Two layers, one question: which goes first?
People stack a VPN and Tor in both orders and defend both on forums. The difference is real and small, and it comes down to who can see that you are using Tor, and how many hops your mirror has to pass through.
| Order | Your network sees | The mirror sees | Trade-off |
|---|---|---|---|
| Tor only | A connection to a Tor entry node | A Tor exit node | The standard setup. Fastest, and what most of the market runs on. |
| VPN first, then Tor | A connection to a VPN server | A Tor exit node | Hides Tor use from your network. Adds one layer between you and the entry node, which is fine. |
| Tor first, then VPN | A connection to a Tor entry node | A VPN server | Your exit traffic detours through the VPN. More hops, more distance, and mirrors get slower for no anonymity you actually need. |
Do you need a VPN at all?
On a home connection, usually no. Tor already keeps your destination from your network; what your network can see is that you are talking to Tor, which is the price of using it and not something a VPN removes from the mirror’s side. Add a VPN when your network itself is hostile: an office or campus Wi-Fi that blocks or throttles Tor, a public network you would rather not reveal Tor to. In those cases the VPN goes first, Tor goes second, and the mirrors never notice the difference.
The order that breaks first
Putting the VPN after Tor means the market’s traffic goes from you, through Tor, out an exit node, into a VPN server, and over to the mirror. Every extra hop is latency plus a point of failure, and you have paid for it in load times to hide from the mirror that you are using a VPN, which it could not see anyway once Tor is in the chain. If your mirrors feel slow while a VPN is on, this is usually why, and turning the VPN off is the fix.
On a phone
The phone version has one extra trap: VPN apps sometimes exclude certain apps from their tunnel, and browsers can be on that excluded list. If you are running a VPN and the Tor Browser app will not reach any onion, check the VPN app’s per-app rules and make sure the Tor Browser is routed through the VPN and not around it.