How Tor Circuits Are Built: Guards, Middles, and Exits
What actually happens inside the Tor client when you open a page. The three-hop circuit, why guard relays change rarely, and what stays the same across requests.
If you have used the Tor Browser long enough to wonder what is happening between your address bar and the page that loads, this is the short explanation. Most of the language people use about Tor (anonymity, layers, relays) is a sketch of an idea. The actual implementation is a three-hop circuit with deliberate role separation, and once you know how the three hops are picked, everything else about Tor's behaviour falls into place.
The three roles
Every Tor circuit goes through three relays in order: a guard, a middle, and an exit. The names are functional. The guard sees who you are (your IP), but not what you are doing. The exit sees what you are doing (the destination), but not who you are. The middle sees neither, which is why it exists: it breaks the link between the guard and the exit so no single relay can map the two ends of the connection.
For an onion service, the structure is slightly different. There is no exit relay because the destination is itself inside the Tor network. Instead, your client builds a circuit to a rendezvous point, and the service builds a separate circuit to the same point. The rendezvous point splices the two circuits together. The service never learns your IP, and you never learn its server location.
Why the guard relay barely changes
The guard is the only relay that sees your IP address. Tor wants that exposure as small as possible, so the guard role is sticky. Your client picks a small set of guards once and reuses them for weeks. Rotating quickly increases the chance that, over many sessions, you eventually pick a hostile guard at least once. Sticking to a small set means you have only ever exposed yourself to a few entry points total.
Middle and exit relays rotate freely. A new circuit picks fresh ones every ten minutes or so by default, which keeps the path varied without giving up the stable guard.
What you can change yourself
The Tor Browser exposes one circuit control directly: New Tor Circuit for this Site, in the menu next to the address bar. It builds a fresh middle and exit without touching your guard. Use it when a site stalls but the network is otherwise fine.
New Identity is the bigger hammer: closes every circuit, opens fresh ones, clears browser state. It does change your guards over the long run, but only because it forces the client into a state where it will rotate them on the normal schedule.
What this means in practice
The three-hop structure is what makes Tor's anonymity claim hold up. It is also what makes Tor slower than a normal browser: every byte travels through three encrypted hops before it reaches the destination. The latency is real and it is the price of the property. There is no faster mode that preserves the same guarantees.
For most users, the takeaway is simpler. Use the Tor Browser at the Safest setting. Trust the circuit the client built. If a circuit stalls, use New Circuit for this Site rather than restarting. The path is almost always correct; the slow part is usually network congestion, not the Tor client.
Related reading
For the protocol-level structure of an onion address, see Why a v3 Onion Address Validates Itself. For what happens when a service publishes more than one address, see How Tor Hidden Service Mirrors Are Rotated. For a worked example, the Nexus Market directory publishes its current onion set.