How to Disable JavaScript in Tor Browser. 2026 Guide

JavaScript is the biggest hole in your Tor anonymity. If it is enabled, a single malicious script can strip away your proxy and reveal your real IP address to an attacker.

Contents

Why You Must Disable JavaScript in Tor

How to Disable JavaScript Using Security Levels

Advanced Control: Using NoScript for Granular Privacy

Troubleshooting: What to Do When Sites Break

Final OpSec Checklist for Tor Users

View more View less

QUICK FIX: THE 10-SECOND METHOD

1. Open Tor Browser $\to$→ Click Menu (three lines).
2. Go to Settings $\to$→ Privacy & Security.
3. Scroll to Security Level $\to$→ Select Safest.
4. Restart your browser.

Why You Must Disable JavaScript in Tor

Tor hides your location, but JavaScript can “fingerprint” your device. Fingerprinting is when a website collects data about your screen resolution, installed fonts, and hardware specs to create a unique ID for you. Even if your IP is hidden, your fingerprint stays the same.

Beyond fingerprinting, JS is often used for Remote Code Execution (RCE). This means an attacker can potentially run code on your computer just because you loaded a page. Turning off JS kills these attack vectors instantly.

Read also: 7 Best Dark Web Search Engines with Verified Onion Links

How to Disable JavaScript Using Security Levels

The easiest way to manage scripts is through the built-in security slider. Tor offers three levels of protection.

Standard Level

This is the default. Everything works, but you are vulnerable. JavaScript is enabled for all sites. Use this only for trusted, non-sensitive browsing.

Safe Level

This disables JavaScript on non-HTTPS sites. It also blocks some dangerous fonts and symbols. It is a middle-ground option, but not enough for high-risk activity.

Safest Level

This is the gold standard for privacy. It disables JavaScript for all websites, regardless of whether they use HTTPS. It also blocks many images and symbols. Most websites will look “broken” or basic, but your anonymity is maximized.

Advanced Control: Using NoScript for Granular Privacy

Sometimes “Safest” mode is too restrictive. You might need JavaScript for one specific site but want it blocked everywhere else. This is where NoScript comes in.

Read also: Top 10 Secure Dark Web Markets

Tor Browser has NoScript integrated directly into the toolbar. Here is how to use it:

1. Look for the S icon (NoScript) in your toolbar.
2. Click the icon while visiting a site.
3. Select “Untrusted” to block all scripts.
4. Select “Trusted” only for sites you absolutely trust with your identity.

This allows you to maintain a “Default Deny” posture. You block everything by default and only open the door for specific, verified sources.

Troubleshooting: What to Do When Sites Break

When you disable JavaScript, the modern web starts to break. You will see missing images, non-functional buttons, or blank pages.

How to handle this without compromising your identity:

• Avoid “Standard” mode: Do not switch back to Standard just to view one page.
• Use NoScript: Temporarily trust a specific domain via the NoScript menu.
• Check for Text-Only Versions: Many sites have a “lite” or “text-only” version that works perfectly without JS.

Read also: Top 8 Best Dark Web Browsers Ranked for Real Anonymity

Final OpSec Checklist for Tor Users

If you are using Tor for high-stakes privacy, disabling JS is only step one. Follow this checklist to ensure you aren’t leaking data elsewhere:

• Do not resize the window: Maximizing the browser window reveals your screen resolution, contributing to your fingerprint. Keep the window at the default size.
• Avoid Browser Extensions: Adding extra plugins makes your browser unique. Use only what comes pre-installed.
• Use a VPN before Tor (Optional): If you want to hide the fact that you are using Tor from your ISP, connect to a trusted VPN first.

For further technical deep dives, always refer to the Official Tor Project Documentation.