Correct.
Your ISP can see:
That you use Tor. Your first hop connects to a guard relay, and all relay IPs are on a public list. The traffic is fully encrypted, but "connected to known Tor relay" = "this customer uses Tor."
Volume and timing, how much, when.
Your ISP cannot see:
Content. Thanks to three layers of encryption, peeled one hop at a time. No single party holds both ends, by design.
Destination. The guard knows you but not where you're going. DNS also resolves inside the circuit, so no DNS leaks (unlike a sloppy VPN setup).
Derek Ross
npub18a…tp424
2026-09-13 17:28:28 UTC
in reply to nevent1q…n967
Author Public Key
npub18ams6ewn5aj2n3wt2qawzglx9mr4nzksxhvrdc4gzrecw7n5tvjqctp424Seen on
wss://nos.lolPublished at
2026-09-13 17:28:28 UTCEvent JSON
{
"id": "0000065f4bab82c98b2348a609fcc87f3a8024131fac46f579482748ca7e3288",
"pubkey": "3f770d65d3a764a9c5cb503ae123e62ec7598ad035d836e2a810f3877a745b24",
"created_at": 1789320508,
"kind": 1,
"tags": [
[
"e",
"0000b9a40ce482a1d27031fd6e1abb929c31ef4f86678491c5edb577e93bf5d1",
"wss://nostr.bitcoiner.social/",
"root",
"64acf4055fa826bcab8457e24ef8fba7490abb1e76dbab6aa8752a53a0eb4d4a"
],
[
"e",
"00000354fff90b7d51f86b0a61bfa850e7863d22d7e48a0a4fe5f654cb9f5c45",
"wss://nostr-relay.derekross.me/",
"",
"3f770d65d3a764a9c5cb503ae123e62ec7598ad035d836e2a810f3877a745b24"
],
[
"e",
"21e4ad347972836534a21e72e1c82fe17339470050652cf0f322b5c75724ded5",
"wss://freelay.sovbit.host/",
"reply",
"036533caa872376946d4e4fdea4c1a0441eda38ca2d9d9417bb36006cbaabf58"
],
[
"p",
"6f0cc771674c2494627c931077dce22ac4ee24517abe5f7233afc0550c70de9e",
"wss://nostr.mom/"
],
[
"p",
"64acf4055fa826bcab8457e24ef8fba7490abb1e76dbab6aa8752a53a0eb4d4a",
"wss://offchain.pub/"
],
[
"p",
"8e1e3efef6509b9efc453d83590940b6e6557307d58b89d5f70f4f8547cc6e09",
"wss://nos.lol/"
],
[
"p",
"3f770d65d3a764a9c5cb503ae123e62ec7598ad035d836e2a810f3877a745b24",
"wss://nos.lol/"
],
[
"p",
"036533caa872376946d4e4fdea4c1a0441eda38ca2d9d9417bb36006cbaabf58",
"wss://theforest.nostr1.com/"
],
[
"client",
"Amethyst"
],
[
"nonce",
"000krP",
"21"
]
],
"content": "Correct.\n\nYour ISP can see:\n\nThat you use Tor. Your first hop connects to a guard relay, and all relay IPs are on a public list. The traffic is fully encrypted, but \"connected to known Tor relay\" = \"this customer uses Tor.\"\n\nVolume and timing, how much, when.\n\nYour ISP cannot see:\n\nContent. Thanks to three layers of encryption, peeled one hop at a time. No single party holds both ends, by design.\n\nDestination. The guard knows you but not where you're going. DNS also resolves inside the circuit, so no DNS leaks (unlike a sloppy VPN setup).",
"sig": "7528f4fc198233b21bf5d05b66dd69a38965ec0040756a75e48067de9a634375b33f2a9bb77a85eed369a66958db379f00284c8744c2e7c35ea49d0f4edfcf0b"
}