Reading Tor Metrics graphs: what the curves actually count
Every few weeks a Tor Metrics screenshot goes viral, usually framed as proof that anonymity is booming, dying, or about to collapse. The graphs are genuinely public, updated daily and released under CC0. But almost nothing on that portal is a raw count.
User numbers are modeled, not measured
The Tor Project is explicit about this: in an anonymity network you cannot collect identifying data, so nobody counts users directly. Instead, relays tally the directory requests clients make to refresh their list of running relays, and those tallies feed an indirect estimate, as the project's own documentation explains (Tor Project support portal). The published figure is an average number of concurrent clients per day, derived from data collected over twenty-four hours. It is best understood as user-days, not people. Two browsers left running around the clock still register as roughly two daily users, while someone who opens Tor Browser once for ten minutes barely moves the needle.The magic number ten
The conversion rule is disarmingly crude: divide daily directory requests by ten. The assumption is that a client connected all day would make about fifteen requests, but typical users are online far less, so ten became the divisor. In effect, each request represents a client assumed to stay online for 2 hours 24 minutes.Not really a count of users, but of user-days.That framing comes from researcher David Fifield's calibration work presented at PETS 2023, which compared the model against ground truth on real bridges (bamsoftware.com). His measurements suggest the constant of ten is effectively arbitrary: for some Snowflake bridges the formula over-predicted connected sockets by a factor of 1.5 to 2. Small wonder the curves wobble.
Relay counts and bandwidth have their own quirks
Relay and bandwidth graphs come from different plumbing. Relays self-report an observed bandwidth, the maximum traffic they sustained in any ten-second window over recent days, capped at 10 MB/s when the consensus is built. Independent bandwidth scanners then re-measure relays so directory authorities can weight circuit selection, a pipeline documented by the network health team (bandwidth scanner documentation). Both layers can mislead. Observed bandwidth reflects what a relay recently carried, not what it could carry, so idle hardware looks weak. Research on FlashFlow has argued that legacy measurement methods underestimate true relay capacity substantially, meaning total-network bandwidth graphs likely undersell the network rather than flatter it.Censorship makes the blind spots political
The biggest distortion is structural: whatever a censor blocks simply vanishes from the relevant curve. When a country throttles direct connections, its users migrate to bridges, and the direct-user graph for that country plummets even if actual usage is rising. Bridge-user estimates rest on separate directory requests counted at the bridges themselves, a method laid out in the Tor Project's technical report on counting daily bridge users (research.torproject.org). Country attribution adds another layer of guesswork, since it infers geography from IP addresses viewed through the distorting lens of VPNs, proxies and address reassignments. Treat per-country spikes as hypotheses, never as verified migration stories. For context on how censorship events shape connectivity, see our tor network notes.A field guide to staying honest
None of this makes Tor Metrics useless. It remains the most transparent measurement effort of any large anonymity network, and trends over weeks matter more than any single point. A few habits keep interpretation grounded:- Read multi-month trends, not day-to-day noise.
- Check whether an event line accompanies a sudden jump before narrating causes.
- Compare direct-user and bridge-user graphs for the same country during crackdowns.
- Quote figures as estimates of average concurrent clients, never as headcounts.