A fresh Ubuntu install is a good moment to sort out private browsing. Most people skip it, then scramble later when a public Wi-Fi network, a nosy ISP or a regional block gets in the way. Tor Browser fixes all three, but it has an awkward installation story on Linux. There is no big “Download .deb” button. Ubuntu’s own repositories carry a launcher instead of the browser. The Tor Project ships a tarball with its own quirks. Flatpak adds a third path. Each one behaves differently when it comes to updates, sandboxing and trust.

Ubuntu 26.04 LTS, codenamed Resolute Raccoon, was released on 23 April 2026 and is supported for five years, until April 2031. It ships with GNOME 50 on Wayland and Linux 7.0. A new LTS tends to surface small integration surprises: a launcher package a version behind, a desktop file that does not register, a sandbox that complains. After years of rolling out locked-down workstations and journalist laptops, the pattern is familiar. The install itself is rarely the problem. The trouble starts three weeks later, when an update silently fails or the browser refuses to launch after a dist-upgrade.

This guide covers the three realistic ways to install Tor Browser on Ubuntu 26.04 LTS, explains when each one makes sense, and shows how to verify what you downloaded. It also covers hardening, performance, troubleshooting and the mistakes that break anonymity without any error message.

What You Are Actually Installing

Two things share the name “Tor”, and mixing them up wastes time.

Tor Browser is a modified Firefox ESR build bundled with its own Tor client, NoScript, and a set of anti-fingerprinting patches. It is self-contained. It brings its own tor process and does not need a system-wide daemon.

The tor package is “little-t tor”, the network daemon. The Tor Project’s support pages state plainly that their apt repository instructions are for installing the daemon, and that Tor Browser has its own manual. If you only want to browse, you do not need the daemon. You would install it for relays, bridges or routing other applications through a SOCKS proxy.

For the browser on Ubuntu, the realistic options are these:

If you are unsure, use the first method. It handles signature checking for you.

Before You Start: Prerequisites and Sanity Checks

A few minutes of checking up front saves a lot of debugging later.

Confirm the release and architecture:

lsb_release -a
uname -m

You should see Ubuntu 26.04 and x86_64. The Ubuntu release page lists the 26.04.1 point release as the current image. Tor Browser also publishes aarch64 builds, but on ARM boards the launcher approach is usually smoother.

Bring the system fully up to date:

sudo apt update
sudo apt full-upgrade -y

Running Tor Browser on a half-updated system is a classic source of strange library errors. Reboot if the kernel or glibc changed. Check that the clock is correct too. Tor refuses to build circuits if the system time drifts by more than a few hours, and this is the most common “it just hangs at connecting” cause in practice.

timedatectl

Look for System clock synchronized: yes. If it says no, fix NTP before touching anything else.

You also need a normal user account. Tor Browser should never run as root. It refuses to start that way, and for good reason.

Method 1: Install with torbrowser-launcher (Recommended)

The Tor Project maintains torbrowser-launcher, and the repository describes it as included in Ubuntu, Debian and Fedora. You install the launcher from your distribution’s package manager and it does the rest: it downloads the current Tor Browser for your language and architecture, verifies it, and launches it.

Step 1: Check what version Ubuntu offers

Look at the candidate version before installing:

apt policy torbrowser-launcher

The package lives in the universe component. If apt reports no candidate, enable it:

sudo add-apt-repository universe
sudo apt update

Step 2: Install the package

sudo apt install torbrowser-launcher

The package pulls in GnuPG, Python dependencies and a few GTK bits. It is small, since the browser itself is not in the package.

Step 3: Launch it once from the menu or terminal

Search for “Tor Browser” in the GNOME app grid, or run:

torbrowser-launcher

On first run, the launcher downloads the Tor Browser tarball and its signature, then verifies them against the Tor Browser signing key. A small progress window appears. Wait for it to finish. Interrupting it mid-download leaves a partial cache that can trigger signature errors on the next try.

Why this method wins for most people

The launcher fetches the browser into your home directory, under ~/.local/share/torbrowser. Nothing is written to system paths, and the browser updates itself afterward the same way the upstream build does. The launcher only re-downloads when needed. You get verification without having to remember GPG commands.

One honest caveat: a launcher package frozen at release time can be outdated by the time you use it, and Tor’s download endpoints occasionally change. If the launcher fails with a download or signature error, jump to the troubleshooting section, then fall back to Method 2.

Using a proxy or bridge for the first download

If torproject.org is blocked on your network, the launcher can be told to use Tor settings. Open its settings window:

torbrowser-launcher --settings

You can set a download mirror or route the initial fetch through a Tor connection. In heavily filtered regions, it is often easier to obtain the tarball through another channel (email autoresponder, mirror, a friend) and use Method 2 with local verification.

Method 2: Install from the Official Tarball

The upstream route is the one the Tor Project documents directly. Their support pages tell Linux users to go to the download page and fetch the .tar.xz file. It takes more steps, but nothing sits between you and the upstream build. That matters on machines where you want full control.

Step 1: Download the files

Get the Linux tarball and its matching .asc signature from the official download page at torproject.org. Save both to ~/Downloads. For the commands below, replace VERSION with the version in your filename.

cd ~/Downloads
ls -lh tor-browser-linux-x86_64-*.tar.xz*

You should see the archive and a file ending in .asc.

Step 2: Import the signing key and verify

Signature checking is the step people skip, and it is the one that justifies using Tor in the first place. Fetch the Tor Browser developers’ key using Web Key Directory:

gpg --auto-key-locate nodefault,wkd --locate-keys torbrowser@torproject.org

Check that the fingerprint matches the one published on the Tor Project’s own site before you trust it. Then verify:

gpg --verify tor-browser-linux-x86_64-VERSION.tar.xz.asc tor-browser-linux-x86_64-VERSION.tar.xz

You want to see Good signature from "Tor Browser Developers (signing key) <torbrowser@torproject.org>". A warning that the key is not certified with a trusted signature is normal. It only means you have not personally signed it. A BAD signature message means stop, delete the files and download again, ideally over a different network.

Step 3: Extract to a sensible location

Where you put it depends on whether the machine is single-user or shared. For a personal desktop, your home directory is fine:

mkdir -p ~/apps
tar -xf tor-browser-linux-x86_64-VERSION.tar.xz -C ~/apps

This creates ~/apps/tor-browser. Keep it in a user-writable place. Tor Browser updates itself in place, which requires write access to its own directory. Putting it under /opt owned by root breaks automatic updates, and that is a security regression disguised as tidiness.

Step 4: Register the desktop launcher

cd ~/apps/tor-browser
./start-tor-browser.desktop --register-app

This writes a .desktop entry into ~/.local/share/applications so Tor Browser appears in the GNOME launcher. If you skip it, you can still start the browser with ./start-tor-browser.desktop from the folder.

On GNOME under Wayland, the first launch occasionally shows a generic icon in the dock. Log out and back in, or run update-desktop-database ~/.local/share/applications.

Step 5: First launch

Run it from the app grid. A connection window appears. Click Connect for a standard connection, or Configure Connection if you need bridges. Within a few seconds you should see a circuit established and the browser opens. A quick sanity test is to visit check.torproject.org, which confirms you are routing through Tor.

Method 3: Install via Flatpak

Flatpak is the third option, and it suits people who want an extra layer of isolation. The Flathub listing is for org.torproject.torbrowser-launcher, and the description repeats the same model: install the launcher, and it handles downloading and updating the actual Tor Browser.

Ubuntu does not enable Flatpak by default, so set it up first:

sudo apt install flatpak
flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo

Log out and in again so the Flatpak export directories join your path. Then install and run:

flatpak install flathub org.torproject.torbrowser-launcher
flatpak run org.torproject.torbrowser-launcher

The trade-off is sandbox permissions. Downloads may only land in specific folders, and file pickers behave differently through portals. Inspect and adjust permissions with:

flatpak info --show-permissions org.torproject.torbrowser-launcher

If something fails to write, the answer is usually a permissions mismatch rather than a bug. Resist the urge to grant --filesystem=home globally. That defeats the point of the sandbox.

About the Tor Project’s APT Repository

A common mistake is searching for “Tor on Ubuntu” and landing on the apt repository instructions. Those are for the daemon. The Tor Project documents a repository at deb.torproject.org, and community pages note that Ubuntu users should get the tor package from that repository rather than Ubuntu’s own. A third-party tracker lists the repository as available for Jammy, Plucky and Resolute, which covers Ubuntu 26.04.

The documented setup is a signed-by keyring and a source entry. The Tor Project’s own page is the authority for the exact steps, and the first instruction there is to install apt-transport-https. Follow it there rather than copying commands from forum posts. One old forum thread shows someone using sudo echo ... > file, which fails because the redirect runs as the unprivileged shell, not as root. Use sudo tee instead if you ever write sources by hand.

You would want the daemon for these scenarios:

• Running a bridge or relay
• Giving command-line tools a SOCKS5 proxy on 127.0.0.1:9050
• Fetching updates privately

The last of those is possible. The Tor Project describes configuring apt to pull from its repository through an onion service using apt-transport-tor.

For ordinary browsing, none of this applies. Leave the daemon uninstalled.

Verifying That Tor Is Working

Do not assume. Test.

1. Open check.torproject.org and confirm the “Congratulations” message.
2. Open the circuit display from the padlock icon in the address bar. You should see three relays.
3. Visit a DNS leak test page and confirm no resolver tied to your ISP appears.

For terminal-minded admins, confirm the browser’s tor process is listening locally:

ss -tlnp | grep -E '9150|9151'

Tor Browser’s bundled tor typically opens SOCKS on 9150 and control on 9151. These differ from the system daemon’s 9050 on purpose, so the two do not collide.

Troubleshooting Common Errors

“Tor Browser should not be run as root”

Exactly what it says. Log in as a normal user. Never prefix the launch command with sudo. If you extracted the tarball as root, fix ownership:

sudo chown -R "$USER":"$USER" ~/apps/tor-browser

torbrowser-launcher fails to download or reports a signature error

Causes include a stale cache, a blocked connection, or a launcher version that predates a change in Tor’s download paths. Clear the cache and retry:

rm -rf ~/.cache/torbrowser ~/.local/share/torbrowser
torbrowser-launcher

If it still fails, check that apt offers a newer launcher, or switch to the manual tarball method.

Stuck at “Connecting” or “Loading authority certificates”

Check the clock first. Run timedatectl and make sure NTP is active. Next, test whether the network blocks Tor: if direct connection hangs, configure a bridge in the connection window. Corporate proxies are another frequent culprit. Tor Browser can be pointed at a local proxy under Configure Connection.

The browser does not appear in the app grid

For tarball installs, rerun the registration:

cd ~/apps/tor-browser
./start-tor-browser.desktop --register-app
update-desktop-database ~/.local/share/applications

If you moved the folder after registering, register again. The .desktop file stores an absolute path.

Crash on start, missing libraries

On a minimal install, Tor Browser may complain about missing GTK or audio libraries. Launch from a terminal to read the error:

cd ~/apps/tor-browser
./Browser/start-tor-browser --verbose

Install what the message names. Typical candidates are libgtk-3-0t64, libdbus-glib-1-2 and libasound2t64. Note the t64 suffixes, a result of the 64-bit time_t transition that Ubuntu began adopting in 24.04. Old tutorials with the non-t64 names will fail on current releases.

Sandbox or user namespace errors

See the AppArmor section above. Check the logs first, then apply a targeted profile rather than disabling the restriction globally.

Flatpak cannot save downloads

Grant a specific folder, not your entire home directory:

flatpak override --user --filesystem=xdg-download org.torproject.torbrowser-launcher

Wayland rendering glitches

GNOME 50 on Wayland is the default. If you see flicker or a blank window, test an X11 session from the login screen’s gear icon to isolate the cause. If the problem disappears, it is a Wayland interaction and worth reporting upstream.

Slow or timing-out pages

Open a new circuit for that site, try a different bridge, or wait. Some onion services and busy sites are slow regardless of what you do.