guard relay

a guard relay is the fixed first hop of your tor circuits - you keep the same one for months so no single observer can watch both your traffic entering and leaving the network.

every tor circuit starts at a guard relay (also called an entry relay), the first hop that receives your encrypted traffic and forwards it onward without being able to read it. your ip address is invisible to every other hop in the circuit.

the counterintuitive design decision is persistence. if tor picked a fresh first hop for every circuit, sooner or later an adversarial guard would catch some of your traffic - and statistically, frequent rotation guarantees that eventually the same adversary watches your entry and an exit at the same time. sticking with a small set of well-behaved guards for weeks or months minimizes that exposure, so tor deliberately pins them.

guards earn their flag through demonstrated bandwidth and uptime, so they tend to be large, stable relays run by long-lived operators. tor clients typically select one or two guards and rebuild ordinary circuits through them repeatedly.

you rarely need to think about guards day to day, but they explain two common observations: switching networks does not change your tor experience much, and tor metrics charts of relay counts dip noticeably whenever big guard operators retire hardware.