Tor Exit List

App · Compliance & Security · 8 actions

Tell whether an IP address is a Tor exit node, using the list the Tor Project publishes and rebuilds about every half hour. Check one address or a whole batch from your logs, pull the current addresses to keep a firewall or WAF blocklist in step, look up the relays behind an address, and see which exits are even allowed to reach your service before you decide to block anything. Every result carries the Tor Project's own ExoneraTor link, for the ticket where someone disputes a block. No account or API key required.

Actions

ActionWhat it does
Check an IP addressCheck whether one IP address is a Tor exit node, against the list the Tor Project rebuilds about every half hour.
Check several IP addressesCheck a batch of IP addresses at once and get them sorted into what they turned out to be.
Export the exit listWrite the current exit addresses out as text you can put somewhere else: a plain list of one address per line to paste into a firewall, a WAF rule or a deny list, or a spreadsheet with how many relays run at each address and when it was last confirmed.
Get an exit relayLook up one exit relay by its fingerprint and get every address it exits from, when it published its descriptor, when it was last confirmed, and links to its Tor Metrics page.
Get exit list detailsRead how big the current exit list is and how fresh: how many relays and how many addresses it holds, how many addresses several relays share, when the Tor Project last rebuilt it and how long ago that was, and which kinds of address it covers.
List exit IP addressesGet the current Tor exit addresses, in numeric order and nothing else attached.
List exit relaysList the exit relays themselves rather than just their addresses: the fingerprint that identifies each one, every address it exits from, and when it was last confirmed.
List exits that can reach your serviceEvery Tor relay publishes which destinations it will carry traffic to, and most of them will not carry all of it.

Check an IP address

Check whether one IP address is a Tor exit node, against the list the Tor Project rebuilds about every half hour. Use it to score a sign-up, gate a login, flag an order for review or add context to a support ticket. A match comes back with the relays running at the address, when traffic was last confirmed leaving them, and a link to the Tor Project's own ExoneraTor page to put in a ticket. The list covers IPv4, so an IPv6 address is refused with that explanation rather than told it is not Tor. No API key required.

Inputs

IP addressip_addresstextRequired
The address to check. Use the public address the visitor connected from; if your app sits behind a proxy or load balancer, that is the forwarded address, not the one your server sees.

Outputs

answertext
'tor_exit' when the address is a Tor exit node, 'not_listed' when it is not on the list, and 'not_covered' when the list does not cover addresses of that kind at all, which today means IPv6.
checked_attext
When this step ran, as an ISO 8601 timestamp in UTC.
exonerator_urltext
A link to ExoneraTor, the Tor Project's own page for checking whether an address was running a Tor relay on a given day. The link to put in a ticket when someone disputes a block.
fingerprintslist
The fingerprints of the relays running at this address.
ip_addresstext
The address that was checked.
is_private_addresstrue/false
True for a private or reserved address such as 10.0.0.5 or 127.0.0.1. Those can never be Tor exits, so a true here usually means a proxy's own address was checked rather than the visitor's.
is_tor_exittrue/false
True when the address is on the current Tor exit list. Only ever true or false about what the list holds; read 'answer' when you need to tell 'not a Tor exit' apart from 'the list cannot say'.
last_confirmedtext
When traffic was last confirmed leaving this address, as an ISO 8601 timestamp in UTC. Empty when the address is not a Tor exit.
list_age_minutesnumber
How many minutes ago that was. The list rebuilds about every 30.
list_is_staletrue/false
True when the list has not been rebuilt for three hours, which is far longer than usual. The answer is still the best one available; this is there so a workflow can notice and say so.
list_updated_attext
When the Tor Project last rebuilt the exit list, as an ISO 8601 timestamp in UTC.
minutes_since_last_confirmednumber
How many minutes ago that was.
relay_countnumber
How many exit relays run at this address. Several relays commonly share one address.
relayslist
The matching exit relays.
summarytext
The answer in one sentence, ready to put in a message or a ticket.
Example output
{
  "answer": "tor_exit",
  "checked_at": "2026-09-14T00:37:50Z",
  "exonerator_url": "https://metrics.torproject.org/exonerator.html?ip=171.25.193.25&timestamp=2026-09-14",
  "fingerprints": [
    "64D74AAA74F30DC2CFB36343CE5D4451B9A4DBA8"
  ],
  "ip_address": "171.25.193.25",
  "is_private_address": false,
  "is_tor_exit": true,
  "last_confirmed": "2026-09-13T23:21:57Z",
  "list_age_minutes": 41,
  "list_is_stale": false,
  "list_updated_at": "2026-09-13T23:56:04Z",
  "minutes_since_last_confirmed": 41,
  "relay_count": 1,
  "relays": [
    {
      "exit_address": "171.25.193.25",
      "exit_address_count": 1,
      "exit_addresses": [
        "171.25.193.25"
      ],
      "exonerator_url": "https://metrics.torproject.org/exonerator.html?ip=171.25.193.25&timestamp=2026-09-14",
      "fingerprint": "64D74AAA74F30DC2CFB36343CE5D4451B9A4DBA8",
      "last_confirmed": "2026-09-13T23:21:57Z",
      "last_status": "2026-09-13T23:00:00Z",
      "minutes_since_last_confirmed": 41,
      "published": "2026-09-13T16:50:20Z",
      "relay_url": "https://metrics.torproject.org/rs.html#details/64D74AAA74F30DC2CFB36343CE5D4451B9A4DBA8"
    }
  ],
  "summary": "171.25.193.25 is a Tor exit node, used by 1 relay, last confirmed 41 minutes ago."
}

Check several IP addresses

Check a batch of IP addresses at once and get them sorted into what they turned out to be. This is the action for a day's sign-ups, a list of addresses from a log, or the senders on a spike of failed logins. Every address is answered individually, and the result also carries a flat list of just the Tor ones and a single true or false for 'was any of this Tor', so a workflow can branch without counting. Duplicates are collapsed and anything that is not an IP address is reported rather than failing the step. Up to 1,000 addresses. No API key required.

Inputs

IP addressesip_addresseslistRequired
The addresses to check. Add them one at a time, or pass a list from an earlier step. Pasted text separated by commas, spaces or new lines works too.

Outputs

any_tor_exittrue/false
True when at least one address is a Tor exit node, so a workflow can branch on the batch in one step.
checked_attext
When this step ran, as an ISO 8601 timestamp in UTC.
checked_countnumber
How many distinct addresses were checked, after duplicates were collapsed.
invalidlist
The values that were not IP addresses.
invalid_countnumber
How many values were not IP addresses at all.
list_age_minutesnumber
How many minutes ago that was. The list rebuilds about every 30.
list_is_staletrue/false
True when the list has not been rebuilt for three hours, which is far longer than usual. The answer is still the best one available; this is there so a workflow can notice and say so.
list_updated_attext
When the Tor Project last rebuilt the exit list, as an ISO 8601 timestamp in UTC.
not_covered_countnumber
How many the list cannot answer for, which today means IPv6 addresses.
not_covered_ipslist
The addresses the list cannot answer for.
not_listed_countnumber
How many are not on the list.
resultslist
One row per address, in the order given.
tor_exit_countnumber
How many of them are Tor exit nodes.
tor_exit_ipslist
Just the addresses that are Tor exit nodes, ready to pass to the next step.
Example output
{
  "any_tor_exit": true,
  "checked_at": "2026-09-14T00:37:50Z",
  "checked_count": 2,
  "invalid": [],
  "invalid_count": 0,
  "list_age_minutes": 41,
  "list_is_stale": false,
  "list_updated_at": "2026-09-13T23:56:04Z",
  "not_covered_count": 0,
  "not_covered_ips": [],
  "not_listed_count": 1,
  "results": [
    {
      "answer": "tor_exit",
      "exonerator_url": "https://metrics.torproject.org/exonerator.html?ip=171.25.193.25&timestamp=2026-09-14",
      "fingerprints": [
        "64D74AAA74F30DC2CFB36343CE5D4451B9A4DBA8"
      ],
      "ip_address": "171.25.193.25",
      "is_private_address": false,
      "is_tor_exit": true,
      "last_confirmed": "2026-09-13T23:21:57Z",
      "note": null,
      "relay_count": 1
    },
    {
      "answer": "not_listed",
      "exonerator_url": "https://metrics.torproject.org/exonerator.html?ip=1.1.1.1&timestamp=2026-09-14",
      "fingerprints": [],
      "ip_address": "1.1.1.1",
      "is_private_address": false,
      "is_tor_exit": false,
      "last_confirmed": null,
      "note": null,
      "relay_count": 0
    }
  ],
  "tor_exit_count": 1,
  "tor_exit_ips": [
    "171.25.193.25"
  ]
}

Export the exit list

Write the current exit addresses out as text you can put somewhere else: a plain list of one address per line to paste into a firewall, a WAF rule or a deny list, or a spreadsheet with how many relays run at each address and when it was last confirmed. Narrow it to a range first if you only care about part of the network. No API key required.

Inputs

Write it asexport_formattext
A plain list is one address per line and nothing else, for pasting into a rule. A spreadsheet adds the relay count, when the address was last confirmed, and the fingerprints behind it.One of: lines (Plain list (one address per line)), csv (Spreadsheet (CSV)). Default: lines.
Address or networknetworktext
Only addresses inside this range. Takes one address (171.25.193.25) or a network in CIDR notation (171.25.193.0/24), so you can ask whether any exit runs inside a range you care about. Leave it empty for the whole list.
Maximum addresseslimitnumber
How many addresses to write. The default is above the size of the whole list, so it exports all of them unless you narrow it.From 1 to 20000. Default: 5000.

Outputs

checked_attext
When this step ran, as an ISO 8601 timestamp in UTC.
columnslist
The column names, in order, for a spreadsheet export. Empty for a plain list.
contenttext
The exported text, ready to write to a file, attach to a ticket or paste into a rule.
countnumber
How many entries came back in this answer.
filenametext
A suggested file name, dated so two exports do not overwrite each other.
formattext
'lines' for one address per line, 'csv' for the spreadsheet.
list_age_minutesnumber
How many minutes ago that was. The list rebuilds about every 30.
list_is_staletrue/false
True when the list has not been rebuilt for three hours, which is far longer than usual. The answer is still the best one available; this is there so a workflow can notice and say so.
list_updated_attext
When the Tor Project last rebuilt the exit list, as an ISO 8601 timestamp in UTC.
source_urltext
The published file this answer was read from.
total_countnumber
How many entries matched in total, before the limit was applied.
truncatedtrue/false
True when more entries matched than were returned. Raise the limit or page through with Skip to see the rest.
Example output
{
  "checked_at": "2026-09-14T00:37:50Z",
  "columns": [],
  "content": "171.25.193.20\n171.25.193.25\n185.220.101.1",
  "count": 3,
  "filename": "tor-exit-ips-2026-09-14.txt",
  "format": "lines",
  "list_age_minutes": 41,
  "list_is_stale": false,
  "list_updated_at": "2026-09-13T23:56:04Z",
  "source_url": "https://check.torproject.org/torbulkexitlist",
  "total_count": 1325,
  "truncated": true
}

Get an exit relay

Look up one exit relay by its fingerprint and get every address it exits from, when it published its descriptor, when it was last confirmed, and links to its Tor Metrics page. Use it after a check to pull the detail on the relay behind an address, or to see whether a relay you were told about is still exiting. A fingerprint that is not on the current list is reported as such, with a link to its history. No API key required.

Inputs

Relay fingerprintfingerprinttextRequired
The 40-character fingerprint that identifies the relay. Upper or lower case both work, and a leading '$' is fine.

Outputs

checked_attext
When this step ran, as an ISO 8601 timestamp in UTC.
exit_addresstext
The address this relay exits from. A relay almost always has one; the full set is in exit_addresses.
exit_address_countnumber
How many addresses that is.
exit_addresseslist
Every address this relay was seen exiting from.
exonerator_urltext
A link to ExoneraTor, the Tor Project's own page for checking whether an address was running a Tor relay on a given day. The link to put in a ticket when someone disputes a block.
fingerprinttext
The relay's fingerprint: 40 hexadecimal characters that identify it, for example '64D74AAA74F30DC2CFB36343CE5D4451B9A4DBA8'.
last_confirmedtext
When traffic was last confirmed leaving this relay at this address, as an ISO 8601 timestamp in UTC. The freshest evidence there is that the address is a live exit.
last_statustext
When the relay was last listed in the Tor network consensus, as an ISO 8601 timestamp in UTC.
list_age_minutesnumber
How many minutes ago that was. The list rebuilds about every 30.
list_is_staletrue/false
True when the list has not been rebuilt for three hours, which is far longer than usual. The answer is still the best one available; this is there so a workflow can notice and say so.
list_updated_attext
When the Tor Project last rebuilt the exit list, as an ISO 8601 timestamp in UTC.
minutes_since_last_confirmednumber
How many minutes ago that was.
publishedtext
When the relay last published its descriptor, as an ISO 8601 timestamp in UTC.
relay_urltext
This relay's page on Tor Metrics.
Example output
{
  "checked_at": "2026-09-14T00:37:50Z",
  "exit_address": "171.25.193.25",
  "exit_address_count": 1,
  "exit_addresses": [
    "171.25.193.25"
  ],
  "exonerator_url": "https://metrics.torproject.org/exonerator.html?ip=171.25.193.25&timestamp=2026-09-14",
  "fingerprint": "64D74AAA74F30DC2CFB36343CE5D4451B9A4DBA8",
  "last_confirmed": "2026-09-13T23:21:57Z",
  "last_status": "2026-09-13T23:00:00Z",
  "list_age_minutes": 41,
  "list_is_stale": false,
  "list_updated_at": "2026-09-13T23:56:04Z",
  "minutes_since_last_confirmed": 41,
  "published": "2026-09-13T16:50:20Z",
  "relay_url": "https://metrics.torproject.org/rs.html#details/64D74AAA74F30DC2CFB36343CE5D4451B9A4DBA8"
}

Get exit list details

Read how big the current exit list is and how fresh: how many relays and how many addresses it holds, how many addresses several relays share, when the Tor Project last rebuilt it and how long ago that was, and which kinds of address it covers. Run it to see the shape of the network before filtering, or as the one-step check that the connection works. No API key required.

Inputs

None.

Outputs

checked_attext
When this step ran, as an ISO 8601 timestamp in UTC.
exit_ip_countnumber
How many distinct IP addresses they exit from. Always the smaller number, because relays share machines.
ip_versions_coveredlist
Which kinds of address the list records. Today that is IPv4 only, which is why an IPv6 address cannot be answered for.
list_age_minutesnumber
How many minutes ago that was. The list rebuilds about every 30.
list_is_staletrue/false
True when the list has not been rebuilt for three hours, which is far longer than usual. The answer is still the best one available; this is there so a workflow can notice and say so.
list_updated_attext
When the Tor Project last rebuilt the exit list, as an ISO 8601 timestamp in UTC.
multi_address_relay_countnumber
How many relays were seen exiting from more than one address.
newest_confirmationtext
The newest one.
oldest_confirmationtext
The oldest 'last confirmed' time on the list, as an ISO 8601 timestamp in UTC.
rebuilds_about_every_minutesnumber
How often the Tor Project rebuilds the list, in minutes. There is nothing to gain from reading it more often than this.
relay_countnumber
How many exit relays are on the list.
shared_ip_countnumber
How many of those addresses have more than one relay behind them.
source_urltext
The published file this answer was read from.
Example output
{
  "checked_at": "2026-09-14T00:37:50Z",
  "exit_ip_count": 1325,
  "ip_versions_covered": [
    "IPv4"
  ],
  "list_age_minutes": 41,
  "list_is_stale": false,
  "list_updated_at": "2026-09-13T23:56:04Z",
  "multi_address_relay_count": 22,
  "newest_confirmation": "2026-09-13T23:52:56Z",
  "oldest_confirmation": "2026-09-12T02:49:36Z",
  "rebuilds_about_every_minutes": 30,
  "relay_count": 3186,
  "shared_ip_count": 454,
  "source_url": "https://check.torproject.org/exit-addresses"
}

List exit IP addresses

Get the current Tor exit addresses, in numeric order and nothing else attached. This is the blocklist feed: run it on a schedule to keep a firewall rule, a WAF list or a risk table in step with the network. Narrow it to one address or one CIDR range to ask whether any exit runs inside it. Every answer says how many matched in total, so a capped page never reads as the whole list. No API key required.

Inputs

Address or networknetworktext
Only addresses inside this range. Takes one address (171.25.193.25) or a network in CIDR notation (171.25.193.0/24), so you can ask whether any exit runs inside a range you care about. Leave it empty for the whole list.
Maximum resultslimitnumber
How many addresses to return. There are roughly 1,300 exit addresses at any time, so raise this above that to get all of them in one step.From 1 to 5000. Default: 100.
Skipoffsetnumber
How many matching entries to skip before returning any, for reading a long list a page at a time. Leave it at 0 for the first page.From 0 to 100000. Default: 0.

Outputs

all_exit_ip_countnumber
How many exit addresses there are altogether, before any filter.
checked_attext
When this step ran, as an ISO 8601 timestamp in UTC.
countnumber
How many entries came back in this answer.
exit_ipslist
The exit addresses, lowest to highest, one entry per address however many relays share it.
list_age_minutesnumber
How many minutes ago that was. The list rebuilds about every 30.
list_is_staletrue/false
True when the list has not been rebuilt for three hours, which is far longer than usual. The answer is still the best one available; this is there so a workflow can notice and say so.
list_updated_attext
When the Tor Project last rebuilt the exit list, as an ISO 8601 timestamp in UTC.
source_urltext
The published file this answer was read from.
total_countnumber
How many entries matched in total, before the limit was applied.
truncatedtrue/false
True when more entries matched than were returned. Raise the limit or page through with Skip to see the rest.
Example output
{
  "all_exit_ip_count": 1325,
  "checked_at": "2026-09-14T00:37:50Z",
  "count": 3,
  "exit_ips": [
    "171.25.193.20",
    "171.25.193.25",
    "185.220.101.1"
  ],
  "list_age_minutes": 41,
  "list_is_stale": false,
  "list_updated_at": "2026-09-13T23:56:04Z",
  "source_url": "https://check.torproject.org/torbulkexitlist",
  "total_count": 1325,
  "truncated": true
}

List exit relays

List the exit relays themselves rather than just their addresses: the fingerprint that identifies each one, every address it exits from, and when it was last confirmed. There are more relays than addresses, because several relays commonly share one machine. Narrow to an address or a CIDR range, or to the relays confirmed since a moment you give, and order the list either way round. Use it to investigate an address or to watch what has appeared since your last run. No API key required.

Inputs

Address or networknetworktext
Only addresses inside this range. Takes one address (171.25.193.25) or a network in CIDR notation (171.25.193.0/24), so you can ask whether any exit runs inside a range you care about. Leave it empty for the whole list.
Confirmed sinceconfirmed_sincedate and time
Only relays last confirmed at this moment or later. Set it to your last run to see what has appeared since. Leave it empty for every relay on the list.
Order bysorttext
How to order the relays. Most recently confirmed first by default.One of: last_seen_desc (Last confirmed (most recent first)), last_seen_asc (Last confirmed (oldest first)), address_asc (Exit address), fingerprint_asc (Fingerprint (A to Z)). Default: last_seen_desc.
Maximum resultslimitnumber
How many relays to return. The answer also carries the total number that matched, so a capped list never reads as a complete one.From 1 to 2000. Default: 50.
Skipoffsetnumber
How many matching entries to skip before returning any, for reading a long list a page at a time. Leave it at 0 for the first page.From 0 to 100000. Default: 0.

Outputs

all_relay_countnumber
How many exit relays there are altogether, before any filter.
checked_attext
When this step ran, as an ISO 8601 timestamp in UTC.
countnumber
How many entries came back in this answer.
list_age_minutesnumber
How many minutes ago that was. The list rebuilds about every 30.
list_is_staletrue/false
True when the list has not been rebuilt for three hours, which is far longer than usual. The answer is still the best one available; this is there so a workflow can notice and say so.
list_updated_attext
When the Tor Project last rebuilt the exit list, as an ISO 8601 timestamp in UTC.
relayslist
The matching exit relays.
sorttext
The order the relays came back in.
total_countnumber
How many entries matched in total, before the limit was applied.
truncatedtrue/false
True when more entries matched than were returned. Raise the limit or page through with Skip to see the rest.
Example output
{
  "all_relay_count": 3186,
  "checked_at": "2026-09-14T00:37:50Z",
  "count": 1,
  "list_age_minutes": 41,
  "list_is_stale": false,
  "list_updated_at": "2026-09-13T23:56:04Z",
  "relays": [
    {
      "exit_address": "171.25.193.25",
      "exit_address_count": 1,
      "exit_addresses": [
        "171.25.193.25"
      ],
      "exonerator_url": "https://metrics.torproject.org/exonerator.html?ip=171.25.193.25&timestamp=2026-09-14",
      "fingerprint": "64D74AAA74F30DC2CFB36343CE5D4451B9A4DBA8",
      "last_confirmed": "2026-09-13T23:21:57Z",
      "last_status": "2026-09-13T23:00:00Z",
      "minutes_since_last_confirmed": 41,
      "published": "2026-09-13T16:50:20Z",
      "relay_url": "https://metrics.torproject.org/rs.html#details/64D74AAA74F30DC2CFB36343CE5D4451B9A4DBA8"
    }
  ],
  "sort": "last_seen_desc",
  "total_count": 3186,
  "truncated": true
}

List exits that can reach your service

Every Tor relay publishes which destinations it will carry traffic to, and most of them will not carry all of it. This lists the exits that are actually allowed to connect to one address and port (your web server on 443, your mail server on 25) which is usually a much smaller list than every exit there is. Use it to block only the exits that could ever reach you, and to see what share of the network that is before you decide to block at all. No API key required.

Inputs

Your service's IP addressdestination_iptextRequired
The public IPv4 address your service is reached on. The Tor Project answers this without being told who is asking, and does not log it.
Portdestination_portnumber
The port your service listens on. 443 for HTTPS, 80 for HTTP, 25 for mail. It matters: most exits allow web traffic and only a few allow mail.From 1 to 65535. Default: 443.
Maximum resultslimitnumber
How many exit addresses to return. Raise it above 1,300 to get every one that qualifies.From 1 to 5000. Default: 100.
Skipoffsetnumber
How many matching entries to skip before returning any, for reading a long list a page at a time. Leave it at 0 for the first page.From 0 to 100000. Default: 0.

Outputs

all_exit_ip_countnumber
How many exit addresses there are altogether, so the answer can be read as a share of the network.
checked_attext
When this step ran, as an ISO 8601 timestamp in UTC.
countnumber
How many entries came back in this answer.
destination_iptext
The address that was asked about.
destination_portnumber
The port that was asked about.
exit_ipslist
Just the addresses from the rows above, ready to pass to a firewall step.
exitslist
One row per exit address allowed to reach the destination, lowest address first.
list_age_minutesnumber
How many minutes ago that was. The list rebuilds about every 30.
list_is_staletrue/false
True when the list has not been rebuilt for three hours, which is far longer than usual. The answer is still the best one available; this is there so a workflow can notice and say so.
list_updated_attext
When the Tor Project last rebuilt the exit list, as an ISO 8601 timestamp in UTC.
summarytext
The answer in one sentence, including what share of all exits it is.
total_countnumber
How many entries matched in total, before the limit was applied.
truncatedtrue/false
True when more entries matched than were returned. Raise the limit or page through with Skip to see the rest.
Example output
{
  "all_exit_ip_count": 1325,
  "checked_at": "2026-09-14T00:37:50Z",
  "count": 1,
  "destination_ip": "1.1.1.1",
  "destination_port": 443,
  "exit_ips": [
    "171.25.193.25"
  ],
  "exits": [
    {
      "exit_address": "171.25.193.25",
      "fingerprints": [
        "64D74AAA74F30DC2CFB36343CE5D4451B9A4DBA8"
      ],
      "relay_count": 1
    }
  ],
  "list_age_minutes": 41,
  "list_is_stale": false,
  "list_updated_at": "2026-09-13T23:56:04Z",
  "summary": "1230 of the 1325 Tor exit addresses allow connections to 1.1.1.1 on port 443 \u2014 about 93% of the network.",
  "total_count": 1230,
  "truncated": true
}

On this page