Network Privacy: Tor & I2P

Monero hides who sent a transaction, who received it, and how much moved — but all of that protection lives inside the blockchain. The moment your wallet broadcasts a transaction, it has to talk to a node over the internet, and that conversation happens at the network layer, where your IP address is exposed. If an observer can tie your IP to a transaction, the world-class on-chain privacy above it is undermined. Tor and I2P exist to close exactly this gap.

The Layer Monero Doesn't Cover

Think of a Monero transaction as having two parts. The cryptographic part — stealth addresses, ring signatures, and confidential amounts — is handled by the protocol and is genuinely strong. The delivery part is ordinary internet traffic: your wallet connects to a node and hands it a signed transaction to relay. That connection reveals your IP address to whichever node you used, and potentially to anyone watching the link between you.

This matters because an IP address is often a direct line to your identity through your ISP. An observer who sees "this IP submitted this transaction at this time" has metadata that Monero's on-chain privacy was never designed to hide. Monero's own Dandelion++ propagation helps obscure which node a transaction originated from, but it is a complement to, not a replacement for, hiding your IP.

How Tor Helps

Tor routes your traffic through a series of volunteer-run relays, each peeling away one layer of encryption, so the node you ultimately reach sees the address of a Tor exit, not your home IP. For Monero this means you can submit and receive transactions without the node — which might be run by anyone, including a snoop — learning where you are.

• Connecting your wallet over Tor lets you use a remote node without leaking your IP to it. We walk through this in Connecting Over Tor.
• Running your own node over Tor avoids trusting a third-party node at all while still hiding your network location; see Running or Choosing a Node.
• Monero ships with Tor-friendly tooling, and the official project documents recommended setups in its user guides.

How I2P Differs

I2P (the Invisible Internet Project) is a peer-to-peer anonymizing network designed for traffic that stays inside the network rather than exiting to the regular internet. Monero supports I2P through its companion routing, which is well suited to node-to-node communication. In practice, Tor is the more common choice for everyday wallet use because it is widely deployed and well documented, while I2P appeals to users who want an alternative network with different design trade-offs. Both achieve the same core goal: separating your real IP from your Monero activity.

The Node Privacy Ladder: Most to Least Private

Two choices decide your network privacy: whose node you talk to (your own or a stranger's) and whether you use Tor or I2P. Combine them and you get a clear ranking, from best to worst:

1. Your own node, over Tor or I2P — most private. Your wallet only ever talks to your own node on your own machine, so no third party sees which outputs you query, your subaddresses, or when you broadcast. And because your node reaches the Monero peer network over Tor or I2P, not even other peers learn your real IP. Nothing links your wallet activity to you. The cost is effort: you run and sync a node, and it's a little slower.
2. Your own node on clearnet (no Tor) — very private, and practical. Your wallet still talks only to your own node, so all of your wallet's requests and broadcasts stay on your machine — no operator to see them. The only exposure is that your node appears on the peer network with your IP as "a Monero node," which isn't tied to any specific transaction (and Dandelion++ further muddies where transactions originate). For most people this is an excellent, low-friction setup.
3. A remote node, over Tor — practically private. You don't run a node, but you reach someone else's over Tor. The operator can see your wallet's requests — which outputs and key images you ask about, and the timing of your broadcasts — and could log or profile that pattern, but they cannot see your real IP, so they can't tie it to your location or identity. This is the best easy option, ideal for mobile use. You still trust the node to give you honest chain data.
4. A remote node on clearnet (no Tor) — least private. The node operator sees both your wallet's requests and your real IP address, letting them link your Monero activity directly to your ISP-identifiable location and the exact time. This is the worst case — and it's the default many wallets fall into if you never change the node setting. Avoid it for anything you care about.

The short version: your own node plus Tor or I2P is the gold standard; a remote node over Tor is the best low-effort choice; and a remote node on clearnet is the one to avoid. Notice that running your own node and using Tor protect different things — your own node hides your activity from a nosy operator, while Tor hides your IP — which is why the top of the ladder uses both.

Common Mistakes

Using Tor or I2P is powerful but easy to get subtly wrong:

• Leaking around the tunnel. If your wallet is configured for Tor but your node-syncing or update checks go in the clear, you may still expose yourself. Make sure the whole wallet's traffic is routed.
• Trusting a hostile remote node anyway. Tor hides your IP from the node, but a malicious node can still feed you misleading data or log the transactions you submit. Running your own node removes this concern.
• Confusing network privacy with on-chain privacy. Tor does nothing about the chain, and Monero does nothing about your IP. You need both, which is why this fits into a broader threat model.
• Forgetting the rest of your footprint. Network privacy is one piece; the next is the metadata you leak through timing, reused identifiers, and habits.

When You Actually Need It

If your threat model only includes casual on-chain observers, default Monero may suffice. But if you worry about your ISP, a hostile network, or anyone correlating your IP to your spending, hiding the network layer is one of the highest-impact steps you can take — often more impactful than exotic on-chain maneuvers like churning.

On-chain privacy and network privacy are two halves of the same shield. Monero gives you the first half for free; Tor and I2P let you supply the second. Pair them with disciplined operational security, and your IP stops being the loose thread that unravels everything else.