# How secure is Tor in safest mode?

**URL:** https://discuss.privacyguides.net/t/how-secure-is-tor-in-safest-mode/40681
**Category:** Questions
**Created:** 2026-09-13T00:02:59Z
**Posts:** 18

## Post 1 by @blibly — 2026-09-13T00:02:59Z

Tor is usually said to be the least secure of the mainstream browsers, but is that still true if all JavaScript is disabled?

---

## Post 2 by @whatdoiputhere — 2026-09-13T02:01:43Z

it is? i didnt know

---

## Post 3 by @not-wittingly — 2026-09-13T02:16:59Z

Why least secure? That doesn’t make sense to me at all. Where did you find this info.

---

## Post 4 by @blibly — 2026-09-13T02:57:46Z

> [@How is monoculture only a problem with Tor-like browsers?](https://discuss.privacyguides.net/t/how-is-monoculture-only-a-problem-with-tor-like-browsers/40534/13):
>
> Tor Browser is probably the worst of the “main stream browsers” you could be running for security. If it didn’t have its strong fingerprinting protections, it would not be worth using at all.

From the GrapheneOS usage guide:

> At the moment, the only browser with any semblance of privacy is the Tor Browser but there are many ways to bypass the anti-fingerprinting and state partitioning. The Tor Browser’s security is weak which makes the privacy protection weak. The need to avoid diversity (fingerprinting) creates a monoculture for the most interesting targets. This needs to change, especially since Tor itself makes people into much more of a target (both locally and by the exit nodes).

---

## Post 5 by @not-wittingly — 2026-09-13T04:18:03Z

Damn GrapheneOS team, I definitely do trust them when it comes to security I must say.

I just can’t comprehend how Tor browser could possibly be more insecure than Firefox, Mullvad, Librewolf, Zen etc.

Sure I understand Gecko is less secure than Chromium, but is Tor less secure than other browsers based on reasons outside of purely not being Chromium-based?

---

## Post 6 by @blibly — 2026-09-13T04:26:07Z

> [@How is monoculture only a problem with Tor-like browsers?](https://discuss.privacyguides.net/t/how-is-monoculture-only-a-problem-with-tor-like-browsers/40534/15):
>
> Disclaimer: This is not meant to attack the Tor Browser devs, since they are in a pretty unique situation which forces their hand for many of these regressions. The biggest regression is using ESR and all the baggage that comes with it. Partial security backports, fewer eyes for security issues and missing the churn that regular releases get. I’d argue the new code being added is better, largely thanks to the AI usage Mozilla has integrated. Because of fingerprinting concerns, there’s no conte…

---

## Post 7 by @not-wittingly — 2026-09-13T10:58:10Z

That was an interesting read. Idk why I had just assumed Tor came with uBO. That’s wild that it doesn’t.

How much less secure is ESR than regular FF?

I will say the changing the security level as a rigid thing and only having three toggles does make sense from an anti-fingerprinting perspective.

The user any1 has Librewolf next to their name, are they a LW dev?

---

## Post 8 by @JaneDoe — 2026-09-13T12:49:21Z

> [@blibly](#):
>
> there are many ways to bypass the anti-fingerprinting

I noticed tor browser did nothing about font fingerprinting, which I think is quite stable and unique. For example:

> **[Font Fingerprinting](https://browserleaks.com/fonts)**
>
> Font metrics-based fingerprinting. System fonts enumeration. Font fingerprinting techniques are based on measuring the dimensions of text or individual Unicode glyphs, enumerating fonts and finding rendering differences. This method can create a...

---

## Post 9 by @user1 — 2026-09-13T13:25:22Z

> **[The Design and Implementation of the Tor Browser [DRAFT]](https://2019.www.torproject.org/projects/torbrowser/design/#fingerprinting-linkability:~:text=Fonts,-According)**

Do not use fingerprint test sites.

---

## Post 10 by @JaneDoe — 2026-09-13T14:07:52Z

I think you should use Tor browser in a microvm, so you can control what fonts are there, and also make it more secure

---

## Post 11 by @user1 — 2026-09-13T14:10:04Z

That will be a really small bucket.

---

## Post 12 by @whatdoiputhere — 2026-09-13T16:53:49Z

why shouldnt you use fingerprint test sites (except for amiunique i think thats not a good site)

if you shouldnt use them what other things should you do to test if youre safe?

---

## Post 13 by @user1 — 2026-09-13T17:01:35Z

> **[DRAFT: Browser Fingerprinting](https://arkenfox.github.io/thorin/items/02browserfingerprinting.html#part4:~:text=Test%20Sites,-To)**

Fingerprinting is a complicate thing, don’t try too hard, it will backfire.

---

## Post 14 by @JaneDoe — 2026-09-13T17:12:18Z

I read its code so I fully understand how that font fingerprinting works and how that web page works. But I get you, privacy is very complex and these detection sites may not truly reflect privacy, and they may collect data.

> **Font fingerprinting**
>
> ```
> function fontsList() {
> return [
> "mono",
> "system-ui",
> "-apple-system",
> "BlinkMacSystemFont",
> "MS Shell Dlg",
> "MS Shell Dlg \\32",
> "aakar",
> "Abadi MT Condensed",
> "Abadi MT Condensed Light",
> "ABeeZee",
> "Abel",
> "Abhaya Libre",
> "Abril Fatface",
> "Abyssinica SIL",
> "Academy Engraved LET",
> "AcadEref",
> "Aclonica",
> "Acme",
> "Actor",
> ...
> "Zhi Mang Xing",
> "Zilla Slab",
> "Zilla Slab Highlight",
> "Zurich BlkEx BT",
> "Zurich Ex BT",
> "ZWAdobeF",
> "מרים",
> "মিত্র",
> "মুক্তি",
> "মুক্তি পাতনা",
> "गार्गी",
> "नालिमाटी",
> "অনি Dvf",
> "宋体",
> "微软雅黑",
> "游ゴシック",
> "細明體",
> "細明體_HKSCS",
> "新細明體",
> "굴림",
> "굴림체",
> "바탕",
> "ＭＳ ゴシック",
> "ＭＳ 明朝",
> "ＭＳ Ｐゴシック",
> "ＭＳ Ｐ明朝",
> ];
> }
> !(function () {
> var d = _el("#fonts-metrics-hash"),
> C = ((d.className = "load-td"), _el("#fonts-glyphs-hash")),
> y =
> ((C.className = "load-td"),
> ["default", "sans-serif", "serif", "monospace", "cursive", "fantasy"]);
> function L(t, e) {
> return (69069 * t + e) % 4294967296;
> }
> function u(t, e) {
> return ((t.style.fontFamily = e), t.offsetWidth + "," + t.offsetHeight);
> }
> function x() {
> for (
> var t,
> e = fontsList(),
> n = e.length,
> o = _el("#fonts-metrics-testbox"),
> s = document.createElement("span"),
> r =
> ((s.style.fontSize = "128px"),
> (s.innerHTML =
> "mmmMMMmmmlllmmmLLL₹▁₺₸ẞॿmmmiiimmmIIImmmwwwmmmWWW"),
> o.appendChild(s),
> {}),
> i = u(s, "br0k3nd3f4u17"),
> a = 0,
> l = 0;
> l < y.length;
> l++
> )
> (r[(t = u(s, y[l]))] || (r[t] = ""),
> "" != r[t] && (r[t] += ", "),
> (r[t] += y[l]),
> a++);
> for (l = 0; l < n; l++)
> (t = u(s, e[l])) !== i &&
> (r[t] || (r[t] = ""),
> "" != r[t] && (r[t] += ", "),
> (r[t] += e[l]),
> a++);
> var m,
> f = 0,
> c = "";
> for (t in r)
> (0 < f && (c += "\n"),
> f++,
> (c +=
> t +
> ((m = t),
> "\t".repeat(Math.max(0, Math.ceil((8 - m.length) / 4)) + 1)) +
> r[t]));
> ((o = _el("#fonts-metrics-output")),
> o.closest("tr").classList.remove("n"),
> (o.textContent = c),
> (o = _el("#fonts-metrics-report")));
> (o.closest("tr").classList.remove("n"),
> (o.innerHTML = a + " fonts and " + f + " unique metrics found"),
> (d.className = "wball mono upper"),
> (d.innerHTML = ico(1) + md5(c)));
> }
> setTimeout(function () {
> for (
> var t,
> e,
> n,
> o,
> s = document.createElement("div"),
> r =
> ((s.id = "fonts-glyphs-testbox"),
> document.body.appendChild(s),
> [
> 8377, 9601, 8378, 42813, 65533, 8376, 1478, 7838, 2431, 61443, 7386,
> 6109, 9134, 3330, 2946, 4442, 9253, 12334, 43056, 11014, 8676, 8381,
> 11387, 8368, 64494, 63504, 65535, 127, 4256, 120720, 1792, 6480,
> 12437, 21293, 1564, 8419, 65529, 536, 1423, 2276, 2483, 7248, 9753,
> ]),
> i = {},
> a = {},
> l = 0,
> m = [],
> f = 0;
> f < y.length;
> f++
> )
> ((t = y[f]),
> (n = document.createElement("div")),
> (e = document.createElement("span")),
> (n.id = "div_" + t),
> (e.id = "span_" + t),
> "default" !== t && (e.style.fontFamily = t),
> (e.textContent = "A"),
> s.appendChild(n),
> n.appendChild(e),
> (i[t] = n),
> (a[t] = e));
> for (f = 0; f < r.length; f++) {
> for (
> var c = r[f],
> d =
> (o = c) <= 65535
> ? String.fromCharCode(c)
> : ((o -= 65536),
> String.fromCharCode(55296 + (o >> 10), 56320 + (o % 1024))),
> u = [
> (function () {
> for (var t = c.toString(16).toUpperCase(); t.length < 4;)
> t = "0" + t;
> return "U+" + t;
> })(),
> ],
> h = 0;
> h < y.length;
> h++
> ) {
> ((n = i[(t = y[h])]), ((e = a[t]).textContent = d));
> var p = e.offsetWidth,
> g = n.offsetHeight,
> p = ((l = L(l, p)), (l = L(l, g)), p + "," + g);
> (p.length < 4 && (p += "\t"), p.length < 8 && (p += "\t"), u.push(p));
> }
> m.push(u.join("\t"));
> }
> for (h = 0; h < y.length; h++) (e = a[(t = y[h])]).textContent = "";
> var v = ("00000000" + l.toString(16)).slice(-8),
> v =
> ((C.className = "wball mono upper"),
> (C.innerHTML = ico(1) + v),
> _el("#fonts-glyphs-output"));
> (v.closest("tr").classList.remove("n"),
> (v.textContent =
> "glyph\tdefault\t\tsans-serif\tserif\t\tmonospace\tcursive\t\tfantasy\n\n" +
> m.join("\n")),
> setTimeout(x, 10));
> }, 10);
> })();
> ```

---

## Post 15 by @any1 — 2026-09-13T17:32:56Z

> [@not-wittingly](#):
>
> The user any1 has Librewolf next to their name, are they a LW dev?

Yes [https://discuss.privacyguides.net/g/developers#:~:text=any1-,Librewolf,-Primary](https://discuss.privacyguides.net/g/developers#:~:text=any1-,Librewolf,-Primary)

> [@not-wittingly](#):
>
> How much less secure is ESR than regular FF?

You can’t really quantify how much exactly, but it is enough of a regression to take note of.

---

## Post 16 by @any1 — 2026-09-13T17:34:43Z

> [@JaneDoe](#):
>
> I noticed tor browser did nothing about font fingerprinting, which I think is quite stable and unique.

> [@JaneDoe](#):
>
> I think you should use Tor browser in a microvm, so you can control what fonts are there, and also make it more secure

> [@user1](#):
>
> That will be a really small bucket.

Tor Browser ships its own fonts that get used.

---

## Post 17 by @JaneDoe — 2026-09-13T17:41:42Z

I tested years ago. Good to know it does now.

---

## Post 18 by @sha123 — 2026-09-14T09:46:17Z

I wouldn’t worry about security of Tor Browser in `Safest` mode on desktop, if you don’t need to make exceptions. If you need to make exceptions, it depends.