Tor highlights evolving censorship evasion tactics during its most challenging year

In 2025, Tor faced some of the most aggressive and technically sophisticated censorship efforts yet, with Iran and Russia ramping up their tactics to unprecedented levels.

In response, the Tor Project deployed and refined a range of anti-censorship technologies, including Snowflake, WebTunnel, and the emerging Conjure transport, demonstrating a critical evolution in how the network defends access to information in authoritarian environments.

The Tor Project’s anti-censorship team shared their insights in a year-end retrospective, outlining the challenges encountered and lessons learned while defending users’ rights to free communication amid intensifying repression.

Blackouts in Iran and the rise of Snowflake

In June 2025, amid escalating conflict between Iran and Israel, the Iranian government executed near-total internet blackouts, effectively severing digital communication for days. These shutdowns, widely believed to be aimed at preventing espionage and suppressing dissent, represented one of the most hostile environments Tor has encountered.

To monitor conditions in real-time, Tor relied on its in-country vantage-point system, monitoring nodes placed within Iran to collect up-to-date data on accessibility and blocking. This system allowed precise tracking of domain-fronting configurations, used to make Tor traffic resemble benign requests to major cloud platforms. Through automated tools, the team could test which front domains provided the most reliable access to Snowflake and Moat, adjusting configurations accordingly.

Snowflake, Tor’s most widely used obfuscation tool in Iran, saw multiple technical upgrades this year. The browser extension was updated to Manifest Version 3 to comply with modern browser standards. Network Address Translation (NAT) detection logic was enhanced to better match users with compatible proxies, and metrics reporting was improved for proxy operators. A new staging infrastructure was also deployed to test protocol changes under simulated real-world censorship conditions.

Deploying Conjure in hostile networks

To counter increasingly sophisticated bridge enumeration and blocking, particularly in Iran, Tor advanced the deployment of Conjure, a pluggable transport that uses temporary, hard-to-predict network addresses from cooperating ISPs. By leveraging ephemeral infrastructure and mimicking popular internet services, Conjure makes it significantly harder for censors to perform bulk blocking.

This year, Tor extended Conjure’s protocols to strengthen both its initial handshake and data transport layers. The addition of multiple bootstrap methods, such as DNS-based and AMP-cache-based registration, makes detection harder. The team also integrated upstream transports like DTLS and prefix obfuscation, which help disguise Tor traffic as regular web or streaming traffic.

While Conjure itself is not new, its integration into Tor’s bridge ecosystem and its preparations for real-world deployment mark a significant step toward more resilient circumvention in 2026.

WebTunnel’s battle in Russia

Russia’s tightening censorship regime has increasingly relied on allowlisting and aggressive IP blocking to limit user access. In response, Tor developed WebTunnel, a pluggable transport that blends into HTTPS traffic and imitates legitimate TLS sessions. Introduced in late 2024, WebTunnel quickly became vital for Russian users.

By mid-2025, most WebTunnel bridges had been identified and blocked by Russian authorities. In response, Tor shifted distribution strategies, most notably through Telegram, a platform popular in Russia but harder for censors to scrape for bridge addresses in real-time. WebTunnel bridge support was added to Tor’s Telegram distributor, which also benefited Iranian users facing similar threats.

This rapid distribution adaptation was powered by rdsys, Tor’s bridge distribution system introduced last year. In 2025, rdsys was enhanced with a staging environment, allowing new features and configurations to be tested under production-like conditions before wide release, reducing downtime and improving user access in critical regions.

Community-driven action

Throughout 2025, Tor’s anti-censorship work was shaped by real-time user feedback and support from its global community. Volunteers helped test transports under different conditions, contributing patches and providing crucial insight from inside censored environments.

Looking ahead, the Tor Project plans to expand Conjure deployment, continue enhancing WebTunnel, and ready Snowflake for future large-scale disruptions. The Tor team emphasized that censorship is not just a governmental issue, as restrictions may be imposed at the level of ISPs, workplaces, or educational institutions. Tor’s mission remains to ensure users can connect securely and privately, no matter who is trying to block.