Download sources matter more than most people think. Do not install Tor Browser from search engine results, third-party app stores, or links shared in forum threads. Those files might have been intercepted or repackaged. Go directly to torproject.org. Look for the download button. The interface changes slightly depending on your operating system, but the core logic remains the same. Download both the application binary and the separate signature file. You need both to verify integrity.
Verifying the download
Before you run the installer, check the checksum. On Windows, open PowerShell and run the Get-FileHash command specifying SHA256 for the downloaded file. Compare the output to the value listed next to the GPG signature on the download page. Then, use GnuPG to verify the signature itself. You need the Tor Project release signing key to validate the detached signature file. If either step fails, delete the file and start again. Do not proceed until the hashes match exactly and the signature checks good. This is your only protection against a tampered installer that injects code before the first launch.
Initial setup and settings
Run the installer. Keep the defaults unless you have a reason to change them. When the browser opens for the first time, it will ask about the security level. Leave this on Standard initially. Do not install extensions yet. Every extension adds attack surface and can leak metadata. Many common plugins track visits or send analytics data back to corporate servers. Turn those off completely. Check for updates only within the Tor Browser interface. Do not let your operating system manage updates through third-party tools. For details on maintaining a clean environment while browsing, refer to the guide on market safety protocols. If you are having trouble connecting after installation, review the steps in how to access the market.