Fruit Bat Docs

Vampire Bat (Tor)

Private windows that go through Tor, with .onion sites, bridges and Orange Blocker.

☰ › New Vampire Bat window (Alt+Shift+N, or about:tor) opens a private window whose traffic only goes through Tor. Sites see a Tor relay's address instead of yours, and your internet provider can't see which sites you visit.

What it does#

  • Waking up: a progress screen shows Tor connecting (usually 5–30 s). If it can't connect, it says why and what to try.
  • Circuit button (in the toolbar): shows the relays this site goes through, with their countries. It also has New circuits for this site (keeps your tabs) and New identity (closes every Vampire Bat tab, wipes all cookies, storage and logins, and gets fresh circuits).
  • .onion sites:
    • They work in Vampire Bat, and HTTPS-only leaves them alone since they're already end-to-end encrypted.
    • A site that sends an Onion-Location header gets a .onion available button.
    • A .onion link in a normal window opens in Vampire Bat instead of leaking the name to DNS.
  • Bridges (Settings › Vampire Bat): built-in Snowflake or obfs4 bridges, or your own bridge lines, for networks that block Tor.

How it's kept sealed#

  • Its own session: all Vampire Bat windows share one in-memory session, wiped when the last one closes. Fruit Bat's Tor stops then too.
  • Fails closed: until Tor is connected, and the moment it stops, the session's proxy points at a closed port, so pages simply don't load rather than going out directly. <-loopback> sends even localhost through Tor, so pages can't probe your local network.
  • Lookups go through Tor: site names are handed to Tor unresolved. This was tested in real Chrome with local DNS broken on purpose.
  • WebRTC is limited to the proxy (disable_non_proxied_udp), so it can't send UDP around Tor.
  • Permissions: every site permission is denied except fullscreen video and copying, and no USB/serial/HID devices. Spellcheck is off, because its dictionaries come from Google.
  • Off in Vampire Bat: history, add-ons (even ones allowed in private windows) and Colony (a torrent would reveal your IP to every peer).
  • Always on: HTTPS-only (exit relays can read and change plain HTTP) and Orange Blocker (below). Searches go to DuckDuckGo, since Google answers Tor with captchas.
  • Toolbar images: the toolbar itself uses the Tor session, so tab and bookmark icons never load over your real connection. Private windows now do the same with their own session.
  • Downloads work, with a warning that some files connect to the internet when opened.

What it doesn't do. It hides your IP address. It doesn't make you look like every other Tor user the way Tor Browser does: your screen size, fonts, language and system are still visible to sites. The new-tab page says so, and points to Tor Browser for the strongest anonymity.

Orange Blocker#

In Vampire Bat windows, Lime Blocker becomes Orange Blocker, with an orange shield and stricter rules:

  • More lists: the complete prebuilt set (ads, trackers, annoyances, cookie notices) instead of ads-and-trackers only.
  • The Orange list on top:
    • fingerprinting services (FingerprintJS, ThreatMetrix…)
    • session recorders (Clarity, FullStory, Hotjar-style tools…)
    • social tracking widgets and pixels
    • extra analytics, ad verification
    • IP-lookup services sites use to profile visitors
    • all tracking pings and beacons
  • Request rules:
    • third-party requests never carry cookies (same-site subdomains still do, so logins work)
    • cross-site requests only see which site you came from, never the exact page
    • every request sends Global Privacy Control (Sec-GPC: 1)
  • Clean links: tracking tags (utm_*, fbclid, gclid…) are stripped from every page you open.

The shield panel counts third-party cookie sends stopped and tracking tags stripped. Orange Blocker's lists are built at startup, not when you open a Vampire Bat window, so opening one never triggers a list download. Until they're ready, or if they can't download, Vampire Bat uses the standard lists, and offline it uses the built-in list plus the Orange hosts. It follows the same on/off switch as Lime Blocker.

Tor is built in#

Fruit Bat ships with Tor inside it, like Tor Browser, so nobody has to install anything for Vampire Bat:

  • Checking downloads: every download is checked against the Tor Project's sha256sums-signed-build.txt. If you have gpg with the Tor Browser signing key, that file's signature is checked too. A mismatch is never installed. Alphas are skipped, and a release that's still uploading falls back to the previous one.

If the built-in Tor is missing, Fruit Bat falls back to:

  1. tor on your PATH (brew install tor, apt install tor).
  2. Tor that's already running: Tor Browser (port 9150) or a system Tor service (9050). In this mode circuits can't be shown or changed, because that Tor belongs to another app.

If something goes wrong, Fruit Bat tries the next option before giving up: built-in Tor → tor on the system → a Tor that's already running. The Vampire Bat page then shows Details for troubleshooting with Tor's own log and everything that was tried, plus Copy details. The last run is also saved in <profile>/tor/tor-last-run.log.

Double-checked: once connected, Fruit Bat asks check.torproject.org (through the Vampire Bat window's own connection) whether the traffic really comes from Tor, and shows the answer on the Vampire Bat page. If the answer is no, which can only happen when "already running" mode finds something on port 9050/9150 that isn't Tor, Vampire Bat cuts itself off.

Fruit Bat runs its own Tor with:

  • SOCKS and control ports on 127.0.0.1 only, on random ports
  • cookie authentication for the control port
  • the system torrc ignored
  • __OwningControllerProcess, so Tor exits if Fruit Bat crashes

Tor's data folder (<profile>/tor, mode 700) keeps the relay list and your guard relay between runs, like Tor Browser. It holds no browsing data.