skip it for:

• Anything that has to stay anonymous, like contact with a source or an account nobody should link to you. Use Tor Browser, with a bridge if Tor is watched or blocked where you are.
• Streaming and big downloads. Tor is slow. In October 2026, a 5 MB download over Tor took a median of 4 to 11 seconds, depending on where the Tor Project measured, and onion sites took 11 to 23 seconds (Tor Metrics). The VPN step adds a little on top.
• Sites that block Tor. They still see a Tor exit address, so Onion Over VPN won’t get you past them.
• Torrents. A standard server is the place for them (chapter 4).
• Censorship. If VPNs or Tor are blocked where you are, NordVPN’s obfuscated servers or a Tor bridge are the tools to try. Our VPN vs Tor guide covers what still gets through.

Is Onion Over VPN safe and legal?

It’s as trustworthy as the company at the front. NordVPN sees your real IP address and the fact that you use Tor, so you rely on its promise not to keep logs. Deloitte last checked that promise between November 10 and December 12, 2025, and the check included the Onion Over VPN servers (NordVPN). Proton’s latest no-logs audit, its fifth by Securitum, covered 2026 (Proton). An audit checks the setup at one point in time. It can’t tell you what happens afterwards. Our NordVPN review and Proton VPN review cover the rest of each service.

The Tor part has the usual limits. The exit relay can read anything sent without HTTPS, and an onion site is only as honest as whoever runs it. Our Tor guide has the safety rules.

Onion Over VPN is legal wherever both VPNs and Tor are. Where either one is restricted, so is this, and anything illegal stays illegal over it. Our guide to whether VPNs are legal goes country by country, and the Tor guide covers Tor.