Decoding Tor Browser's Security Levels: A Threat-Model Approach to the Settings Most Users Get Wrong

When the Tor Project redesigned its browser's security controls into a simplified three-position slider, the intent was accessibility. The result, however, has been a widespread misunderstanding of what those positions actually do. Walk into any privacy-focused forum and you will find users who believe they are adequately protected simply because they opened Tor Browser — without ever touching the security settings. That assumption carries real consequences.

This article provides a systematic, technically grounded breakdown of Tor Browser's Standard, Safer, and Safest configurations. More importantly, it frames each level against concrete threat models, because the right setting is never universal — it depends entirely on who might be watching and what they are trying to learn.

What the Slider Is Actually Controlling

Before examining individual levels, it is worth understanding the underlying mechanism. The security slider does not adjust Tor's routing behavior — your traffic still traverses three relays regardless of where the slider sits. What it controls is the browser's attack surface: specifically, which web technologies are permitted to execute in the context of a page you visit.

Modern browsers are extraordinarily capable runtime environments. JavaScript engines, WebAssembly interpreters, WebGL renderers, and font-loading APIs can all be exploited — either by malicious sites or by adversaries who have compromised a site you trust — to extract information about your system or, in serious cases, to deanonymize your session entirely. The slider is a coarse but effective tool for limiting that exposure.

Standard: The Default That Leaves More Open Than Users Realize

At the Standard level, Tor Browser operates similarly to Firefox with a privacy overlay. JavaScript runs freely, all media types are permitted, and most browser APIs remain accessible. The Tor Project's own documentation notes that "all browser features are enabled" at this level.

For casual browsing of mainstream websites — reading news, accessing legal resources, or using services that require JavaScript-heavy interfaces — Standard is functional. But its threat-model coverage is narrow. A site served over HTTP (not HTTPS) can inject JavaScript that attempts to fingerprint your browser, probe your local network, or exploit a known vulnerability in the JavaScript engine. Even HTTPS sites can embed third-party scripts from advertisers or analytics providers that perform similar reconnaissance.

The critical point: Standard protects your IP address (via Tor's routing) but does relatively little to protect your browser's identity or your system's integrity. If your threat model extends beyond simple IP concealment — if you are concerned about fingerprinting, exploit delivery, or behavioral tracking — Standard is almost certainly insufficient.

Safer: The Meaningful Middle Ground

Moving the slider to Safer introduces a more substantial set of restrictions. JavaScript is disabled on sites served over HTTP, significantly reducing the attack surface on unencrypted connections. Additionally, some JavaScript performance optimizations are disabled on all sites, which limits certain timing-based fingerprinting techniques. HTML5 video and audio playback via JavaScript is also restricted.

This level represents a meaningful improvement for most users whose threat models fall into the middle range — people concerned about commercial surveillance, data brokers, or opportunistic tracking rather than targeted nation-state attacks. The HTTP JavaScript restriction alone eliminates a large class of passive fingerprinting scripts that operate on non-HTTPS pages.

However, Safer still permits JavaScript on HTTPS sites. This is a deliberate usability compromise, but it means that a sophisticated adversary who controls or has compromised an HTTPS endpoint can still deliver malicious scripts. For journalists communicating with sources through SecureDrop, or activists operating in jurisdictions with active monitoring infrastructure, this residual exposure may not be acceptable.

Testing conducted by independent researchers using tools such as Cover Your Tracks (formerly Panopticlick) consistently shows that even at the Safer level, certain browser characteristics — screen resolution, installed fonts where accessible, and timezone data — can contribute to a partial fingerprint. Safer reduces the signal; it does not eliminate it.

Safest: What You Gain, and What You Sacrifice

At the Safest level, JavaScript is disabled globally across all sites, regardless of protocol. SVG images, certain fonts, and other dynamic rendering features are also restricted. The browser becomes, in practical terms, a document viewer with hyperlinks — capable of rendering static HTML and CSS, but stripped of the execution environment that makes modern web applications possible.

The security gains are substantial. Without JavaScript, the overwhelming majority of browser-based exploit chains become inoperative. Drive-by download attacks, WebAssembly exploits, and canvas-fingerprinting scripts all require script execution. Disabling JavaScript categorically removes that entire attack category from the equation.

For users facing sophisticated, targeted threats — investigative journalists, human rights workers in countries with advanced surveillance capabilities, or individuals subject to legal proceedings involving digital evidence — Safest is the technically defensible choice. The Tor Project itself recommends this level for users with "the highest security needs."

The cost is real, though. A substantial portion of the modern web is non-functional without JavaScript. Many US-based services — banking portals, government websites, news platforms — will either break entirely or degrade to unusable states. This is not a flaw in Tor Browser; it is an accurate reflection of how dependent the web has become on client-side scripting. Users operating at Safest should expect to maintain a separate, non-Tor browser for ordinary tasks and reserve Tor Browser for activities where anonymity is paramount.

Matching Settings to Threat Models

The practical question is not which level is "best" in the abstract — it is which level corresponds to your actual threat model.

If your primary concern is avoiding commercial data collection and IP-based tracking, Safer provides a reasonable balance. The HTTP JavaScript restriction addresses the most common passive fingerprinting vectors, and the usability impact is manageable on HTTPS-dominant sites.

If your concern involves an adversary with the capability and motivation to target you specifically — a government agency, a sophisticated criminal organization, or a well-resourced private entity — Safest is the appropriate starting point, supplemented by additional operational security measures that no browser setting can substitute for.

If you are using Tor Browser primarily to access .onion services rather than the clearnet, the calculus shifts somewhat. Onion services eliminate the exit node as an attack vector, but a malicious or compromised onion service can still deliver exploit payloads through the browser. The security slider remains relevant.

A Note on Testing Methodology

Users who want to audit their own configuration can use several publicly available tools. The Electronic Frontier Foundation's Cover Your Tracks service provides a fingerprint uniqueness assessment that responds to slider changes in observable ways. BrowserLeaks.com offers granular tests for specific APIs — WebGL, Canvas, AudioContext — that correspond directly to restrictions imposed at each security level. Running these tests sequentially across all three slider positions provides concrete, personalized evidence of what each configuration exposes.

One important caveat: these tools measure what is technically detectable, not what is being actively collected. A site may be capable of fingerprinting your browser without doing so. Threat modeling requires thinking about adversary capability and motivation together.

The Practical Recommendation

For most OpenTor readers who are serious about anonymous browsing rather than casual privacy, the default Standard configuration represents a miscalibration. Safer should be the baseline for routine Tor use, with Safest reserved for the sessions that genuinely require it.

The slider is not a comprehensive security solution — it is one layer in a broader operational security posture. But it is a layer that too many users leave at its weakest setting, often without realizing what that choice actually means.