Can my ISP see which Tor relays I connect to or just that I use Tor?
Executive summary
Your ISP can see that you are connecting to the public Tor network because Tor relay IPs are public and detectable; using a public (non-bridge) client connection reveals a destination IP that matches a Tor guard/relay [1]. Bridges and pluggable transports hide relay IPs from ISPs by not appearing in the public directory, which is why they’re recommended where censorship or detection is a concern [1] [2].
1. How Tor looks from your ISP: visible connection endpoints
When you run Tor Browser or a Tor client that connects to the public network your ISP sees IP-level connections to known Tor relays — especially the entry (guard) relays — because the Tor design publishes relay IP addresses and directory information that anyone (including ISPs) can use to block or detect relays [1]. Multiple reports and documentation note plainly that public relay IPs are listed and therefore detectable by on-path observers such as ISPs [1] [3].
2. Distinguishing “I use Tor” from “which relays I use”
Because Tor’s relays are public, an ISP can match your outbound connection to a specific relay IP and therefore tell you’re talking to the Tor network and to which relay (for example, your current guard) [1]. Community answers and operator discussion add that while middle/exit changes can happen without the ISP seeing those internal rotations, the ISP still observes your client’s connection to your chosen guard over time [4].
3. Why guards matter — and why your ISP can track guard connections
Tor clients pick a small set of entry guards and keep them for long periods to limit exposure; your ISP will therefore repeatedly see traffic between your IP and the same guard IPs and can infer Tor use and the guard identities [4]. StackExchange‑style community explanations emphasize that guard rotation is much slower than minute-level changes — often weeks — so the pattern is stable and observable at the ISP level [4].
4. When an ISP cannot easily see relay IPs: bridges and pluggable transports
The Tor Project documents that bridges are not listed in the public directory, making them harder for ISPs or governments to block or detect; anti-censorship tools such as Snowflake, Conjure and WebTunnel are explicitly used to keep relay endpoints hidden or harder to enumerate [1] [2]. Tor’s 2025 reporting underscores that new transports and bridge distributions are core tactics for users in censored environments [2].
5. Practical differences for users: private browsing vs running a relay
Running a Tor relay at your location is different from merely using Tor: if you operate a relay your ISP will very likely notice you are running one because relay traffic patterns, directions and volumes differ from client-only use and the relay’s presence is public and contactable for abuse reports [5] [6]. The Tor Project’s relay guidance and community materials stress that relays are visible and may attract ISP scrutiny, and they recommend operators check ISP terms and expectations [7] [8] [6].
6. Limitations, tradeoffs and what the sources do not say
Available sources make clear that public relay IPs are observable [1] and that bridges/protocols reduce detectability [2], and community posts explain guard stability and ISP visibility of guards [4]. The provided material does not contain detailed, measured data about how well specific ISPs or nation-state actors perform traffic-correlation attacks or packet-size fingerprinting to deanonymize users — those capabilities are discussed in some forums but are not documented in the supplied sources (not found in current reporting).
7. Bottom line for readers deciding what to do
If you connect to the Tor network using public relays, your ISP can tell you are using Tor and can identify the relay IP you connect to because those relays are publicly listed [1]. To hide the relay endpoints from an ISP or censor, use bridges or pluggable transports that are not in the public directory — the Tor Project recommends these tools for resisting blocklists and detection [1] [2]. If you plan to operate a relay, consult Tor’s relay guidance and your ISP’s policies because running a relay is visible and may require coordination [7] [8] [6].