2.5 How Exit Relays Actually Work

In the Tor network, the Exit Relay (sometimes simply called an “exit node”) is the final hop in a Tor circuit when a user accesses the normal internet (the “clearnet”).
Exit relays play a unique role because they are the only Tor nodes that interact directly with external websites.

This chapter explains, in depth, how exit relays function, what they can and cannot see, how traffic flows through them, and why they are essential despite being a common source of misunderstanding.

A. What Is an Exit Relay?

An exit relay is the Tor relay responsible for:

removing the final layer of onion encryption
forwarding the decrypted request to the clearnet destination
receiving the response from the clearnet and re-encrypting it for the user

It is the only point in a Tor circuit where Tor traffic becomes ordinary internet traffic.

Exit relays do not know who the user is; they only see:

the destination site
plaintext data if the site does not use HTTPS

Even then, they only see the content, not the user’s identity.

B. Position of the Exit Relay in the Tor Circuit

A Tor circuit consists of:

Entry Guard (first hop)
Middle Relay (second hop)
Exit Relay (third hop)

Data flow (simplified):

User → Entry Guard → Middle Relay → Exit Relay → Destination Website

The exit relay only sees decrypted outgoing traffic and the destination server.
It cannot see:

user IP
user identity
user location
user’s entry guard

This separation of knowledge is fundamental to Tor’s anonymity design.

C. What the Exit Relay Can See

Exit relays have visibility over exactly two things:

1. The Final Unencrypted Layer of Data

If a user visits:

HTTP websites → exit relay can read content
HTTPS websites → content is fully encrypted; exit relay sees nothing meaningful

Since most modern websites use HTTPS, exit relays cannot read the majority of traffic.

2. The Destination IP and Port

Exit relays must know where to forward the traffic.
They see:

Destination server IP Requested port (e.g., port 80 for HTTP)

Nothing else.

D. What Exit Relays Cannot See

Despite popular myths, exit relays cannot:

See the user’s IP address
That information is hidden by the guard relay.
Know the user’s identity
All Tor traffic is layered and encrypted.
Decrypt HTTPS traffic
HTTPS encryption terminates at the destination server, not the exit node.
See internal Tor circuits
Each hop removes only one encryption layer.
Determine where the user is located
IP geolocation is impossible from the exit’s perspective.
Trace the user back through the Tor network
No single relay has enough information.

E. Why Exit Relays Exist

Many darknet systems (I2P, Freenet) do not allow clearnet access.
Tor intentionally supports clearnet access to create a practical anonymity system for:

researchers
journalists
everyday users seeking privacy
citizens in censored environments

Exit relays act as translation bridges between:

anonymous Tor circuits
the normal, public internet

Without exit relays, Tor would be an internal-only network like I2P.

F. Exit Relay Policies & Restrictions

Exit relays operate under specific rules:

1. Exit Policies

Relay operators specify which ports/services they allow.
For example:

allow ports 80 and 443
deny SMTP ports to prevent spam
deny risky ports to reduce abuse

These policies shape how traffic routes through the network.

2. Abuse Management

Exit operators often receive:

DMCA notices
abuse complaints
legal inquiries

However, Tor Project provides guides explaining that operators cannot identify users.

Exit operators are not responsible for user actions, as they do not know who the user is.

G. Exit Relays & HTTPS: A Critical Distinction

If the site uses HTTPS:

exit relay sees only encrypted TLS packets
cannot read or manipulate content
cannot insert malware
cannot observe personal data

If the site uses HTTP:

exit relay can see content
but still cannot see the user’s identity

Modern browsers enforce HTTPS with:

HSTS
automatic HTTPS upgrades
certificate pinning

This greatly reduces exit relay visibility.

H. Exit Traffic Fingerprinting & Academic Findings

Exit relay behavior has been studied extensively in academia.

Key findings include:

1. Exit Relays Are Often Underpowered

Volunteer-run nodes have limited bandwidth.

2. Exit Relays Are Bottlenecks

Clearnet-bound traffic flows through relatively few relays compared to entry or middle nodes.

3. Malicious Exit Relays Are Rare but Possible

Some research uncovered misconfigured or malicious exits attempting:

TLS downgrades
traffic injection
DNS tampering

Tor mitigates these using:

Relay operator vetting
Exit scanning (Tor “exitmap” research)
Community reporting
Consensus weighting

No single malicious exit can deanonymize a user due to Tor’s architecture.

I. Why Exit Relays Cannot De-Anonymize Tor Users Alone

To deanonymize a user, an adversary must control:

The entry guard (to see user IP)
The exit relay (to see destination)

Controlling both simultaneously is difficult due to:

guard rotation policies
consensus mechanisms
diverse volunteer relay operators
large network size

A malicious exit alone is insufficient for deanonymization.

J. Exit Relays for .onion Services

When a user accesses a .onion service:

exit relays are not used at all
the entire circuit remains internal to Tor
both sides use rendezvous points
traffic never touches the clearnet

This increases anonymity and security.