Tor hides your location from destination servers, but it does not encrypt <i>all</i> your communication. The last relay of a Tor circuit, called the <i>exit node</i>, establishes the actual connection to the destination server. This last step can be unencrypted, for example, if you connect to a website using HTTP instead of HTTPS.
[[!img doc/anonymous_internet/tor/tor.svg size="600x" link="no" alt="A Tor connection goes through 3 relays with the last one establishing the actual connection to the final destination"]]
Observe your traffic. That is why <i>Tor Browser</i> and Tails include tools, like [[<i>HTTPS Everywhere</i>|doc/anonymous_internet/Tor_Browser#https-everywhere]], to encrypt the connection between the exit node and the destination server, whenever possible.
Pretend to be the destination server, a technique known as <i>machine-in-the-middle</i> attack (MitM). That is why you should pay even more attention to the security warnings in <i>Tor Browser</i>. If you get such a warning, use the [[New Identity|doc/anonymous_internet/Tor_Browser#new-identity]] feature of <i>Tor Browser</i> to change exit node.
To learn more about what information is available to someone observing the different parts of a Tor circuit, see the interactive graphics at <a href="https://support.torproject.org/https/https-1/">Tor FAQ: Can exit nodes eavesdrop on communications?</a>.
Tor exit nodes have been used in the past to collect sensitive information from unencrypted connections. Malicious exit nodes are regularly identified and removed from the Tornetwork. For an example, see <a href="https://arstechnica.com/information-technology/2007/09/security-expert-used-tor-to-collect-government-e-mail-passwords/">Ars Technica: Security expert used Tor to collect government e-mail passwords</a>.
The Tornetwork has more than 6 000 relays. Organizations running Torrelays include universities like the MIT, activist groups like Riseup, nonprofits like Derechos Digitales, Internet hosting companies like Private Internet Access, etc. The huge diversity of people and organizations running Torrelays makes it more secure and more sustainable.
End-to-end correlation attacks have been studied in research papers, but we don't know of any actual use to deanonymize Tor users. For an example, see <a href="https://www.freehaven.net/anonbib/cache/murdoch-pet2007.pdf">Murdoch and Zieliński: Sampled Traffic Analysis by Internet-Exchange-Level Adversaries</a>.
