Skip to content

What Tor VPN Beta's first year looks like across seven Asia-Pacific regions

This post builds on the Tor Project announcement below. We also publish full translations of it:

Tor VPN beta promotional image showing availability on download.torproject.org with F-Droid and Google Play badges, and a phone displaying the connected screen with upload and download counters

The Tor Project's retrospective on the first year of Tor VPN Beta contains one finding that reframes the whole product. The team expected to learn from real-world use, and what they learned was that the primary use case is unblocking the internet — not the privacy features a commercial VPN would lead with. Early adoption concentrated in heavily censored regions, and that shaped what got built next.

That finding is the interesting part for us, a community based in Taiwan, because the regions we cover sit at very different points on that spectrum. This post checks the announcement against measurement data for seven Asia-Pacific regions, and sets out what the regulatory picture looks like in each.

What the Tor Project published

The design detail that matters most: every app on the device gets its own Tor circuit rather than sharing one tunnel, an isolation model borrowed from Tor Browser's cross-site tracking protections. The Apps screen is now searchable, so picking which apps route through Tor is faster.

The lesson the team highlights is about exit selection. Giving users more control over exit location sounded reasonable on paper and confused people in practice: users trying to get around censorship were picking exit locations when what they needed were bridges. The current design therefore requires connecting to the Tor network before an exit can be selected.

The rest is infrastructure. Tor VPN is built on Arti2, the Rust implementation of Tor, which the team credits for fewer crashes and better handling of changing network conditions. WebTunnel bridges3 arrived in the 1.4.0 beta, reproducible builds and an F-Droid listing4 both landed, and congestion control has not yet been ported over from the C implementation. Full details are in the original announcement1, and our two Chinese translations cover it section by section.

How many people use Tor across seven regions

We pulled Tor Metrics daily user estimates for the 90 days from 11 June to 9 September 2026, for both direct connections and bridges5.

Region Direct users (daily mean) Bridge users (daily mean) Bridge share
China 1,179 2,486 67.8%
Hong Kong 6,078 529 8.0%
Malaysia 15,917 806 4.8%
Taiwan 12,018 479 3.8%
Japan 30,295 1,209 3.8%
Singapore 21,812 516 2.3%
South Korea 27,847 581 2.0%
The exact queries behind this table

Tor Metrics serves these figures as CSV. Swap country= for cn, hk, sg, my, jp or kr to get the other rows.

https://metrics.torproject.org/userstats-relay-country.csv?start=2026-06-11&end=2026-09-09&country=tw&events=off
https://metrics.torproject.org/userstats-bridge-country.csv?start=2026-06-11&end=2026-09-09&country=tw

Both files carry one row per day, with the user count in the third column. The table shows the arithmetic mean of that column across the 90 rows, rounded to the nearest whole number. Bridge share is the bridge mean divided by the sum of both means. Tor recalculates these estimates as new directory data arrives, so the table is a snapshot of one window rather than a fixed figure.

China is the only region in the sample where bridge users outnumber direct users. Everywhere else the bridge share sits between 2 and 8 percent. That single ratio is the clearest evidence for the announcement's point about exit selection versus bridges: in the one place where direct access to Tor mostly fails, as the OONI measurements in the next section show, bridges are not an advanced option, they are the only way in.

Two caveats before anyone reuses these numbers. Tor's user estimates are derived from directory requests and geolocated by IP address, so they are estimates rather than headcounts, and someone reaching Tor through a bridge or a commercial VPN may be attributed to the wrong place5. The absolute counts are also not normalized by population, which is why Singapore's 21,812 direct users and Japan's 30,295 are not the comparison to draw. The bridge share is a ratio within each region, so it survives both problems.

What OONI measurements add

OONI (Open Observatory of Network Interference) runs a tor test, which checks whether Tor directory authorities and default bridges are reachable. Over the same 90-day window6:

Region Anomaly rate, OONI tor test Measurements
China 96.5% 2,847
South Korea 9.6% 4,407
Japan 5.6% 10,052
Taiwan 5.2% 15,582
Hong Kong 0.9% 3,270
Singapore 0.9% 3,557
Malaysia 0.7% 10,288
The exact queries behind this table

OONI's aggregation API returns totals for one country and one test over a date range. probe_cc takes the uppercase two-letter code, and the same call with test_name=psiphon produces the Psiphon figures quoted below the table.

https://api.ooni.io/api/v1/aggregation?probe_cc=TW&test_name=tor&since=2026-06-11&until=2026-09-09

The anomaly rate is anomaly_count divided by measurement_count in the JSON response. Adding &axis_x=measurement_start_day returns the same counts broken down by day. The tests we looked at and discarded, covered in the next section, are vanilla_tor, torsf and riseupvpn, reachable by changing test_name in the same call. Counts grow as probes submit measurements, so the same query run later returns different totals and the live data is the authoritative version.

China's 96.5 percent is a different category of result from everything below it. OONI's classification does not record why a measurement was flagged, so the single-digit rates below China settle nothing in either direction and none of them should be read as proof that Tor is partly censored. South Korea's 9.6 percent is the highest of those, and the government there runs the active HTTPS filtering system described later in this post, which is a reason to treat that figure with more care than Japan's or Taiwan's.

The same picture appears in OONI's psiphon test, which measures whether that circumvention tool can bootstrap. China sits at 23.2 percent anomalies across 3,326 measurements; the other six regions all come in at or below 2.1 percent6.

Which measurements we discarded

Three OONI test families looked relevant and did not survive scrutiny, and saying so is more useful than publishing them.

The Snowflake test (torsf) comes out at a 70.6 percent anomaly rate in Taiwan across 517 measurements. Taiwan does not block Tor, and the OONI tor test puts Taiwan at 5.2 percent over the same window. An anomaly rate that high in a region with no blocking points at the reliability of the test, not at censorship, so we left the whole family out.

The vanilla_tor test carries more failures than anomalies in several regions — 4,304 failures out of 6,215 measurements in Taiwan, 3,200 out of 3,707 in Malaysia. Failures are measurement errors, so the anomaly rates computed on top of them are not comparable across regions.

The riseupvpn test had no measurements at all for China and Hong Kong in this window, and one or two for Singapore, Malaysia and South Korea. Taiwan and Japan were covered properly, 221 and 562 measurements with no anomalies in either, but five of seven regions left effectively unmeasured cannot carry a regional comparison, and absence of measurement is not evidence that a tool works.

Why we do not cite VPN adoption numbers

Readers ask for VPN usage rates by country, and we do not publish them. The figures in circulation come from VPN vendors' own marketing reports and from download-tracker estimates, where the sample is the vendor's customers, the methodology is usually undisclosed, and the publisher sells the product being measured. Numbers built that way cannot support the comparisons people want to make with them.

What can be measured is whether specific circumvention tools work from inside a network, which is what the OONI numbers above do, and what the law says, which is the section below.

Blocking and regulation region by region

Freedom House's Freedom on the Net 2025 covers 1 June 2024 to 31 May 20257, and gives us one consistent source for six of these seven regions. Hong Kong has no separate country report in that edition.

China — the national-level Great Firewall blocks thousands of domains, and a provincial website-blocking system in Henan operates on top of it, according to the 2025 report8. Separately, a 2017 Ministry of Industry and Information Technology circular requires approval from the telecommunications authority before building or leasing channels, VPNs included, to carry out cross-border business; the ministry's follow-up clarification described the target as entities operating cross-border telecom services without the relevant licence9.

Hong Kong — no separate Freedom on the Net report, so we have only our own measurements: an 8.0 percent bridge share, the second highest in the sample, against a 0.9 percent anomaly rate on the OONI tor test. Direct access to Tor works.

Taiwan — mainstream services are not blocked and Tor connects directly. The governance question sits at the DNS layer, where the Taiwan Network Information Center (TWNIC) executes stop-resolution orders from competent authorities through a Response Policy Zone10. In Freedom on the Net 2025, drawing on TWNIC's first transparency report, the figure is more than 50,000 websites designated for blocking in the first half of 2025, with the vast majority of designations not subject to judicial review; an LGBT+ bulletin board blocked in February 2025 at the request of the Ministry of Health and Welfare is in the same entry11. In December 2025, the Central News Agency (CNA) reported a one-year block of rednote (小紅書, also transliterated Xiaohongshu) ordered by the Ministry of the Interior and executed through the same mechanism12.

Singapore — the government blocked 10 websites in October 2024, saying they "could be used to mount hostile information campaigns against Singapore", with several of the domains appearing to impersonate Singapore-based sites13.

Malaysia — the Malaysian Communications and Multimedia Commission (MCMC) continued removing content perceived as critical of the government, and legislation passed during the coverage period widened the regulator's censorship powers. In September 2024 the MCMC withdrew planned rules that would have required service providers to reroute DNS traffic to domestic servers, after civil society groups objected; DNS hijacking by two providers had been reported the month before14.

Japan — no website blocks, and the highest possible score on the blocking and filtering indicator15.

South Korea — the government began SNI-based filtering of HTTPS sites in February 2019, which allows blocking at the level of an individual page17. More recently, the data protection authority blocked downloads of DeepSeek's app in February 2025, with access restored two months later after the company made privacy changes16.

What this means for Tor VPN Beta

Bridges are the feature that matters in this region, and the design decision to require a Tor connection before exit selection is the right one for the place where it counts. For anyone introducing the app in China, bridge configuration is the first thing to teach and exit selection is a distraction. Our own guides on Snowflake bridges and running a WebTunnel bridge cover the mechanics.

Install channels are not a side note either. Google Play is unavailable in China, so the F-Droid listing and the direct APK download are what make the app reachable at all — with the caveat that the download hosts themselves may be unreachable, which makes fetching and verifying the package in advance the practical approach.

In the low-blocking regions in this table the value proposition is different, and per-app routing is the reason to look at it: route the apps that need anonymity through Tor and leave the ones that need a local IP address on the normal network. Anti-abuse systems commonly blocklist Tor exit addresses, a general pattern rather than something we measured for this post, and the per-app switch is what makes mixed use workable in spite of it.

The Beta warning still applies everywhere. It is in the Tor Project's own support documentation: the app may leak information and should not be used for anything sensitive18. The independent audit of the Android app is covered in our earlier post, and the wider trade-offs are in our VPN guide. For high-risk work, Tor Browser and Tails, the amnesic live operating system, remain the mature options, and the tool choice should follow from a threat model rather than from a feature list.

  1. Tor VPN Beta: What we've learned building our own VPN for Android from scratch - The Tor Project blog, 9 September 2026, by pavel. Images in this post are the full-resolution files from the companion forum thread. Retrieved 2026-09-11. ↩

  2. Arti is the Tor Project's Tor implementation written from scratch in Rust, structured primarily as a library so it can be embedded in other software. It is the engine underneath Tor VPN. See our Arti changelog and the source repository - Tor Project GitLab. Retrieved 2026-09-11. ↩

  3. WebTunnel is a pluggable transport that wraps Tor traffic inside an HTTPS connection so it resembles traffic to an ordinary website. See Hiding in plain sight: Introducing WebTunnel - The Tor Project blog, 12 March 2024. Retrieved 2026-09-11. ↩

  4. Tor VPN Beta on F-Droid - F-Droid. Packages in F-Droid are built by F-Droid from source, and installing or updating from it does not require a Google account. Retrieved 2026-09-11. ↩

  5. Daily user estimates from userstats-relay-country and userstats-bridge-country - Tor Metrics, queried as CSV for the window 2026-06-11 to 2026-09-09. Tor derives these figures from directory requests and geolocates them by IP address, so they are estimates, and traffic arriving through a bridge or a commercial VPN can be attributed to the wrong region. Retrieved 2026-09-11. ↩↩

  6. Measurement and anomaly counts from the OONI aggregation API - Open Observatory of Network Interference, queried per region for test_name values tor, vanilla_tor, torsf, psiphon and riseupvpn over 2026-06-11 to 2026-09-09. An anomaly is OONI's own classification and is not by itself proof of blocking. Retrieved 2026-09-11. ↩↩

  7. An Uncertain Future for the Global Internet - Freedom House, the Freedom on the Net 2025 edition. The coverage period is printed in the Key Developments header of each country report rather than on the edition page; we checked it on all six country reports cited here and it reads June 1, 2024 to May 31, 2025 in every one. Retrieved 2026-09-11. ↩

  8. China: Freedom on the Net 2025 - Freedom House. Retrieved 2026-09-11. ↩

  9. 工業和信息化部關於清理規範互聯網網絡接入服務市場的通知 - Ministry of Industry and Information Technology, January 2017, republished by the Cyberspace Administration of China, with the ministry's follow-up clarification. Retrieved 2026-09-11.  ↩

  10. RPZ malicious domain interception service - TWNIC, which publishes the transparency reports for stop-resolution orders it executes. TWNIC's blog post of 4 December 2025, TWNIC依法執行主管機關命令，啟動DNS RPZ技術屏蔽措施, describes the mechanism as executing orders from competent authorities. Use the figures currently published on the transparency site rather than the ones quoted here. Retrieved 2026-09-11. ↩

  11. Taiwan: Freedom on the Net 2025 - Freedom House, which attributes the blocking figures to TWNIC's first DNS RPZ transparency report. Retrieved 2026-09-11. ↩

  12. 內政部令小紅書暫封鎖1年 TWNIC：依法啟動屏蔽措施 - CNA, 4 December 2025. The app carries the brand name rednote on both stores it ships through, Google Play and the App Store, while Chinese-language coverage uses 小紅書. Retrieved 2026-09-11. ↩

  13. Singapore: Freedom on the Net 2025 - Freedom House. Retrieved 2026-09-11. ↩

  14. Malaysia: Freedom on the Net 2025 - Freedom House. Retrieved 2026-09-11. ↩

  15. Japan: Freedom on the Net 2025 - Freedom House, which records no blocks on websites and a full score on indicator B1. Retrieved 2026-09-11. ↩

  16. South Korea: Freedom on the Net 2025 - Freedom House. Retrieved 2026-09-11. ↩

  17. South Korea: Freedom on the Net 2019 - Freedom House, on the introduction of SNI-based filtering of HTTPS sites. Retrieved 2026-09-11. ↩

  18. About Tor VPN - Tor Project support documentation, source of the Beta warning. Retrieved 2026-09-11. ↩