Setting Up Tor Browser Right: The Settings That Matter and the Ones That Do Not
The most common advice about Tor Browser is also the most confusing, because it treats a normal browser like a piece of hardware to be tuned. You do not need most of that. Tor Browser ships configured, and the configuration that matters is small. This guide covers the settings that genuinely change your exposure and the ones that mostly add friction.
The security level is the one that matters
The security setting, found in the menu, has four levels from Standard up to Safest. It controls how much scripting the browser allows, and scripting is where most of the risk lives, because a script on a page can do things the page itself cannot see you do.
Standard is the right starting point. It blocks the riskier scripts and keeps pages working. Safer blocks more and will break some market pages. Safest turns scripting off almost entirely, which is the most protective setting and the one that makes some markets look broken, because parts of their interface need scripts to render. The practical approach is to start on Standard, and if you are on a market that you trust and that needs scripts, you can leave it there. If you are browsing something you do not trust, raise it. The setting is per-session, so you can change it as you go.
Do not install extensions
This is the setting that is not a setting, and the one people get wrong most. Extensions are scripts, and a script running inside Tor Browser can undo the isolation it provides. A password manager extension can leak, a translator can phone home, an ad blocker can fingerprint. The browser is built to work without them, and the market's own tools cover what you need. If you find yourself wanting an extension, the answer is usually to use the market's built-in feature instead.
Use a separate identity for it
Tor Browser gives you a fresh identity each time you close it, which is part of the design. You do not need to do anything to get that, but you do need to stop undoing it. Logging into the same email, the same social account, or the same bank inside Tor connects your dark web activity to your normal one, which defeats the purpose. The clean habit is a separate identity for the browser, a separate email if you register for anything, and no personal logins inside it.
Update it, and only from the source
Tor Browser updates itself, and you should let it. An outdated browser is a browser with known gaps. The only rule is to get it, and its updates, from torproject.org. A browser that arrived through a search result or a third-party site is a browser you cannot be sure is the one you think it is, and that uncertainty is the whole problem the project exists to remove.
What you can skip
You do not need to change the relay selection, you do not need to run a bridge unless your network blocks Tor, and you do not need to touch the advanced network settings. Those are for specific situations, and fiddling with them without a reason usually trades a small theoretical gain for a real chance of breaking something. The default configuration is the configuration that has been tested by the most people, which is a reason to leave it alone unless you have a specific problem to solve.
Quick questions
Related guides
What to Do When a Darknet Order Goes Wrong: Disputes, Step by Step
An order did not arrive, arrived damaged, or the vendor has gone quiet. Here is the exact sequence for opening a dispute and the timing rules that decide whether you win it.
How to Spot a Fake Darknet Market Mirror Before You Lose Anything
A fake mirror is a pixel-perfect copy of a real market, waiting for your password. Here is the exact sequence of checks that catches it, and the one detail that gives a copy away.
How to Choose a Darknet Market: The Criteria That Actually Matter
There is no single best market, there is only the best fit for what you are buying and how much you care about each tradeoff. Here is the framework for making that call.