Most investigators spend a lot of time online, but very few stop to think about what they are actually exposing when they browse, search, or interact with websites. This lesson is not about paranoia. It is about understanding risk and knowing when basic precautions make sense.
This is about protecting yourself.
What “anonymity” really means online
Being anonymous online does not mean invisible. It means reducing what can be tied back to you later. Most online tracking is not about names or faces. It is about patterns with IP addresses, browsers, devices, and repeated behavior.
If someone can later connect those patterns to you, your past activity can suddenly become relevant. That is the risk investigators should care about.
What a VPN actually does
A VPN hides your real IP address from the website you visit.
When you use a VPN, the site sees the VPN’s IP, not yours. Your internet provider sees that you are using a VPN, but not what sites you visit.
What a VPN does not do is hide your browser. The site can still see details about your browser and device. That includes things like browser type, operating system, screen size, time zone, language, and rendering behavior. Taken together, those details can be fairly unique.
So a VPN protects location. It does not fully protect identity at the browser level.
I prefer Protonmail, which comes with multiple features, including a VPN. and if you want 2 weeks for free, use this link: https://pr.tn/ref/0J6GKTXN. I’m on the lower tier plan at $5 a month, which suits my needs just fine.
What the Tor Browser actually does
Tor Browser does two things at the same time.
First, it hides your IP address by routing traffic through multiple relays. The website never sees your real IP.
Second, and more importantly, it standardizes your browser. Everyone using Tor Browser looks almost the same. Fonts are limited. Screen size is controlled. Fingerprinting tricks are blocked or reduced.
This matters because most tracking today relies on browser uniqueness, not just IP addresses.
Tor is not magic. It does not make you untraceable forever. What it does is remove stable identifiers that can be reused later.
You can download the TOR Browser here: https://www.torproject.org/download/
VPN vs Tor, in plain terms
A VPN hides your IP address. The website sees the VPN instead of you, but it still sees your browser, which can be unique.
Tor hides your IP and makes your browser look the same as everyone else using Tor.
If you use Tor by itself, your internet provider can see that you’re using Tor, but not the websites you visit. If you use a VPN before Tor, your internet provider only sees VPN traffic.
To a website, a VPN shows a masked IP with a unique browser. Tor shows a Tor IP with a generic browser. That’s why Tor reduces later tracking.
Why browser fingerprinting matters to investigators
A browser fingerprint does not identify a person by itself. It identifies a specific browser setup.
If law enforcement or a civil party later ties that browser setup to you through some other event, earlier activity using the same fingerprint can be linked back.
That is not theory. That is how correlation works.
Tor reduces this risk by design. Normal browsers do not.
Cookies and basic tracking
Cookies are still used everywhere. A VPN does not stop cookies. Tor isolates and clears them aggressively.
This is one reason people think they are being careful when they are not. Hiding your IP alone does not stop tracking.
When anonymity actually matters
Most investigative work does not require Tor. Basic browsing, public records searches, and routine research usually don’t justify the extra friction.
Anonymity starts to matter when you’re researching sensitive topics, adversarial targets, or anything that could later be questioned or reviewed. In those situations, the concern isn’t being watched in real time. It’s whether your research can be connected back to you later.
The biggest mistake investigators make is thinking anonymity is a switch you turn on. It isn’t. It’s a set of trade-offs between convenience, exposure, and necessity. Understanding what the tools actually do lets you make those decisions deliberately instead of guessing.
Final thought
You do not need to be paranoid to be careful.
Understanding how VPNs and Tor actually work lets you protect yourself when it matters and avoid overkill when it does not. That is the investigator mindset.
Click Here to join Skiplook for member only tutorials, investigator tools that can save countless hours and tons of resources to help you investigate better!
Bonus Section – Onion Links
Here are some Onion links to use in the TOR browser. Sometimes these links go down and other times they switch onion addresses, but most should work.
DuckDuckGo – https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/
Best for internet searches with maximum privacy.
Ahima – http://juhanurmihxlp77nkq76byazcldy2hlmovfu2epvl5ankdibsot4csyd.onion/
Widely used safe search engine that filters out potential illegal websites.
Torch – http://xmh57jrknzkhv6y3ls3ubitzfqnkrwxhopf5aygthi7d6rplyvk3noyd.onion/
Fairly old school and not particularly good, but might be worth searching. Use caution as it doesn’t have much of a filter.
Dark.fail – http://darkfailenbsdla5mal2mxn2uz66od5vtzd5qozslagrfzachha3f3id.onion/
Another industry-standard directory for checking the “up” status of major dark web sites.
Onion Links – http://s4k4ceiapwwgcm3mkb6e4diqecpo7kvdnfr5gg7sph7jjppqkvwwqtyd.onion/
Tons of onion links. Use caution as some sites may not be legal.