Two layers, one question: which goes first?

People stack a VPN and Tor in both orders and defend both on forums. The difference is real and small, and it comes down to who can see that you are using Tor, and how many hops your mirror has to pass through.

OrderYour network seesThe mirror seesTrade-off
Tor onlyA connection to a Tor entry nodeA Tor exit nodeThe standard setup. Fastest, and what most of the market runs on.
VPN first, then TorA connection to a VPN serverA Tor exit nodeHides Tor use from your network. Adds one layer between you and the entry node, which is fine.
Tor first, then VPNA connection to a Tor entry nodeA VPN serverYour exit traffic detours through the VPN. More hops, more distance, and mirrors get slower for no anonymity you actually need.

Do you need a VPN at all?

On a home connection, usually no. Tor already keeps your destination from your network; what your network can see is that you are talking to Tor, which is the price of using it and not something a VPN removes from the mirror’s side. Add a VPN when your network itself is hostile: an office or campus Wi-Fi that blocks or throttles Tor, a public network you would rather not reveal Tor to. In those cases the VPN goes first, Tor goes second, and the mirrors never notice the difference.

The order that breaks first

Putting the VPN after Tor means the market’s traffic goes from you, through Tor, out an exit node, into a VPN server, and over to the mirror. Every extra hop is latency plus a point of failure, and you have paid for it in load times to hide from the mirror that you are using a VPN, which it could not see anyway once Tor is in the chain. If your mirrors feel slow while a VPN is on, this is usually why, and turning the VPN off is the fix.

On a phone

The phone version has one extra trap: VPN apps sometimes exclude certain apps from their tunnel, and browsers can be on that excluded list. If you are running a VPN and the Tor Browser app will not reach any onion, check the VPN app’s per-app rules and make sure the Tor Browser is routed through the VPN and not around it.