How to Use Monero Over Tor and I2P: Wallets and Nodes

Monero’s cryptography hides who paid whom and how much, but it does nothing about the network connection your wallet uses to talk to the world. Your IP address is the single most useful piece of data a chain-surveillance company can collect about a Monero user. Tor and I2P remove it. This guide covers three levels of setup, from a two-minute wallet tweak to a node that only exists as a hidden service.

Why IP privacy matters even with Monero

When your wallet syncs or sends a transaction, it opens a network connection to a node. Whoever runs that node, or watches the network around it, can see:

• The IP address the connection came from
• When it happened
• Which transaction was pushed out first from that connection

No amount of ring signatures fixes that, because it happens below the blockchain layer. Tor and I2P route your traffic through several relays so that the node sees a relay, not you.

Key point: Monero protects your on-chain data. Tor and I2P protect your network data. You need both for strong privacy.

Tor vs I2P for Monero

You don’t have to choose just one. The official Monero docs document both side by side, and many node operators run both.

Level 1: Route your wallet through Tor

This hides your IP from whatever node your wallet uses. It takes a few minutes.

Feather Wallet (desktop)

Feather bundles its own Tor binary, so there is nothing to install. If it doesn’t find a Tor daemon on port 9050, it starts its own. Under Settings → Network → Proxy you can choose between:

• Never over Tor
• Switch to Tor after initial synchronization (the default)
• Always over Tor

The default is a sensible compromise: the bulky first sync runs over clearnet, and everything after it, including broadcasts, goes over Tor. Pick “Always over Tor” if you don’t want even the first sync tied to your IP. On Tails or Whonix, Feather sends all traffic through Tor whatever the setting.

Cake Wallet (mobile and desktop)

Cake Wallet has a built-in Tor option under Settings → App settings → Connections → Enable built-in Tor. Cake labels it experimental: startup is slower, syncing is much slower than clearnet, and some third-party services such as fiat on-ramps may refuse Tor connections. Once it’s enabled, you can select Cake’s onion node. After updating to v6.5.0 or later, reselect the “Cake Wallet (Tor)” node, because its onion address changed.

Monero GUI

1. Install and start Tor (the Tor daemon, or keep Tor Browser open).
2. In the GUI, open Settings → Interface and set the SOCKS5 proxy to 127.0.0.1 port 9050 (use 9150 if you rely on Tor Browser).
3. Go to Settings → Node, choose a remote node, and enter a .onion address with port 18089.

Monero CLI

monero-wallet-cli --proxy=127.0.0.1:9050 \
  --daemon-address=http://youronionaddress.onion:18089

Only add --trusted-daemon if the onion belongs to a node you operate. A trusted daemon gets extra privileges, such as being relied on for some data your wallet would otherwise double-check.

Tip: Prefer .onion or .b32.i2p node addresses over normal IP nodes reached through Tor. Hidden-service connections are end-to-end encrypted and never leave the anonymity network. Clearnet traffic through a Tor exit relay can be watched or tampered with by the exit operator.

Level 2: Broadcast your node’s transactions over Tor or I2P

If you already run monerod, this is the most valuable single change you can make. The --tx-proxy option sends transactions you create through a SOCKS proxy to peers on Tor or I2P, while blocks keep syncing over clearnet for speed.

Step-by-step (Tor)

1. Install the Tor daemon from your distribution or the Tor Project’s repository and confirm it listens on 127.0.0.1:9050.
2. Add this line to your monerod config file (often bitmonero.conf):

tx-proxy=tor,127.0.0.1:9050,disable_noise

3. Restart monerod.
4. Point your wallet at your local node (127.0.0.1:18081). Traffic from wallet to node stays on your machine, so it doesn’t need Tor.

Step-by-step (I2P with i2pd)

1. Install i2pd and make sure its SOCKS proxy is running on 127.0.0.1:4447.
2. Add to your config:

tx-proxy=i2p,127.0.0.1:4447,disable_noise

3. Restart monerod. I2P can take several minutes to build tunnels on first start, so be patient.

What disable_noise does

By default, tx-proxy uses “noise”, meaning padding and randomized timing that make it harder for an observer of your connection to spot when you actually sent something. According to the monerod reference, the disable_noise flag makes transactions get fluffed to onion and I2P peers faster. The official setup guide uses it. If you care more about resisting traffic analysis than about speed, leave it off.

Note: tx-proxy only covers transactions that originate from your node. Transactions your node forwards for other people still travel over clearnet with Dandelion++. That is by design.

Going further: —proxy

--proxy sends all of monerod’s outbound clearnet traffic through a SOCKS proxy. It is slower, it relies on Tor exit relays, and it doesn’t use hidden services for P2P. Most people are better served by --tx-proxy plus an anonymity-network inbound address. Since release 0.18.5.0 in May 2026, the daemon and wallet support SOCKS5, which makes these proxy setups easier to combine with modern Tor and I2P software.

Level 3: Make your node reachable as a hidden service

A hidden service gives your node a .onion or .b32.i2p address. Two benefits:

• Your phone or laptop can connect to your home node from anywhere without you opening router ports or revealing your home IP.
• Other Monero nodes can relay transactions to you over Tor or I2P, which strengthens the anonymity network for everyone.

Tor hidden service

1. Add a hidden service to /etc/tor/torrc:

HiddenServiceDir /var/lib/tor/monero/
HiddenServicePort 18089 127.0.0.1:18089
HiddenServicePort 18084 127.0.0.1:18084

2. Restart Tor and read your new address from /var/lib/tor/monero/hostname.
3. Make sure monerod serves a restricted RPC on port 18089 (for example with rpc-restricted-bind-port=18089) so remote wallets can’t use admin methods.
4. Add the inbound line to your monerod config, using your real onion address:

anonymous-inbound=youronionaddress.onion:18084,127.0.0.1:18084

5. Restart monerod and test from another machine:

curl -x socks5h://127.0.0.1:9050 http://youronionaddress.onion:18089/get_info

I2P hidden service

With i2pd, create server tunnels for P2P port 18085 and RPC port 18089, restart it, and find your .b32.i2p address in the web console at 127.0.0.1:7070. Then add:

anonymous-inbound=youri2paddress.b32.i2p,127.0.0.1:18085

Warning: Back up your Tor hidden-service directory and your I2P key files. If you lose them, or change HiddenServiceDir, your node gets a new address and every wallet pointed at the old one breaks.

Common mistakes

1. Using socks5:// instead of socks5h:// in test commands. Without the “h”, DNS lookups can happen outside Tor.
2. Leaving a clearnet fallback node configured. Some wallets try other nodes if your onion node is unreachable. Check your node list.
3. Marking random nodes as trusted. Use --trusted-daemon only for your own node.
4. Opening the Monero port to the internet for a node you only use over Tor. Recent versions of monerod have dropped UPnP support, but check that your router doesn’t forward port 18080 or 18089 unless you mean it to.
5. Thinking Tor fixes everything. Tor hides your IP. It does nothing about reusing addresses, round-amount timing patterns, or withdrawing straight from a KYC exchange into a payment.

Tails and Whonix: Tor for everything

If you want every connection your wallet makes to go over Tor, without relying on per-app settings, use an operating system built for that:

• Tails is a live system that boots from a USB stick and forces all traffic through Tor. Feather runs on it, and its persistent storage can keep your wallet files between sessions. It’s a good fit for occasional, high-sensitivity use.
• Whonix runs as two virtual machines: a gateway that handles Tor and a workstation that can only reach the internet through it. Even malware in the workstation can’t learn your real IP easily. It suits people who want a permanent private setup on their everyday computer.

In both systems, a wallet syncing from a remote .onion node is the usual setup, because running a full node inside Tails isn’t practical. On Whonix, --tx-proxy is technically optional since all traffic already goes through Tor, but some operators keep it on so the noise feature still applies.

Which level should you choose?

• Just starting out: Level 1. Turn on Tor in your wallet today.
• Running a node already: Add Level 2. It’s one config line.
• Want remote access or to help the network: Add Level 3.

Even the simplest step removes the most valuable metadata your Monero wallet would otherwise leak. For the bigger picture, see the rest of our Privacy & OpSec guides, and the Wallets category if you’re still choosing a wallet.