Tor Browser Security Settings Deep Dive — Slider, NoScript, and Circuit Isolation

Last month, a researcher I work with logged into a market using JavaScript enabled at the “Standard” security level. Within hours, a fingerprinting script harvested his screen resolution, timezone, and installed fonts — enough to correlate his session with a previous identity. The fix took ten minutes, but the lesson took longer to absorb: the default Tor Browser configuration is built for usability, not for the kind of work that puts a target on your traffic.

This guide is a deep dive into the three settings that actually matter when you treat Tor Browser as an operational tool rather than a curiosity: the Security Level slider, NoScript’s granular controls, and circuit isolation for separating identities. If you have already read the broad OPSEC overview, this is the hands-on follow-up.

1. What We’re Configuring and Why It Matters

The Tor Browser Security Level slider is not a marketing checkbox — it directly controls which browser features the Tor Browser team has audited for fingerprinting resistance. At “Standard,” JavaScript runs everywhere, fonts load from third parties, and audio/video can autoplay. At “Safer,” JavaScript still runs but is restricted on non-HTTPS sites, certain fonts and symbols are disabled, and some media formats stop rendering. At “Safest,” JavaScript is disabled on every site by default, and most features that can leak identifying data are turned off entirely.

For market access, vendor communication, and any session tied to a real identity, “Safest” is the only sensible baseline. The friction is real — some sites break — but the trade-off is that you stop being uniquely identifiable by your font list or your audio context fingerprint.

2. Prerequisites Before You Touch Anything

Download Tor Browser only from torproject.org. Verify the signature using the Tor Browser signing key before launching it for the first time. If you are running Tails, the browser is pre-configured but still defaults to “Standard” — you have to raise the slider manually every session.

Close every other browser tab and application that touches the network. WebRTC leaks in Firefox, Chrome, and even hardened derivatives have burned people who thought they were only using Tor. If you need a separate identity for a separate task, that is what circuit isolation is for, not a second browser running alongside.

3. Setting the Security Slider to Safest

Open Tor Browser, click the shield icon next to the address bar, then click “Advanced Security Settings.” Move the slider all the way to the right to “Safest.” You will see a warning that some sites will not work — accept it. This is the configuration the Tor Project recommends for users dealing with sensitive information, and it is the configuration you should be running.

What actually changes at Safest: JavaScript is disabled on all sites by default, some fonts and math symbols stop rendering, audio and video do not autoplay, and certain image and media formats are blocked. If a site requires JavaScript for a legitimate feature, NoScript will let you re-enable it on a per-domain basis — which is the next step.

4. Configuring NoScript the Right Way

NoScript is installed by default in Tor Browser. Click the NoScript icon in the toolbar to open its menu. You will see a list of domains on the current page. The default behavior at the Safest level is to block everything, which is what you want for first-time visits.

For a market like Torzon or Nexus, the rule is: never enable scripts globally, and never enable scripts on a domain you did not type yourself. If the market URL is torzonmarketxyz.onion, allow scripts only on torzonmarketxyz.onion and on the specific subdomains it uses for its PGP verification or 2FA flow. Do not allow scripts on third-party CDNs, analytics domains, or anything that resolves to a different operator.

Common mistake: people click “Allow all on this page” because a login form does not load. That single click can load scripts from ten different domains, including fingerprinting scripts the market operator may not even know about. Instead, refresh the page, check the console, and enable only the specific script source the form needs.

5. Circuit Isolation for Multiple Identities

Tor Browser supports multiple identities through the “New Identity” and “New Tor Circuit for this Site” features. The first clears cookies, history, and cache, then rebuilds the circuit. The second keeps your cookies but routes the next request through fresh relays — useful when a site loads slowly and you suspect a guard node is being watched.

To use this properly: dedicate one identity to your buyer account on a market like DarkMatter, a separate identity to vendor research, and a third to anything tied to your real-world identity (PGP key generation, XMR wallet setup, email). Never log into two different market accounts from the same circuit. Never log into a personal account from the same circuit you used for a market session. The exit node sees the traffic; the guard node sees your IP; the middle relays see neither, but correlation attacks chain the rest.

6. Verification Steps

After configuring, visit check.torproject.org to confirm you are on Tor. Then visit a fingerprinting test site — the EFF’s Cover Your Tracks or amiunique.org — and confirm the reported fingerprint matches what Tor Browser is supposed to show (a uniform fingerprint shared by all Tor Browser users at the same security level). If your fingerprint looks unique, something is leaking.

Open NoScript and confirm the default is still “Block all scripts globally.” Open about:preferences#privacy and confirm “Delete cookies and site data when Tor Browser is closed” is checked, and that history is set to “Never remember history.”

7. Common Issues and Troubleshooting

If a market login page breaks at Safest, the cause is almost always JavaScript. Use NoScript to temporarily allow scripts on that specific .onion domain, complete your login, then return NoScript to its default blocked state. Do not lower the security slider to fix this — that defeats the purpose of the configuration.

If circuits feel slow, use the circuit display (click the Tor button → “Tor Circuit”) to see which relays you are routed through. If a guard node looks suspicious or geographically close to you, click “New Tor Circuit for this Site” to rotate. If a site is completely unreachable, try a bridge — obfs4 or snowflake — but only if you actually face censorship, not as a default.

8. Additional Security Recommendations

Pair this configuration with Tails OS if your threat model warrants it. Tails routes everything through Tor, runs in RAM, and leaves no forensic trace on the host machine. For PGP key generation and XMR wallet setup, use Tails + a dedicated Tor identity so the keys are never tied to a market session circuit.

Disable JavaScript globally, isolate circuits per identity, verify the browser fingerprint before every sensitive session, and never assume a configuration is permanent — Tor Browser updates can reset preferences, so re-check the slider and NoScript after every update.