Tor Exit List
App · Compliance & Security · 8 actions
Tell whether an IP address is a Tor exit node, using the list the Tor Project publishes and rebuilds about every half hour. Check one address or a whole batch from your logs, pull the current addresses to keep a firewall or WAF blocklist in step, look up the relays behind an address, and see which exits are even allowed to reach your service before you decide to block anything. Every result carries the Tor Project's own ExoneraTor link, for the ticket where someone disputes a block. No account or API key required.
Actions
| Action | What it does |
|---|---|
| Check an IP address | Check whether one IP address is a Tor exit node, against the list the Tor Project rebuilds about every half hour. |
| Check several IP addresses | Check a batch of IP addresses at once and get them sorted into what they turned out to be. |
| Export the exit list | Write the current exit addresses out as text you can put somewhere else: a plain list of one address per line to paste into a firewall, a WAF rule or a deny list, or a spreadsheet with how many relays run at each address and when it was last confirmed. |
| Get an exit relay | Look up one exit relay by its fingerprint and get every address it exits from, when it published its descriptor, when it was last confirmed, and links to its Tor Metrics page. |
| Get exit list details | Read how big the current exit list is and how fresh: how many relays and how many addresses it holds, how many addresses several relays share, when the Tor Project last rebuilt it and how long ago that was, and which kinds of address it covers. |
| List exit IP addresses | Get the current Tor exit addresses, in numeric order and nothing else attached. |
| List exit relays | List the exit relays themselves rather than just their addresses: the fingerprint that identifies each one, every address it exits from, and when it was last confirmed. |
| List exits that can reach your service | Every Tor relay publishes which destinations it will carry traffic to, and most of them will not carry all of it. |
Check an IP address
Check whether one IP address is a Tor exit node, against the list the Tor Project rebuilds about every half hour. Use it to score a sign-up, gate a login, flag an order for review or add context to a support ticket. A match comes back with the relays running at the address, when traffic was last confirmed leaving them, and a link to the Tor Project's own ExoneraTor page to put in a ticket. The list covers IPv4, so an IPv6 address is refused with that explanation rather than told it is not Tor. No API key required.
Inputs
- IP address
ip_addresstextRequired - The address to check. Use the public address the visitor connected from; if your app sits behind a proxy or load balancer, that is the forwarded address, not the one your server sees.
Outputs
answertext- 'tor_exit' when the address is a Tor exit node, 'not_listed' when it is not on the list, and 'not_covered' when the list does not cover addresses of that kind at all, which today means IPv6.
checked_attext- When this step ran, as an ISO 8601 timestamp in UTC.
exonerator_urltext- A link to ExoneraTor, the Tor Project's own page for checking whether an address was running a Tor relay on a given day. The link to put in a ticket when someone disputes a block.
fingerprintslist- The fingerprints of the relays running at this address.
ip_addresstext- The address that was checked.
is_private_addresstrue/false- True for a private or reserved address such as 10.0.0.5 or 127.0.0.1. Those can never be Tor exits, so a true here usually means a proxy's own address was checked rather than the visitor's.
is_tor_exittrue/false- True when the address is on the current Tor exit list. Only ever true or false about what the list holds; read 'answer' when you need to tell 'not a Tor exit' apart from 'the list cannot say'.
last_confirmedtext- When traffic was last confirmed leaving this address, as an ISO 8601 timestamp in UTC. Empty when the address is not a Tor exit.
list_age_minutesnumber- How many minutes ago that was. The list rebuilds about every 30.
list_is_staletrue/false- True when the list has not been rebuilt for three hours, which is far longer than usual. The answer is still the best one available; this is there so a workflow can notice and say so.
list_updated_attext- When the Tor Project last rebuilt the exit list, as an ISO 8601 timestamp in UTC.
minutes_since_last_confirmednumber- How many minutes ago that was.
relay_countnumber- How many exit relays run at this address. Several relays commonly share one address.
relayslist- The matching exit relays.
summarytext- The answer in one sentence, ready to put in a message or a ticket.
Example output
{
"answer": "tor_exit",
"checked_at": "2026-09-14T00:37:50Z",
"exonerator_url": "https://metrics.torproject.org/exonerator.html?ip=171.25.193.25×tamp=2026-09-14",
"fingerprints": [
"64D74AAA74F30DC2CFB36343CE5D4451B9A4DBA8"
],
"ip_address": "171.25.193.25",
"is_private_address": false,
"is_tor_exit": true,
"last_confirmed": "2026-09-13T23:21:57Z",
"list_age_minutes": 41,
"list_is_stale": false,
"list_updated_at": "2026-09-13T23:56:04Z",
"minutes_since_last_confirmed": 41,
"relay_count": 1,
"relays": [
{
"exit_address": "171.25.193.25",
"exit_address_count": 1,
"exit_addresses": [
"171.25.193.25"
],
"exonerator_url": "https://metrics.torproject.org/exonerator.html?ip=171.25.193.25×tamp=2026-09-14",
"fingerprint": "64D74AAA74F30DC2CFB36343CE5D4451B9A4DBA8",
"last_confirmed": "2026-09-13T23:21:57Z",
"last_status": "2026-09-13T23:00:00Z",
"minutes_since_last_confirmed": 41,
"published": "2026-09-13T16:50:20Z",
"relay_url": "https://metrics.torproject.org/rs.html#details/64D74AAA74F30DC2CFB36343CE5D4451B9A4DBA8"
}
],
"summary": "171.25.193.25 is a Tor exit node, used by 1 relay, last confirmed 41 minutes ago."
}Check several IP addresses
Check a batch of IP addresses at once and get them sorted into what they turned out to be. This is the action for a day's sign-ups, a list of addresses from a log, or the senders on a spike of failed logins. Every address is answered individually, and the result also carries a flat list of just the Tor ones and a single true or false for 'was any of this Tor', so a workflow can branch without counting. Duplicates are collapsed and anything that is not an IP address is reported rather than failing the step. Up to 1,000 addresses. No API key required.
Inputs
- IP addresses
ip_addresseslistRequired - The addresses to check. Add them one at a time, or pass a list from an earlier step. Pasted text separated by commas, spaces or new lines works too.
Outputs
any_tor_exittrue/false- True when at least one address is a Tor exit node, so a workflow can branch on the batch in one step.
checked_attext- When this step ran, as an ISO 8601 timestamp in UTC.
checked_countnumber- How many distinct addresses were checked, after duplicates were collapsed.
invalidlist- The values that were not IP addresses.
invalid_countnumber- How many values were not IP addresses at all.
list_age_minutesnumber- How many minutes ago that was. The list rebuilds about every 30.
list_is_staletrue/false- True when the list has not been rebuilt for three hours, which is far longer than usual. The answer is still the best one available; this is there so a workflow can notice and say so.
list_updated_attext- When the Tor Project last rebuilt the exit list, as an ISO 8601 timestamp in UTC.
not_covered_countnumber- How many the list cannot answer for, which today means IPv6 addresses.
not_covered_ipslist- The addresses the list cannot answer for.
not_listed_countnumber- How many are not on the list.
resultslist- One row per address, in the order given.
tor_exit_countnumber- How many of them are Tor exit nodes.
tor_exit_ipslist- Just the addresses that are Tor exit nodes, ready to pass to the next step.
Example output
{
"any_tor_exit": true,
"checked_at": "2026-09-14T00:37:50Z",
"checked_count": 2,
"invalid": [],
"invalid_count": 0,
"list_age_minutes": 41,
"list_is_stale": false,
"list_updated_at": "2026-09-13T23:56:04Z",
"not_covered_count": 0,
"not_covered_ips": [],
"not_listed_count": 1,
"results": [
{
"answer": "tor_exit",
"exonerator_url": "https://metrics.torproject.org/exonerator.html?ip=171.25.193.25×tamp=2026-09-14",
"fingerprints": [
"64D74AAA74F30DC2CFB36343CE5D4451B9A4DBA8"
],
"ip_address": "171.25.193.25",
"is_private_address": false,
"is_tor_exit": true,
"last_confirmed": "2026-09-13T23:21:57Z",
"note": null,
"relay_count": 1
},
{
"answer": "not_listed",
"exonerator_url": "https://metrics.torproject.org/exonerator.html?ip=1.1.1.1×tamp=2026-09-14",
"fingerprints": [],
"ip_address": "1.1.1.1",
"is_private_address": false,
"is_tor_exit": false,
"last_confirmed": null,
"note": null,
"relay_count": 0
}
],
"tor_exit_count": 1,
"tor_exit_ips": [
"171.25.193.25"
]
}Export the exit list
Write the current exit addresses out as text you can put somewhere else: a plain list of one address per line to paste into a firewall, a WAF rule or a deny list, or a spreadsheet with how many relays run at each address and when it was last confirmed. Narrow it to a range first if you only care about part of the network. No API key required.
Inputs
- Write it as
export_formattext - A plain list is one address per line and nothing else, for pasting into a rule. A spreadsheet adds the relay count, when the address was last confirmed, and the fingerprints behind it.One of:
lines(Plain list (one address per line)),csv(Spreadsheet (CSV)). Default:lines. - Address or network
networktext - Only addresses inside this range. Takes one address (171.25.193.25) or a network in CIDR notation (171.25.193.0/24), so you can ask whether any exit runs inside a range you care about. Leave it empty for the whole list.
- Maximum addresses
limitnumber - How many addresses to write. The default is above the size of the whole list, so it exports all of them unless you narrow it.From 1 to 20000. Default:
5000.
Outputs
checked_attext- When this step ran, as an ISO 8601 timestamp in UTC.
columnslist- The column names, in order, for a spreadsheet export. Empty for a plain list.
contenttext- The exported text, ready to write to a file, attach to a ticket or paste into a rule.
countnumber- How many entries came back in this answer.
filenametext- A suggested file name, dated so two exports do not overwrite each other.
formattext- 'lines' for one address per line, 'csv' for the spreadsheet.
list_age_minutesnumber- How many minutes ago that was. The list rebuilds about every 30.
list_is_staletrue/false- True when the list has not been rebuilt for three hours, which is far longer than usual. The answer is still the best one available; this is there so a workflow can notice and say so.
list_updated_attext- When the Tor Project last rebuilt the exit list, as an ISO 8601 timestamp in UTC.
source_urltext- The published file this answer was read from.
total_countnumber- How many entries matched in total, before the limit was applied.
truncatedtrue/false- True when more entries matched than were returned. Raise the limit or page through with Skip to see the rest.
Example output
{
"checked_at": "2026-09-14T00:37:50Z",
"columns": [],
"content": "171.25.193.20\n171.25.193.25\n185.220.101.1",
"count": 3,
"filename": "tor-exit-ips-2026-09-14.txt",
"format": "lines",
"list_age_minutes": 41,
"list_is_stale": false,
"list_updated_at": "2026-09-13T23:56:04Z",
"source_url": "https://check.torproject.org/torbulkexitlist",
"total_count": 1325,
"truncated": true
}Get an exit relay
Look up one exit relay by its fingerprint and get every address it exits from, when it published its descriptor, when it was last confirmed, and links to its Tor Metrics page. Use it after a check to pull the detail on the relay behind an address, or to see whether a relay you were told about is still exiting. A fingerprint that is not on the current list is reported as such, with a link to its history. No API key required.
Inputs
- Relay fingerprint
fingerprinttextRequired - The 40-character fingerprint that identifies the relay. Upper or lower case both work, and a leading '$' is fine.
Outputs
checked_attext- When this step ran, as an ISO 8601 timestamp in UTC.
exit_addresstext- The address this relay exits from. A relay almost always has one; the full set is in exit_addresses.
exit_address_countnumber- How many addresses that is.
exit_addresseslist- Every address this relay was seen exiting from.
exonerator_urltext- A link to ExoneraTor, the Tor Project's own page for checking whether an address was running a Tor relay on a given day. The link to put in a ticket when someone disputes a block.
fingerprinttext- The relay's fingerprint: 40 hexadecimal characters that identify it, for example '64D74AAA74F30DC2CFB36343CE5D4451B9A4DBA8'.
last_confirmedtext- When traffic was last confirmed leaving this relay at this address, as an ISO 8601 timestamp in UTC. The freshest evidence there is that the address is a live exit.
last_statustext- When the relay was last listed in the Tor network consensus, as an ISO 8601 timestamp in UTC.
list_age_minutesnumber- How many minutes ago that was. The list rebuilds about every 30.
list_is_staletrue/false- True when the list has not been rebuilt for three hours, which is far longer than usual. The answer is still the best one available; this is there so a workflow can notice and say so.
list_updated_attext- When the Tor Project last rebuilt the exit list, as an ISO 8601 timestamp in UTC.
minutes_since_last_confirmednumber- How many minutes ago that was.
publishedtext- When the relay last published its descriptor, as an ISO 8601 timestamp in UTC.
relay_urltext- This relay's page on Tor Metrics.
Example output
{
"checked_at": "2026-09-14T00:37:50Z",
"exit_address": "171.25.193.25",
"exit_address_count": 1,
"exit_addresses": [
"171.25.193.25"
],
"exonerator_url": "https://metrics.torproject.org/exonerator.html?ip=171.25.193.25×tamp=2026-09-14",
"fingerprint": "64D74AAA74F30DC2CFB36343CE5D4451B9A4DBA8",
"last_confirmed": "2026-09-13T23:21:57Z",
"last_status": "2026-09-13T23:00:00Z",
"list_age_minutes": 41,
"list_is_stale": false,
"list_updated_at": "2026-09-13T23:56:04Z",
"minutes_since_last_confirmed": 41,
"published": "2026-09-13T16:50:20Z",
"relay_url": "https://metrics.torproject.org/rs.html#details/64D74AAA74F30DC2CFB36343CE5D4451B9A4DBA8"
}Get exit list details
Read how big the current exit list is and how fresh: how many relays and how many addresses it holds, how many addresses several relays share, when the Tor Project last rebuilt it and how long ago that was, and which kinds of address it covers. Run it to see the shape of the network before filtering, or as the one-step check that the connection works. No API key required.
Inputs
None.
Outputs
checked_attext- When this step ran, as an ISO 8601 timestamp in UTC.
exit_ip_countnumber- How many distinct IP addresses they exit from. Always the smaller number, because relays share machines.
ip_versions_coveredlist- Which kinds of address the list records. Today that is IPv4 only, which is why an IPv6 address cannot be answered for.
list_age_minutesnumber- How many minutes ago that was. The list rebuilds about every 30.
list_is_staletrue/false- True when the list has not been rebuilt for three hours, which is far longer than usual. The answer is still the best one available; this is there so a workflow can notice and say so.
list_updated_attext- When the Tor Project last rebuilt the exit list, as an ISO 8601 timestamp in UTC.
multi_address_relay_countnumber- How many relays were seen exiting from more than one address.
newest_confirmationtext- The newest one.
oldest_confirmationtext- The oldest 'last confirmed' time on the list, as an ISO 8601 timestamp in UTC.
rebuilds_about_every_minutesnumber- How often the Tor Project rebuilds the list, in minutes. There is nothing to gain from reading it more often than this.
relay_countnumber- How many exit relays are on the list.
shared_ip_countnumber- How many of those addresses have more than one relay behind them.
source_urltext- The published file this answer was read from.
Example output
{
"checked_at": "2026-09-14T00:37:50Z",
"exit_ip_count": 1325,
"ip_versions_covered": [
"IPv4"
],
"list_age_minutes": 41,
"list_is_stale": false,
"list_updated_at": "2026-09-13T23:56:04Z",
"multi_address_relay_count": 22,
"newest_confirmation": "2026-09-13T23:52:56Z",
"oldest_confirmation": "2026-09-12T02:49:36Z",
"rebuilds_about_every_minutes": 30,
"relay_count": 3186,
"shared_ip_count": 454,
"source_url": "https://check.torproject.org/exit-addresses"
}List exit IP addresses
Get the current Tor exit addresses, in numeric order and nothing else attached. This is the blocklist feed: run it on a schedule to keep a firewall rule, a WAF list or a risk table in step with the network. Narrow it to one address or one CIDR range to ask whether any exit runs inside it. Every answer says how many matched in total, so a capped page never reads as the whole list. No API key required.
Inputs
- Address or network
networktext - Only addresses inside this range. Takes one address (171.25.193.25) or a network in CIDR notation (171.25.193.0/24), so you can ask whether any exit runs inside a range you care about. Leave it empty for the whole list.
- Maximum results
limitnumber - How many addresses to return. There are roughly 1,300 exit addresses at any time, so raise this above that to get all of them in one step.From 1 to 5000. Default:
100. - Skip
offsetnumber - How many matching entries to skip before returning any, for reading a long list a page at a time. Leave it at 0 for the first page.From 0 to 100000. Default:
0.
Outputs
all_exit_ip_countnumber- How many exit addresses there are altogether, before any filter.
checked_attext- When this step ran, as an ISO 8601 timestamp in UTC.
countnumber- How many entries came back in this answer.
exit_ipslist- The exit addresses, lowest to highest, one entry per address however many relays share it.
list_age_minutesnumber- How many minutes ago that was. The list rebuilds about every 30.
list_is_staletrue/false- True when the list has not been rebuilt for three hours, which is far longer than usual. The answer is still the best one available; this is there so a workflow can notice and say so.
list_updated_attext- When the Tor Project last rebuilt the exit list, as an ISO 8601 timestamp in UTC.
source_urltext- The published file this answer was read from.
total_countnumber- How many entries matched in total, before the limit was applied.
truncatedtrue/false- True when more entries matched than were returned. Raise the limit or page through with Skip to see the rest.
Example output
{
"all_exit_ip_count": 1325,
"checked_at": "2026-09-14T00:37:50Z",
"count": 3,
"exit_ips": [
"171.25.193.20",
"171.25.193.25",
"185.220.101.1"
],
"list_age_minutes": 41,
"list_is_stale": false,
"list_updated_at": "2026-09-13T23:56:04Z",
"source_url": "https://check.torproject.org/torbulkexitlist",
"total_count": 1325,
"truncated": true
}List exit relays
List the exit relays themselves rather than just their addresses: the fingerprint that identifies each one, every address it exits from, and when it was last confirmed. There are more relays than addresses, because several relays commonly share one machine. Narrow to an address or a CIDR range, or to the relays confirmed since a moment you give, and order the list either way round. Use it to investigate an address or to watch what has appeared since your last run. No API key required.
Inputs
- Address or network
networktext - Only addresses inside this range. Takes one address (171.25.193.25) or a network in CIDR notation (171.25.193.0/24), so you can ask whether any exit runs inside a range you care about. Leave it empty for the whole list.
- Confirmed since
confirmed_sincedate and time - Only relays last confirmed at this moment or later. Set it to your last run to see what has appeared since. Leave it empty for every relay on the list.
- Order by
sorttext - How to order the relays. Most recently confirmed first by default.One of:
last_seen_desc(Last confirmed (most recent first)),last_seen_asc(Last confirmed (oldest first)),address_asc(Exit address),fingerprint_asc(Fingerprint (A to Z)). Default:last_seen_desc. - Maximum results
limitnumber - How many relays to return. The answer also carries the total number that matched, so a capped list never reads as a complete one.From 1 to 2000. Default:
50. - Skip
offsetnumber - How many matching entries to skip before returning any, for reading a long list a page at a time. Leave it at 0 for the first page.From 0 to 100000. Default:
0.
Outputs
all_relay_countnumber- How many exit relays there are altogether, before any filter.
checked_attext- When this step ran, as an ISO 8601 timestamp in UTC.
countnumber- How many entries came back in this answer.
list_age_minutesnumber- How many minutes ago that was. The list rebuilds about every 30.
list_is_staletrue/false- True when the list has not been rebuilt for three hours, which is far longer than usual. The answer is still the best one available; this is there so a workflow can notice and say so.
list_updated_attext- When the Tor Project last rebuilt the exit list, as an ISO 8601 timestamp in UTC.
relayslist- The matching exit relays.
sorttext- The order the relays came back in.
total_countnumber- How many entries matched in total, before the limit was applied.
truncatedtrue/false- True when more entries matched than were returned. Raise the limit or page through with Skip to see the rest.
Example output
{
"all_relay_count": 3186,
"checked_at": "2026-09-14T00:37:50Z",
"count": 1,
"list_age_minutes": 41,
"list_is_stale": false,
"list_updated_at": "2026-09-13T23:56:04Z",
"relays": [
{
"exit_address": "171.25.193.25",
"exit_address_count": 1,
"exit_addresses": [
"171.25.193.25"
],
"exonerator_url": "https://metrics.torproject.org/exonerator.html?ip=171.25.193.25×tamp=2026-09-14",
"fingerprint": "64D74AAA74F30DC2CFB36343CE5D4451B9A4DBA8",
"last_confirmed": "2026-09-13T23:21:57Z",
"last_status": "2026-09-13T23:00:00Z",
"minutes_since_last_confirmed": 41,
"published": "2026-09-13T16:50:20Z",
"relay_url": "https://metrics.torproject.org/rs.html#details/64D74AAA74F30DC2CFB36343CE5D4451B9A4DBA8"
}
],
"sort": "last_seen_desc",
"total_count": 3186,
"truncated": true
}List exits that can reach your service
Every Tor relay publishes which destinations it will carry traffic to, and most of them will not carry all of it. This lists the exits that are actually allowed to connect to one address and port (your web server on 443, your mail server on 25) which is usually a much smaller list than every exit there is. Use it to block only the exits that could ever reach you, and to see what share of the network that is before you decide to block at all. No API key required.
Inputs
- Your service's IP address
destination_iptextRequired - The public IPv4 address your service is reached on. The Tor Project answers this without being told who is asking, and does not log it.
- Port
destination_portnumber - The port your service listens on. 443 for HTTPS, 80 for HTTP, 25 for mail. It matters: most exits allow web traffic and only a few allow mail.From 1 to 65535. Default:
443. - Maximum results
limitnumber - How many exit addresses to return. Raise it above 1,300 to get every one that qualifies.From 1 to 5000. Default:
100. - Skip
offsetnumber - How many matching entries to skip before returning any, for reading a long list a page at a time. Leave it at 0 for the first page.From 0 to 100000. Default:
0.
Outputs
all_exit_ip_countnumber- How many exit addresses there are altogether, so the answer can be read as a share of the network.
checked_attext- When this step ran, as an ISO 8601 timestamp in UTC.
countnumber- How many entries came back in this answer.
destination_iptext- The address that was asked about.
destination_portnumber- The port that was asked about.
exit_ipslist- Just the addresses from the rows above, ready to pass to a firewall step.
exitslist- One row per exit address allowed to reach the destination, lowest address first.
list_age_minutesnumber- How many minutes ago that was. The list rebuilds about every 30.
list_is_staletrue/false- True when the list has not been rebuilt for three hours, which is far longer than usual. The answer is still the best one available; this is there so a workflow can notice and say so.
list_updated_attext- When the Tor Project last rebuilt the exit list, as an ISO 8601 timestamp in UTC.
summarytext- The answer in one sentence, including what share of all exits it is.
total_countnumber- How many entries matched in total, before the limit was applied.
truncatedtrue/false- True when more entries matched than were returned. Raise the limit or page through with Skip to see the rest.
Example output
{
"all_exit_ip_count": 1325,
"checked_at": "2026-09-14T00:37:50Z",
"count": 1,
"destination_ip": "1.1.1.1",
"destination_port": 443,
"exit_ips": [
"171.25.193.25"
],
"exits": [
{
"exit_address": "171.25.193.25",
"fingerprints": [
"64D74AAA74F30DC2CFB36343CE5D4451B9A4DBA8"
],
"relay_count": 1
}
],
"list_age_minutes": 41,
"list_is_stale": false,
"list_updated_at": "2026-09-13T23:56:04Z",
"summary": "1230 of the 1325 Tor exit addresses allow connections to 1.1.1.1 on port 443 \u2014 about 93% of the network.",
"total_count": 1230,
"truncated": true
}