Why Disable JavaScript in Tor Browser
JavaScript runs on websites and can execute code that bypasses Tor's protections. Malicious scripts can leak your IP address, read your browser history, or gather system information that identifies you. Even legitimate JavaScript can be exploited by network-level attackers. The Tor Project acknowledges this risk, which is why security-conscious users disable it. Disabling JavaScript reduces your attack surface significantly, though it breaks some websites. The tradeoff is worth it if anonymity is your priority over convenience.
Disable JavaScript via Tor Browser Settings
Open Tor Browser and click the hamburger menu (three horizontal lines) in the top right corner. Select Preferences, then Privacy & Security. Scroll down to the Security section. You'll see a slider labeled "Security Level." Move it to "Safer" or "Safest." At the Safer level, JavaScript is disabled on all sites. At Safest, additional protections activate, including disabling certain fonts and plugins. Close the settings tab. JavaScript is now off. To verify, visit a JavaScript detection site—it should report that JavaScript is disabled.
Manual JavaScript Disabling via about:config
For finer control, type about:config in the address bar and press Enter. Accept the warning. Search for "javascript.enabled" in the search box. Double-click the result to toggle it to false. Search for "dom.disable_beforeunload" and set it to true to prevent scripts from blocking page navigation. Search for "extensions.activeTheme" and verify it's set to a default theme, not a custom one that might contain malicious code. Close the tab. These changes persist across sessions. To re-enable JavaScript, return to about:config and toggle javascript.enabled back to true.
What Breaks When JavaScript Is Off
Many modern websites rely on JavaScript for core functionality. You may encounter blank pages, broken layouts, or non-functional buttons. Video players often don't work. Forms may fail to submit. Some search engines and marketplaces become unusable. However, basic text-based sites, forums, and documentation pages usually work fine. If you need JavaScript for a specific task, enable it temporarily: return to Settings > Security Level and move the slider back to Standard. Complete your task, then disable it again. This approach balances security with occasional convenience.
JavaScript and Tor Browser Installation
When you first install Tor Browser, JavaScript is enabled by default. Before browsing, disable it using the Security Level slider described above. This prevents any initial exposure. If you're reinstalling Tor Browser or upgrading to a new version, repeat this step immediately after launch. The setting persists if you're updating within the same profile, but a fresh installation resets it. Always verify the Security Level after any major update.
Common Mistakes and Troubleshooting
Mistake 1: Assuming JavaScript is off because you moved the slider once. Verify by visiting a test site or checking about:config. Mistake 2: Enabling JavaScript globally to access one site, then forgetting to disable it. Use the site-specific toggle instead: click the shield icon in the address bar to temporarily allow JavaScript for that domain only. Mistake 3: Mixing Tor Browser with extensions that re-enable JavaScript. Avoid installing third-party extensions unless absolutely necessary. Mistake 4: Thinking JavaScript is the only anonymity risk. Combine this with other practices: use a VPN before Tor, avoid maximizing your browser window, disable plugins, and never download files unless necessary.
Security Best Practices Beyond JavaScript
Disabling JavaScript is one layer. Add others: use Tor Browser's built-in security features without modification. Keep Tor Browser updated—updates patch vulnerabilities. Use a VPN before connecting to Tor if your ISP or network administrator is a threat. Never enable plugins like Flash or Java. Disable WebRTC leaks by checking your IP at a WebRTC test site with JavaScript off—if it shows your real IP, your Tor Browser needs updating. Don't maximize your window to avoid fingerprinting by screen resolution. Don't change Tor Browser's default font size. Avoid downloading files unless you trust the source and can verify them offline.
Frequently asked questions
Does turning off JavaScript make Tor Browser slower?
No. JavaScript disabling may make some pages load faster because the browser skips script execution. Overall performance is unchanged. If anything, you may notice slightly faster page loads on sites that use heavy JavaScript frameworks.
Can I turn off JavaScript for only certain websites?
Yes. Click the shield icon in the address bar while on a site. You'll see options to adjust security for that domain. However, the global Security Level slider is simpler for most users. Use per-site controls only if you need JavaScript on specific trusted sites.
What's the difference between Safer and Safest security levels?
Safer disables JavaScript, some fonts, and certain media features. Safest adds restrictions on window resizing, disables MathML, and limits other features. Safest is more restrictive but breaks more sites. For most users, Safer is the right balance.
If I disable JavaScript, am I completely safe from tracking?
JavaScript disabling removes one major attack vector, but it's not a complete solution. Browser fingerprinting, DNS leaks, and network-level attacks can still occur. Use JavaScript disabling as part of a broader security strategy, not as a standalone fix.
Does Tor Browser's JavaScript disabling work the same on all operating systems?
Yes. The Security Level slider and about:config settings work identically on Windows, macOS, and Linux. The underlying Firefox engine behaves the same across platforms.
