Every few months someone asks r/TOR where to find good proxies to add to Tor, and every few months the honest answer disappoints them. This post is that answer, written out properly: what chaining a proxy with Tor actually changes, what it costs you, and which of the two possible orderings solves which problem. None of it is new. These questions have sat in Reddit archives for years because the answer never changes.
Does Tor need a proxy for better anonymity?
No, Tor on its own is a complete anonymity design, and adding a proxy does not add anonymity, it adds another party who can watch you. Tor already routes your traffic through three relays (guard, middle, exit) chosen so that no single relay knows both who you are and where you are going. That separation is the entire product. A proxy is one machine run by one operator who sees both ends of every connection you push through it. Put one in the chain and you have introduced exactly the kind of single observer Tor was built to remove.
The old privoxy guides confuse people here. A decade and a half ago, browsers spoke HTTP proxies better than SOCKS, so tutorials wired Firefox to privoxy and privoxy to Tor's SOCKS port. That was plumbing, not extra security. Tor Browser made it obsolete. If a modern guide tells you to add a proxy "for another layer", close the tab.
One related misunderstanding deserves a paragraph: there is no list of "public Tor SOCKS5 proxies" you need to go find. Tor gives you the SOCKS5 proxy itself, locally, at 127.0.0.1:9050 (or 9150 inside Tor Browser). Tools like torsocks simply point programs at that local port. Nothing external is required.
Why free proxy lists are the wrong tool for anyone who cares about privacy
Free proxy lists are the worst of every world: most entries are dead, the live ones are slow, the operator is unknown, and the IPs are already on every blocklist that matters. Think about the economics for a second. Running a proxy costs money. Someone paying that bill to serve strangers for free is either running a research honeypot, monetizing your traffic by logging it or injecting into it, or unknowingly hosting an open relay that will be abused and blacklisted within days. For casual scraping that is merely annoying. For a person browsing a proxy list because they care about anonymity, it is backwards: you are handing your traffic, readable wherever it is plain HTTP, to the one class of operator with the strongest incentive to inspect it. No privacy problem on any list has "free proxies" as its answer.
Proxy after Tor: how to hide Tor from the website you visit
Placing a proxy after Tor (you connect through Tor, the exit relay connects to the proxy, the site sees the proxy's IP) genuinely hides the fact that you are using Tor from the destination site. This is the setup behind the recurring "the site blocks Tor" and "I want the website not to know I'm on Tor" threads. It works because Tor's exit relays are public. Anyone can download the exit list, and sites and CDNs check it, then block or challenge accordingly. Exit through a proxy instead and the site sees an unremarkable address.
Now the part every guide skips. That proxy operator sees every destination you visit through it. And if you paid for the proxy with a card, or signed up with an email you use anywhere else, you have pinned your real identity to one end of the chain. Tor's anonymity toward the site survives; anonymity toward the proxy provider, and toward anyone who can compel that provider, does not. A commercial proxy bought with an account is pseudonymous at best, never anonymous. That includes BirdProxies. We can see which customer account ran which proxy session, and so can any provider who bills you. If your threat model includes someone with subpoena power, a paid proxy after Tor is a dressed-up weak link, not a shield.
Configuration is the easy bit. Run your application over Tor and point it at the upstream proxy: proxychains produces this ordering when Tor's local port is listed first, and Whonix-style setups do the same at the system level. Expect it to be slow. You kept all three Tor hops and added a fourth.
Proxy before Tor: hiding Tor from your network
A proxy placed before Tor hides your Tor usage from your local network or ISP, and for that job the purpose-built answer is a Tor bridge, not a commercial proxy. This is the mirror image of the previous section. Your ISP cannot read Tor traffic, but it can see you connecting to a publicly listed Tor relay. Where that observation is itself the problem (a hostile network, a country that filters Tor), the Tor Project ships bridges: unlisted entry relays, optionally wrapped in obfs4 or Snowflake so the traffic does not even look like Tor. Bridges are free and built into Tor Browser under connection settings, and they were designed by the same people who designed the rest of the network. Routing Tor through a commercial HTTP or SOCKS proxy also works mechanically, since torrc accepts an upstream proxy, but then your proxy provider holds a clean record of you connecting to Tor entry nodes. That is usually the exact record you were trying not to create.
Why Tor is slow and a paid proxy is fast
Tor is slow because your traffic crosses three volunteer-run relays by design, and a paid proxy is fast because it is one hop through hardware someone bills you for. Neither is a flaw. They are the same trade seen from opposite sides. Three hops, each adding latency, each limited by the most congested volunteer link in the chain: that is the price of no single party knowing the whole route. One accountable hop is the price of speed. What does not exist, at any price, is the thing people keep asking for, a service that is fast, reliable, and accountable to nobody. Every "fast anonymous proxy" quietly drops one of the three.
So pick by problem, not by product category. If you need anonymity against a capable adversary, use Tor as shipped and accept the speed. If Tor is unusably slow for what you are doing, ask whether you needed anonymity at all, or just a different IP.
What commercial proxies are actually for
Commercial residential and ISP proxies are built for blocking-resistance and identity separation, not for being untraceable, and confusing those two goals is the root of most of these Reddit threads. A residential proxy makes your traffic exit from an IP that belongs to an ordinary consumer connection in a country you choose. Sites treat it like a household visitor. That matters for concrete, boring reasons: managing accounts that must not share an IP, testing geo-targeted content, scraping sites that block datacenter ranges, keeping client work separated by region.
The OSINT case fits the same shape. A researcher who opens a subject's website from a corporate VPN range or a cloud IP announces the visit, because server logs make security-company ranges easy to spot. Through a residential proxy the visit reads as one more household in that country. That is operational discretion, not anonymity. The provider can still connect the session to the researcher's account, and a court can still compel that connection. For most research work the trade is fine, because the threat is the subject noticing, not a subpoena. Know which one you are defending against before you pay anyone, us included.
Which setup solves which problem
Match the tool to the observer you are worried about, because each of these setups blinds exactly one party and no configuration blinds them all.
- The website must not identify you at all: Tor alone, as shipped in Tor Browser. Add nothing.
- The website must not see that you use Tor: proxy after Tor. It works, and the proxy provider now sees your destinations and your payment identity.
- Your ISP or local network must not see that you use Tor: an obfs4 bridge from the Tor Project, not a purchased proxy.
- Sites keep blocking you and anonymity was never really the point: a paid residential or ISP proxy alone, no Tor, is the honest tool.
- Free proxy lists: no problem on this list has them as the answer.
The people asking these questions were not wrong to want what they wanted. They were sold the idea that stacking tools stacks protection. It does not. Every hop you add is a party you must trust, and the whole craft is choosing, deliberately, which parties those are.