obfs4, Snowflake or WebTunnel: choosing a Tor bridge in 2026
When a censor blocks the Tor entry points that everyone knows about, the practical answer is a bridge: a relay kept out of Tor's public directory, paired with a pluggable transport that changes what the connection looks like on the wire. Three transports carry most of that workload in 2026: obfs4, Snowflake and WebTunnel. They solve the same problem — making a Tor connection resemble permitted traffic — but they differ sharply in how you get them, how they hide, and how fast they move. Choosing wrong rarely means instant failure; it usually means a bridge that worked yesterday stops working next week.
What bridges share
The Tor Browser manual describes bridges as relays excluded from the public Tor directory, so a censor cannot enumerate them the way it enumerates ordinary relays; the pluggable transport in front of the relay handles the disguise. All three mainstream types follow that pattern, and all three can be selected or requested from Tor Browser's connection settings, which the manual's circumvention section documents alongside the built-in options. The other shared property is less comforting: a bridge is an IP address like any other, and if a censor learns it, the address can be blocked like any other. Availability is not immunity. That is why distribution gets its own engineering effort — rdsys, Tor's rewrite of BridgeDB, exists to decide which bridge lines reach which users.obfs4, the mature default
obfs4 wraps Tor traffic in randomized-looking bytes with no stable signature, and it has the longest service record of the three. Tor's community documentation sums up the tradeoff in one line when comparing transports: obfs4 is fast and proven, but can be hard to distribute. The randomness holds up against protocol fingerprinting, yet the bridge's address is still exposed to scanning, and the longer a line circulates, the greater the chance a censor has catalogued it. That is why throughput is rarely the complaint about obfs4; the complaint is that heavily used, long-lived bridges tend to stop working. For a line-by-line walkthrough of how obfs4 builds its connections, see our earlier explainer.Snowflake, assembled from volunteers
Snowflake takes a different route to survival. The entry point is a volunteer-run proxy, and the traffic is dressed as WebRTC, the protocol family behind browser video and voice calls. The project's site describes routing traffic through proxies operated by volunteers in uncensored countries, a disguise that makes it costly for a censor to act on, since blocking it means blocking the traffic patterns of everyday video calling. Setup is the simplest of the three: Snowflake ships in Tor Browser as a selectable transport, and the project recruits capacity through a browser add-on. The price is performance. Volunteer proxies vary in bandwidth and come and go, and Tor's community documentation rates Snowflake the slower option of the mainstream set. Expect higher and less predictable latency than a dedicated bridge, with each session's quality depending on which volunteer happens to carry it.WebTunnel, Tor in an HTTPS costume
WebTunnel is the newest of the three; the reference implementation on Tor's GitLab dates to August 2022. It is based on HTTPT, a tunneling protocol built on HTTP, and Tor's community documentation describes the intent directly: it disguises Tor traffic as HTTPS web browsing. Against deep packet inspection that poses the hardest possible choice for a censor, because filtering WebTunnel means degrading ordinary HTTPS, the one protocol most networks cannot afford to break. The costs sit on the operator side: running a WebTunnel bridge takes a Linux server with root access, a domain name, DNS records, a valid TLS certificate and a reverse proxy such as NGINX, Caddy or Apache, with Docker as an alternative. The same documentation warns that domain-backed bridges cost money to run and can become a single point of failure. For users none of this matters — a WebTunnel bridge arrives as a line to paste into the bridge field.Setting expectations
- obfs4: fastest and longest-proven. Take fresh lines through Tor Browser's request flow and expect popular ones to be blocked over time.
- Snowflake: easiest setup and a disguise that rides on video-call traffic, at the cost of slower, more variable throughput.
- WebTunnel: the strongest answer to protocol fingerprinting, dependent on operators willing to maintain domains and certificates.