<page xmlns="http://projectmallard.org/1.0/"
type="topic"
id="plugins">
<info>
<desc>How Tor Browser handles add-ons, plugins and JavaScript</desc>
<link type="guide" xref="index" group="ten" />
</info>
<title>Plugins, add-ons and JavaScript</title>
<section id="flash">
<title>Flash Player</title>
<p>
Video websites, such as Vimeo make use of the Flash Player plugin
to display video content. Unfortunately, this software operates
independently of Tor Browser and cannot easily be made to obey Tor
Browser’s proxy settings. It can therefore reveal your real location
and IP address to the website operators, or to an outside observer.
For this reason, Flash is disabled by default in Tor Browser, and
enabling it is not recommended.
</p>
<p>
Some video websites (such as YouTube) offer alternative video delivery
methods that do not use Flash. These methods may be compatible with
Tor Browser.
</p>
</section>
<section id="javascript">
<title>JavaScript</title>
<p>
JavaScript is a programming language that websites use to offer
interactive elements such as video, animation, audio, and status
timelines. Unfortunately, JavaScript can also enable attacks on the
security of the browser, which might lead to deanonymization.
</p>
<p>
Tor Browser includes an add-on called NoScript, accessed through the
“S” icon at the top-left of the window, which allows you to control the
JavaScript that runs on individual web pages, or to block it entirely.
</p>
<p>
<media type="image" width="400" src="media/plugins/noscript_menu.png" />
</p>
<p>
Users who require a high degree of security in their web browsing should
set Tor Browser’s <link xref='security-slider'>Security Slider</link> to
“Medium-High” (which disables JavaScript for non-HTTPS websites) or “High”
(which does so for all websites). However, disabling JavaScript will
