When people first learn about Tor, terms such as Bridge, Guard relay, Middle relay, and Exit relay can sound like different “levels” of the same system.
That interpretation is only partly correct.
These terms actually describe different roles within Tor’s network architecture. Some roles are closely related, while others exist for completely different purposes.
Understanding the distinction makes the Tor network much easier to visualize.
Tor Is a Network of Relays
Tor does not normally connect a user directly to a website.
Instead, traffic passes through several independently operated Tor relays.
A simplified Tor circuit looks like this:
User
│
▼
Guard Relay
│
▼
Middle Relay
│
▼
Exit Relay
│
▼
Internet Destination
Each relay knows only part of the communication path.
This separation is fundamental to Tor’s privacy model.
The Guard knows where the connection came from, but normally does not know its final destination.
The Exit knows the final destination, but normally does not know the original user’s IP address.
The Middle connects the two without normally knowing either endpoint.
This is why Tor is often described as using layered routing.
1. What Is a Guard Relay?
A Guard relay, sometimes called an Entry Guard, is the first public Tor relay in a user’s circuit.
The basic path is:
User
│
▼
Guard
│
▼
Middle
│
▼
Exit
The Guard is therefore the Tor relay closest to the user.
Because the user connects directly to it, the Guard can normally observe the user’s source IP address.
However, it cannot normally see the final website being accessed.
Conceptually, its knowledge looks like this:
Guard knows:
User IP
│
▼
Guard
│
▼
another Tor relay
It does not see:
User IP
+
final website
as one complete path.
Why Does Tor Use Guards?
One might imagine that choosing a completely random first relay every time would provide better anonymity.
In practice, it creates another problem.
Suppose a small percentage of Tor relays are controlled by an attacker.
If users continually select random entry relays, eventually they may connect through a malicious one.
The more circuits they create, the more chances an attacker gets.
Tor therefore prefers to keep a relatively small set of trusted entry relays for longer periods.
These are called Guards.
The basic idea is:
Constantly changing entry relay
↓
many opportunities to eventually encounter a malicious relay
Stable Guard selection
↓
fewer entry relays exposed to the user
This reduces certain traffic-correlation risks.
2. What Is a Middle Relay?
A Middle relay carries traffic between other Tor relays.
In a typical circuit:
User
│
Guard
│
Middle
│
Exit
│
Internet
the Middle does not directly communicate with either the user or the destination website.
Instead, it sees something more like:
Tor Relay A
│
▼
Middle
│
▼
Tor Relay B
From the Middle relay’s perspective, both sides are usually simply other Tor nodes.
This makes the Middle role particularly interesting from an operational perspective.
A Middle relay does not normally generate traffic directly toward websites, email servers, or other Internet services.
As a result, it generally produces far fewer abuse complaints than an Exit relay.
For volunteer operators, this is one reason a non-exit relay is often the most straightforward way to contribute bandwidth to Tor.
3. Is a Guard a “Higher-Level Middle Relay”?
In a limited sense, there is a relationship.
But calling Guard and Middle different “levels” is misleading.
A new public non-exit relay usually begins life primarily as a general relay and may initially be used in the Middle position.
If it remains:
- stable,
- reachable,
- sufficiently fast,
- consistently online,
the Tor directory authorities may eventually mark it as suitable for Guard usage.
Conceptually:
New public relay
│
▼
Primarily usable as Middle
│
▼
Long-term stability
Good uptime
Adequate bandwidth
│
▼
May receive Guard eligibility
The operator does not simply declare:
"This server is now a Guard."
The Tor network evaluates relay characteristics and assigns flags accordingly.
Therefore:
Middle and Guard are roles within the public Tor relay system.
A relay may become eligible for the Guard role after demonstrating sufficient reliability.
4. What Is an Exit Relay?
The Exit relay is the final Tor relay before traffic reaches the ordinary Internet.
Its position is:
User
│
Guard
│
Middle
│
Exit
│
▼
Website
From the destination website’s perspective, the connection appears to originate from the Exit relay.
For example:
User real IP:
203.0.113.10
Exit IP:
198.51.100.25
Website sees:
198.51.100.25
The website does not normally see the user’s real IP.
This makes the Exit one of the most important components of Tor—but also the most operationally sensitive.
Why Exit Relays Receive Abuse Complaints
Consider a Tor user connecting to an ordinary website:
User
↓
Guard
↓
Middle
↓
Exit
↓
Website
The website sees only:
Exit → Website
If someone abuses the service, the resulting logs may therefore contain the Exit relay’s IP address.
Consequently, complaints may initially be sent to:
- the Exit operator,
- its hosting provider,
- its ISP,
- or the organization owning the IP range.
This does not mean the Exit operator performed the activity.
It simply means that the Exit was the last visible network hop.
That distinction is one of the most important concepts in understanding Tor infrastructure.
5. What Is a Bridge?
A Bridge is fundamentally different from Guard, Middle, and Exit.
Its primary purpose is not to occupy a particular numbered position in an ordinary Tor circuit.
Instead, a Bridge exists to help users connect to Tor when normal Tor relays are blocked.
The Problem With Public Relays
Normal Tor relays are publicly listed.
Tor clients need to discover them somehow, so information about public relays is distributed through Tor’s directory system.
That means a censor can also obtain those addresses.
A simple blocking strategy could therefore be:
Download Tor relay list
│
▼
Collect public relay IP addresses
│
▼
Block all of them
In such an environment, ordinary Tor connections may stop working.
6. Bridges Exist to Make Blocking Harder
A Bridge is an entry relay whose address is not published in the normal public relay directory.
Instead of:
Public Tor relay
│
▼
IP visible in public relay directory
a Bridge works more like:
Bridge
│
▼
address distributed through restricted mechanisms
This makes mass blocking more difficult.
Bridges are therefore mainly a censorship-resistance mechanism.
They are especially useful in networks where direct connections to known Tor infrastructure are filtered.
7. Bridge and Guard May Look Similar, But Their Purpose Is Different
Both Bridges and Guards can appear close to the beginning of a Tor connection.
For that reason, they are easy to confuse.
An ordinary Tor connection might look like:
User
│
▼
Guard
│
▼
Middle
│
▼
Exit
A connection using a Bridge might look approximately like:
User
│
▼
Bridge
│
▼
Tor Network
│
▼
Exit
But their purposes are different.
A Guard exists mainly to provide a stable and secure first hop within the normal public Tor network.
A Bridge exists mainly so that users can reach Tor even when public relay addresses are blocked.
This distinction is crucial.
8. So Are Bridge, Guard, and Middle Different Levels?
No.
A better classification is:
Tor Infrastructure
│
├── Public Relays
│ │
│ ├── Guard
│ │ └── entry role
│ │
│ ├── Middle
│ │ └── internal forwarding role
│ │
│ └── Exit
│ └── connection to ordinary Internet
│
└── Bridges
└── non-public entry infrastructure
This model is much more accurate than imagining:
Bridge
↓
Middle
↓
Guard
↓
Exit
as if they were ranks or upgrade levels.
They are not.
9. One Machine Can Have Different Roles Over Time
Another source of confusion is that Tor relay roles are not necessarily permanently fixed.
A public non-exit relay might initially function mostly as a Middle.
After demonstrating sufficient stability and bandwidth, it may later qualify as a Guard.
Therefore:
Physical server
│
▼
Tor relay identity
│
├── initially used as Middle
│
└── later possibly eligible as Guard
The machine itself has not necessarily changed.
Its role within the Tor network has.
This is why Guard and Middle should often be thought of as selection roles assigned to public relays, rather than entirely different classes of hardware.
10. Exit Is Different Again
Exit capability is more deliberate.
A Tor operator must explicitly permit certain outbound destinations and ports through an Exit Policy.
A non-exit relay effectively says:
Relay Tor traffic
but do not send it onto the ordinary Internet
An Exit relay says:
Relay Tor traffic
and allow selected traffic to leave Tor
This distinction has major operational consequences.
A Middle or Guard usually communicates primarily with other Tor relays.
An Exit communicates directly with arbitrary Internet services.
That is why Exit operation generally involves significantly more administrative, legal, and abuse-management considerations.
11. What Does Each Relay Know?
A simplified view helps illustrate Tor’s compartmentalization.
Guard
The Guard can generally know:
User IP
+
next Tor relay
but not the final Internet destination.
Middle
The Middle generally knows:
previous Tor relay
+
next Tor relay
but not the original user and final destination together.
Exit
The Exit generally knows:
previous Tor relay
+
destination server
but not the original user’s IP address.
Destination Website
The destination generally knows:
Exit IP
but not the original user’s network address.
That separation is central to onion routing.
12. Where Does a Bridge Fit Into This Privacy Model?
A Bridge does not replace the entire Tor circuit.
It primarily changes how the user enters the Tor network.
Conceptually:
Normal connection:
User
↓
Public Guard
↓
Tor Network
Bridge connection:
User
↓
Non-public Bridge
↓
Tor Network
The remainder of Tor’s layered routing architecture still applies.
The key advantage is that the user’s ISP or local network cannot simply compare the destination IP against the ordinary public Tor relay list.
Modern Bridge systems can also use pluggable transports designed to make Tor traffic harder to identify through traffic inspection.
13. Why Bridges Are Not Completely Secret
“Not publicly listed” does not mean “impossible to discover.”
If Bridge addresses were completely inaccessible, legitimate users would not be able to obtain them either.
Tor therefore distributes Bridge information through controlled channels.
This creates a continual contest:
Tor:
make bridges available to real users
without publishing everything openly
Censors:
attempt to discover and block bridges
This is why Bridge architecture is a specialized area of censorship resistance.
14. Relay Role vs. Physical Server
Another useful distinction is between a relay identity and a physical machine.
When statistics say that a country has a certain number of Tor relays, that does not necessarily mean the same number of separate servers.
For example:
One physical server
│
├── Relay identity A
├── Relay identity B
└── Relay identity C
Multiple Tor relay instances can sometimes exist on one host or public IP.
Conversely, one operator may run relays across many machines, networks, or countries.
Therefore Tor statistics should be interpreted carefully.
15. A Practical Operator’s Perspective
From the viewpoint of someone contributing infrastructure to Tor, the roles also differ significantly.
Bridge
Primary purpose:
Help users reach Tor when public relays are blocked.
Advantages:
- not listed in the normal public relay directory,
- useful against censorship,
- generally low abuse exposure.
Middle Relay
Primary purpose:
Provide bandwidth inside the Tor network.
Advantages:
- relatively simple operation,
- little direct interaction with destination websites,
- low abuse complaint exposure,
- useful contribution even without Exit operation.
Guard Relay
Primary purpose:
Provide trusted, stable entry capacity.
Characteristics:
- publicly listed,
- requires strong uptime and reliability,
- usually becomes Guard-eligible based on network evaluation.
Exit Relay
Primary purpose:
Connect Tor users to the ordinary Internet.
Characteristics:
- extremely important to the network,
- destination services see its IP,
- highest abuse-management burden,
- requires careful operational planning.
16. The Simplest Mental Model
The entire distinction can be reduced to four sentences:
Bridge:
“Help users get into Tor when Tor is blocked.”
Guard:
“Be the stable first public relay in a Tor circuit.”
Middle:
“Move encrypted traffic between Tor relays.”
Exit:
“Take Tor traffic out to the normal Internet.”
Or visually:
┌───────────────┐
│ Public Guard │
└───────┬───────┘
│
User ────────────────────────────┤
▼
Middle Relay
│
▼
Exit Relay
│
▼
Internet
Alternative censored-network entry:
User
│
▼
Bridge
│
▼
Tor Network
│
▼
Exit
│
▼
Internet
Conclusion
Bridge, Guard, Middle, and Exit are not four ranks of Tor relay.
They represent different functions.
Guard, Middle, and Exit describe positions or capabilities inside the public Tor relay architecture.
Bridge describes a special non-public entry mechanism designed primarily to resist censorship.
Among public relays, a new non-exit relay may initially function mainly as a Middle and later become Guard-eligible after demonstrating sufficient stability.
Exit operation is different because it allows traffic to leave Tor and reach the ordinary Internet directly.
The resulting architecture can therefore be summarized as:
Public Tor Network
│
├── Guard
├── Middle
└── Exit
Censorship-resistant entry
│
└── Bridge
Once this distinction is understood, much of Tor’s architecture becomes easier to reason about.
Tor is not built around a hierarchy of “higher” and “lower” relays.
It is built around specialization, separation of knowledge, and distribution of trust.