Tor Country Codes List: Set Exit Nodes by Country (torrc)

Tor country codes are two-letter ISO 3166-1 alpha-2 codes wrapped in braces ({us}, {de}, {nl}) that you put in your torrc to control which countries your traffic may enter, exit, or avoid. Use ExitNodes for exit selection, ExcludeExitNodes for exit exclusions, and ExcludeNodes for broader exclusions. StrictNodes applies to ExcludeNodes; it does not enforce ExitNodes.

Below is the full searchable list of every Tor country code, plus working torrc snippets, ready-to-paste blocks for excluding the Five Eyes / Nine Eyes / 14 Eyes countries, command-line examples with torify and torsocks, the StrictNodes failure modes that catch most people, and how to verify which country your exit is actually using.

What are Tor country codes?

Tor country codes are two-letter abbreviations from the ISO 3166-1 alpha-2 standard that the Tor client uses to identify the geographic origin of a relay. You wrap them in braces inside torrc and pass them as a comma-separated list to one of three directives: ExitNodes (allowed exits), ExcludeNodes (banned countries for any hop), or EntryNodes (allowed entry guards). The Tor client maps relay addresses using its configured GeoIP database, so the codes work without any external service. The same codes apply across all platforms: Tor Browser, the tor daemon on Linux/macOS, and the bundled Tor inside applications like OnionShare. The table below lists every code Tor accepts in 2026.

In short, here is how Tor country codes work:

• Format: lowercase ISO 3166-1 alpha-2 in braces, e.g. {us}, {de}, {nl} (Tor parses them case-insensitively).
• ExitNodes {us},{de}: restrict the last hop to these countries.
• ExcludeNodes {cn},{ru}: ban these countries from any hop.
• EntryNodes {se},{ch}: restrict the first hop (guard) to these countries.
• StrictNodes 1: makes ExcludeNodes mandatory even for special-purpose circuits. It does not change ExitNodes or ExcludeExitNodes.

Jump to:

• Full Tor country code list
• Set Tor exit nodes by country with ExitNodes
• Set the exit node country in Tor Browser
• Use ExcludeNodes to ban specific countries
• Block exit nodes by alliance: Five Eyes, Nine Eyes, 14 Eyes
• Exclude ungeolocated relays (the unknown country code)
• Use EntryNodes to choose the guard country
• Run torify and torsocks through country-pinned exits
• Multiple Tor instances for per-command country switching
• StrictNodes 1: what it does and when it breaks Tor
• Verify the exit node country
• Troubleshooting
• FAQ

Full Tor country code list

# Select countries from the table above…

The table above is a country-code reference, not a live list of exit relays. A code can be valid even when no suitable exit is currently available there. The selector builds a torrc snippet from your chosen countries. Tick the countries you want, choose the directive (ExitNodes, ExcludeNodes, EntryNodes, or ExcludeExitNodes), and copy the generated snippet straight into your config.

Set Tor exit nodes by country with ExitNodes

ExitNodes tells Tor which countries are acceptable for the last hop, where your traffic exits onto the public internet. This is the directive that matters for almost every use case (testing geolocated content, checking a site as seen from another country, avoiding a specific jurisdiction).

# torrc
ExitNodes {us},{de},{nl}

ExitNodes restricts selection for connections that exit to the public internet. If no suitable listed exit allows the destination, the connection can fail. StrictNodes does not change this behavior. Onion-service and directory circuits are different and do not necessarily end at an internet exit.

For a single country, drop the comma list:

ExitNodes {us}

Validate the configuration and reload the specific daemon instance you edited. For Tor Browser, close it before editing and restart it afterwards.

Set the exit node country in Tor Browser

To pin the exit country in Tor Browser, edit the bundle's own torrc and add the same ExitNodes line described above, then fully restart the browser. Tor Browser does not read /etc/tor/torrc; it ships its own copy inside the bundle:

# Linux
~/.local/share/torbrowser/tbb/x86_64/tor-browser/Browser/TorBrowser/Data/Tor/torrc

# Windows
<install dir>\Browser\TorBrowser\Data\Tor\torrc

# macOS
~/Library/Application Support/TorBrowser-Data/Tor/torrc

Close Tor Browser first, open that file, and add the same syntax the rest of this article uses, for example ExitNodes {us}. See the official Tor Browser torrc locations for your platform. Browser command-line settings can override options in the file. A connection toggle inside the browser is not enough; quit the whole process so the bundled tor daemon rereads the file on next launch.

Two caveats. Tor Browser updates can overwrite or relocate this file, so recheck the directive after upgrading. And pinning to one country shrinks your exit set, which reduces anonymity and makes you easier to fingerprint, so prefer a few countries over a single one unless you specifically need one jurisdiction.

Use ExcludeNodes to ban specific countries

ExcludeNodes blacklists countries for any hop in the circuit, not just the exit. Common reasons: avoid hosting countries you distrust, avoid countries that block traffic to your destination, or comply with internal policy that bans certain jurisdictions.

# torrc
ExcludeNodes {cn},{ru},{ir},{kp}
StrictNodes 1

With StrictNodes 0, Tor can make exceptions to ExcludeNodes for purposes such as directory access and onion-service connections. StrictNodes 1 forbids those exceptions and can break that functionality.

There is also ExcludeExitNodes, which bans countries from being the exit specifically but allows them at other hops. Use it when you don't mind a country being in the middle of the circuit but don't want it terminating the connection.

ExcludeExitNodes {us},{gb},{ca},{au},{nz}

Block exit nodes by alliance: Five Eyes, Nine Eyes, 14 Eyes

The most common reason people reach for a long ExcludeNodes list is to avoid the intelligence-sharing alliances: the Five Eyes (AU, CA, NZ, GB, US), the Nine Eyes (Five Eyes plus DK, FR, NL, NO), and the 14 Eyes / SIGINT Seniors Europe (Nine Eyes plus DE, BE, IT, SE, ES). Here are the three ready-to-paste blocks. Each list is additive: Nine Eyes contains the Five, and 14 Eyes contains the Nine.

# torrc — exclude Five Eyes (AU, CA, NZ, GB, US)
ExcludeNodes {au},{ca},{nz},{gb},{us}
StrictNodes 1

# torrc — exclude Nine Eyes (Five Eyes + DK, FR, NL, NO)
ExcludeNodes {au},{ca},{nz},{gb},{us},{dk},{fr},{nl},{no}
StrictNodes 1

# torrc — exclude 14 Eyes (Nine Eyes + DE, BE, IT, SE, ES)
ExcludeNodes {au},{ca},{nz},{gb},{us},{dk},{fr},{nl},{no},{de},{be},{it},{se},{es}
StrictNodes 1

Two things to get right that most copy-paste lists get wrong:

• {au} is Australia, {at} is Austria. Several widely-shared Five Eyes lists accidentally exclude Austria instead of Australia. Double-check the Five Eyes block above: it uses {au}.
• Large exclusions can remove useful relay capacity. The effect changes with the live relay set and destination exit policies; a fixed percentage is not reliable. A relay's country does not prove its operator or jurisdiction. Country filtering is not an anonymity guarantee. If your requirement concerns only internet exits, use ExcludeExitNodes rather than excluding all hops.

Exclude ungeolocated relays (the unknown country code)

Tor maps every relay to a country using its bundled GeoIP database. A relay whose IP the database cannot place is assigned the country code ??. You can target those relays explicitly with the same brace syntax:

# Drop every relay Tor cannot geolocate
ExcludeNodes {??}
StrictNodes 1

This is useful when a policy requires a known jurisdiction for every hop, since {??} relays are exactly the ones whose location can't be confirmed. The {??} code also works in ExitNodes and ExcludeExitNodes. Note that excluding {??} shrinks the relay pool, so pair it with a generous country list to keep circuits buildable.

Use EntryNodes to choose the guard country

EntryNodes controls the first hop, the guard relay. Most users should leave this alone. Tor's guard-selection algorithm has security properties (long-lived guards, fingerprint diversity) that you defeat by pinning entries.

If you do need to set it, for testing or research:

EntryNodes {se},{no}

The countries you pick for entry should ideally be jurisdictions with strong privacy laws and a large healthy relay set (Sweden, Norway, Netherlands, Switzerland are common choices).

Combining directives

The three directives compose freely. A typical "research lab" configuration:

EntryNodes {se},{ch}
ExitNodes {us},{de}
ExcludeNodes {cn},{ir},{kp},{ru},{sy}
StrictNodes 1

This says: enter through Sweden or Switzerland, exit through US or Germany, and never touch China, Iran, North Korea, Russia, or Syria at any hop.

Run torify and torsocks through country-pinned exits

torify and torsocks both route a single command's TCP traffic through Tor's local SOCKS proxy (default 127.0.0.1:9050). Neither tool accepts country codes directly. To make torify curl exit from a specific country, you configure ExitNodes in torrc, reload the Tor daemon, then run the command. The country pinning happens inside the Tor daemon, not the wrapper. The wrapper only works for applications and network calls it can intercept; raw sockets, static binaries, and some platform restrictions can bypass or prevent interception. Prefer native SOCKS support when available.

The three-step workflow:

1. Pin the exit country in torrc.

# /etc/tor/torrc
ExitNodes {us}

2. Reload the Tor daemon.

# Linux (systemd)
sudo systemctl reload tor

# macOS (Homebrew) or non-systemd Linux
pkill -HUP tor

3. Run your command through torify.

torify curl https://dnschkr.com/api/ip
# {"ip":"151.115.X.X","type":"IPv4","success":true,
#  "geo":{"country":"United States","country_code":"US","flag_emoji":"🇺🇸", ...}}

I use DNS Checker (dnschkr.com/api/ip) for verification because its response returns more diagnostic context than most IP lookup endpoints: the ISO alpha-2 country_code Tor uses internally, the full geo block, ASN, flag emoji, and IPv4/IPv6 type in a single payload. Compare the reported country with Tor's view, allowing for disagreements between GeoIP databases.

torify is a thin wrapper around torsocks. On modern systems (Debian/Ubuntu 22.04+, Fedora 38+, Arch, Tor Browser bundle) the two names are interchangeable. Run which torify to confirm what's installed; on many systems it's a symlink to torsocks.

Common torify command examples

# Verify exit IP and country (dnschkr returns the ISO alpha-2 code)
torify curl https://dnschkr.com/api/ip
torify curl https://check.torproject.org/api/ip

# Anonymous download
torify wget https://example.com/file.tar.gz

# Clone a git repo through Tor
torify git clone https://github.com/user/repo.git

# SSH over Tor (the destination must allow Tor)
torify ssh user@example.com

# nmap a host through Tor (TCP scans only, no SYN scan)
torify nmap -sT -p 80,443 example.com

The wrapper intercepts the program's network calls (via LD_PRELOAD on Linux, DYLD_INSERT_LIBRARIES on macOS) and routes everything through the SOCKS proxy, including DNS lookups. This matters: a plain curl --socks5 127.0.0.1:9050 resolves DNS locally and leaks the hostname to your ISP. torify curl resolves through Tor, so no leak.

torify vs torsocks

For new scripts and documentation, prefer torsocks. For pasting one-liners from old guides, torify still works.

Multiple Tor instances for per-command country switching

The single-torrc approach pins everything routed through Tor to one country. To switch exit countries per command without restarting Tor, run multiple Tor daemon instances on different SOCKS ports, each with its own torrc.

# /etc/tor/torrc-us
SocksPort 9051
DataDirectory /var/lib/tor-us
ExitNodes {us}

# /etc/tor/torrc-de
SocksPort 9052
DataDirectory /var/lib/tor-de
ExitNodes {de}

Start each instance:

tor -f /etc/tor/torrc-us &
tor -f /etc/tor/torrc-de &

Point torsocks at the SOCKS port you want with -p / --port (you can also export TORSOCKS_TOR_PORT instead of passing the flag):

# Exit from US (country_code: "US")
torsocks -p 9051 curl https://dnschkr.com/api/ip

# Exit from Germany (country_code: "DE")
torsocks -p 9052 curl https://dnschkr.com/api/ip

This pattern is the standard way to run multi-country smoke tests for geo-blocked content from a single shell session. For three or four countries it's fine; beyond that consider a proper Tor SOCKS proxy farm or a service like Tor's own MapAddress feature.

The same -p flag works for torify on systems where it's a torsocks symlink.

StrictNodes 1: what it does and when it breaks Tor

The Tor manual defines StrictNodes specifically for ExcludeNodes.

It does not make ExitNodes or ExcludeExitNodes stricter. If an exit-country list leaves no usable exit for a destination, changing StrictNodes is not the remedy; revise the exit list after checking the logs. Check for conflicts too: ExcludeNodes wins when a relay is both selected and excluded.

A broad ExcludeNodes list plus StrictNodes can also prevent onion-service or directory operations. Validate the configuration and test the traffic you actually need, rather than assuming a successful bootstrap proves every connection will work.

Verify the exit node country

After setting ExitNodes, confirm the exit is actually in the country you asked for. Three ways:

1. DNS Checker IP API (returns the ISO alpha-2 code Tor uses):

torify curl https://dnschkr.com/api/ip
# {"ip":"151.115.X.X","success":true,
#  "geo":{"country":"United States","country_code":"US","flag_emoji":"🇺🇸", ...}}

The geo.country_code field is the same two-letter code you put in ExitNodes {us}, so verification is a direct string match. DNS Checker is a useful tool for this kind of debugging because it returns more diagnostic context than check.torproject.org (full geo block, ASN, flag emoji, IPv4/IPv6 type) in a single response, so you can confirm exit country and ASN in one call.

2. Tor's own check service:

torify curl https://check.torproject.org/api/ip

Returns the exit IP plus a confirmation that you're actually using Tor. Cross-reference the IP against any geolocation service.

3. From Tor Browser:

Open the circuit display (the lock icon → "View circuit info"). The last hop is labeled with its country flag.

If the reported country differs, check that you used the intended Tor instance, that the configuration loaded, and whether the two GeoIP databases disagree. Do not attribute the mismatch to StrictNodes being off.

Troubleshooting

Tor won't connect after editing torrc. Validate the actual configuration with tor --verify-config -f /path/to/torrc, then inspect that instance's logs. Check for invalid syntax, missing GeoIP data, conflicting selections, and an exit list too small for your destination. Back out the particular change you made; disabling StrictNodes will not relax ExitNodes.

Circuit builds but the site geoblocks me anyway. Some sites use multiple geo sources (IP geolocation + browser headers + timezone). Tor Browser already spoofs the timezone and locale, but check that the exit IP is actually in the country you wanted (above) and that you're not leaking your real timezone via JavaScript.

Exit country is correct but speed is terrible. Country pinning concentrates load on a small relay set. Try a country with more capacity (US, Germany, Netherlands, France) or list multiple alternatives so Tor can load-balance.

{us} syntax not working. Country codes require braces: ExitNodes {us},{de}. Bare identifiers are not equivalent country-code syntax.

Bridges and pluggable transports. If you're using bridges (obfs4, Snowflake, meek), country restrictions still apply to your exit, but the entry hop goes through the bridge instead of a normal guard. Country directives don't apply to bridges themselves.

Resources

• Tor Project torrc reference: official manual for every torrc directive.
• Tor Metrics: live network data, including which countries have how many exits.
• Tor Project: how Tor works: protocol fundamentals if you're new.
• ISO 3166-1 alpha-2 codes: official source of the underlying country code standard.

FAQ

See also

• Tor Bridges Explained: obfs4, Snowflake, and meek: when your ISP or country blocks Tor entirely, bridges and pluggable transports keep you connected
• Host a v3 .onion Hidden Service with Tor: end-to-end setup for serving content over Tor including key backup, permissions, and the onion-location header
• Use Tor as a SOCKS5 Proxy with curl, Python, and Node: route a single command, script, or HTTP client through Tor without DNS leaks
• Force a New Tor Circuit on Demand with NEWNYM: the control-port NEWNYM signal for rotating circuits programmatically
• torrc Cheat Sheet: every common torrc directive grouped by use case