What roles do Entry Guards and Exit Nodes play in a Tor circuit?

Entry Guards are a small, stable set of first hops that protect against de-anonymisation; Exit Nodes are the last hop that connects to the normal Internet and only ever sees the destination, not the user.

* A Tor circuit: entry guard, middle relay, exit node. — Electronic Frontier Foundation, CC BY 3.0, via Wikimedia Commons. *

Entry Guards (Eingangsknoten): act as "guardians" at the start of the circuit. Crucially, Tor assigns each user a small, fixed set of guards rather than picking a random first hop every time. This prevents de-anonymisation attacks: if first hops were random, an attacker running many relays would eventually be chosen as someone's entry and exit and could correlate them. Sticking to a few stable guards drastically lowers that probability.

Exit Nodes (Ausgangsknoten): form the exit from the Tor network and connect to the normal Internet. The exit node knows the destination and sees the (now decrypted) traffic, but it only knows the previous relay in the chain — not the original user — so identifying the user stays hard.

Tip: Guard at the front protects who you are; exit at the back is where you re-enter the open web (and the riskiest point — see exit-node dangers).

Go deeper:

• How is Tor different from other proxies? (Tor Project) — why no single relay sees both ends.