The client
Short, because the correct answer is one piece of software and most of the page is about what people use instead.
The correct answer
Tor Browser, downloaded from the Tor Project directly, with the installer signature checked against their published key. Then set the security level to Safest before going anywhere that matters. Some pages break at that setting. That is the trade and it is a good one, because the scripting it disables is what most drive by compromise depends on.
What the security levels actually change
| Level | What it does |
|---|---|
| Standard | Everything enabled. The largest attack surface and the reason the other two exist. |
| Safer | Scripting off on non-secure sites, some media restricted. A compromise that mostly helps. |
| Safest | Scripting off everywhere, most media and fonts blocked. Pages look plain and behave predictably. |
What not to use
- Clearnet gateways. A site that opens onion addresses for you makes the request itself, which means it reads everything you send including credentials. That is how the mechanism works, not a question of trusting the operator. An honest one is still one that can be compromised or compelled later, retroactively affecting everyone who used it.
- Anything promising faster Tor. The category is entirely malware and fingerprinting. There is no such product and there cannot be.
- Repackaged bundles. Software named similarly, distributed anywhere other than the project, usually with something added.
- A VPN as a substitute. Different tool, different problem. Marketing that blurs the two sells the first as though it did the job of the second.
Mobile
Workable and worse, and worth being honest about rather than dismissive. Verification is genuinely harder, the signature checking workflow is poor, and the platform underneath gives you less control over what else is running.
The specific problem is not that mobile is insecure in the abstract. It is that the one habit this whole site rests on, checking a signature before typing anything, is inconvenient enough on a phone that people stop doing it. A tool that makes the load bearing habit annoying is a tool that removes the habit.
Tails and Whonix
Both are meaningful improvements and both are a step up in effort. They matter most for somebody whose ordinary machine is shared, monitored or otherwise not fully theirs. For a reader on their own machine who is going to do this a handful of times, the honest ranking is that pinning a fingerprint properly buys more safety than changing operating system, and it takes an hour instead of a weekend.