The Tor Project's VPN guidance is clear: if you use both, connect VPN first, then launch Tor Browser. Reversing the order routes traffic incorrectly and can deanonymize you. A VPN is optional for Drughub; Tor Browser at Safest is not.
A VPN encrypts traffic between your device and the VPN provider's server. Your ISP sees a connection to the VPN — not that you are using Tor. That is the main reason people combine the two: hiding Tor usage from a home ISP or campus network.
What a VPN does not do: open .onion sites. You still need Tor Browser for hidden services. A VPN alone cannot reach Drughub any more than Chrome can. And once traffic exits Tor at the destination, the VPN layer is already behind you — it does not protect what the .onion page sees.
You also add a second party who could log your connection times: the VPN provider. That tradeoff only makes sense with a provider you trust and a reason to hide Tor from your ISP.
Your ISP sees VPN traffic. Tor enters the network from the VPN server's IP. The VPN provider sees that you use Tor but not what you do inside Tor. This is the standard setup when you need both layers.
Routing Tor exit traffic into a VPN sends identifiable traffic through a single VPN IP. The VPN provider can correlate your session. Tor Project explicitly warns against this for anonymity. Do not configure Tor to push traffic through a VPN tunnel on the exit side.
Use a paid provider with a published no-logs policy and third-party audits. Free VPNs fund themselves by logging and reselling data — the opposite of what you want here.
Turn on the kill switch in VPN settings before your first connection. If the VPN drops mid-session, the kill switch blocks all traffic instead of leaking your real IP to Tor entry nodes.
Connect to a server and confirm the VPN is active — check your IP through the VPN app's status screen. Do not open Tor until this step is done.
Your ISP flags or blocks Tor traffic and bridges alone are not enough. Your employer or school monitors connection types. You want your ISP to see generic VPN traffic instead of Tor handshakes.
Many ISP blocks are solved without a VPN. Tor bridges cost nothing and do not add a logging provider. Start there before paying for a VPN.
Connecting to a VPN and opening Chrome still cannot load .onion addresses. Tor Browser is mandatory for Drughub regardless of VPN status.
A VPN hides your IP from your ISP. Safest mode stops JavaScript fingerprinting on the page itself. You need both layers for different threats — or just Safest if your ISP does not block Tor.
VPN is optional. Tor Browser at Safest, a verified onion link from the homepage or PGP-verified mirror list, and no password reuse are the non-negotiable parts. Add VPN only when your network situation requires it.
Official documentation behind the recommendations on this page.