Tor Browser Security Levels: What Standard, Safer and Safest Actually Disable
Every Tor Browser ships with three security levels: Standard, Safer and Safest. The names are familiar; the exact trade-offs are less so. The slider does not fine-tune privacy in small increments. It switches whole classes of browser behaviour on or off, and the gap between adjacent levels is wider than most people assume. Here is what each level really disables, where the control lives now, and which level suits which kind of visit.
What each level actually turns off
The support portal's security levels page defines all three. At Standard, the default, all Tor Browser and website features are enabled. Safer disables JavaScript on all non-HTTPS sites, turns off some fonts and math symbols, and makes HTML5 audio and video click-to-play. Safest goes further still, keeping only the features required for static sites and basic services.At this level, all Tor Browser and website features are enabled. — the support portal's complete description of Standard.
- Standard: everything on. Scripts, fonts and media all behave like a stock Firefox.
- Safer: JavaScript off on non-HTTPS sites; some fonts and math symbols disabled; HTML5 audio and video wait for a click.
- Safest: JavaScript off on all sites; some fonts, icons, math symbols and images disabled; media click-to-play; only static-site and basic-service features remain.
A change only fully applies after a restart
The manual's security settings chapter describes the current flow: click the shield icon in the address bar, open Settings, choose a level, then confirm with a save-and-restart prompt. That restart is not cosmetic. Privacy Guides documented in May 2025 that not all slider changes take effect until the browser restarts. A user who lowers a level can keep some protections silently active; a user who raises one is not fully protected yet. Restart before you judge what a level does.Which level fits which task
For reading, Safest is often enough. Text-heavy sites — news pages, wikis, directory listings, most forum threads — work with scripts and some images gone. Breakage shows up where sites lean on JavaScript for the basics: logins behind captchas, infinite-scroll boards, anything that builds its layout at runtime. For logging into accounts, Safer is the practical middle. JavaScript keeps running on HTTPS sites, which is what most login flows need, while scripts on plain HTTP die. Standard is for the rare visit that genuinely requires full scripting; treat it as a deliberate exception, not a home base. And remember the level is browser-wide: there is no per-site exception, so one session's convenience becomes every session's default until you change it back.What Standard costs on a Tor audience
Running Standard on the Tor network has a price on both sides. As a user, you keep scripts, full font enumeration paths and default behaviour active — exactly the surface fingerprinters measure, as our earlier piece on fingerprinting in Tor Browser explains. Tor Browser's uniformity defence assumes a stock configuration, and the security level is part of that stock. As a site operator, assume some of your visitors browse with Safer or Safest by choice; a page that needs JavaScript to render its text excludes them on purpose.From NoScript button to shield popup
The control has moved twice. Through Tor Browser 7, security lived in a slider plus the NoScript button for script permissions. Tor Browser 8.0 rebuilt the scheme in September 2018: the release post notes the switch to the WebExtension version of NoScript, which the team still needed to provide the security slider functionality, consolidated into the Standard, Safer and Safest levels. Tor Browser 13, rebased on Firefox ESR 115 in 2023 per the 13.0 release post, folded the entry point into the shield panel beside the address bar. Today's popup is a doorway, not a live toggle: it shows your current level and routes you into Settings, where the change is saved and applied with that restart.When Safest breaks a site
Blank players, missing icons, half-drawn layouts, forms that do nothing on submit — that is Safest doing its job. Because the setting is global, the wrong response is downgrading the whole browser forever for one site. The better habit: switch deliberately when a task needs more of the web, drop back afterwards, and let the restart be part of the routine. For anything that involves an account, Safer usually restores function without handing back everything Standard gives away. The levels are blunt by design. They trade parts of the modern web for a smaller attack surface, and the defaults assume you would rather click a missing video back to life than explain a compromised session.Quick reference
- Reading mostly static content: Safest.
- Logging in over HTTPS: Safer.
- A site that truly needs full scripting: Standard, temporarily, with eyes open.
- After any change: restart, then check the shield again.