I posted a very elementary explanation on my twitter about VPN and TOR a while back:
If you’re using the Tor browser, you’re surfing anonymously. Your activity is being sent through a series of servers called Tor exit nodes. Your internet provider (Comcast, Verizon, etc) can see that you’re using Tor browser and might block the connections. Although, no one can see what your activity.
Tor is S L O W, because it’s going through multiple servers. You activity appears to come from the last server as opposed to your real location.
Tor browser is not the most safe as far as malware. Also because the servers are hosted by random people, they have the ability if they wanted to to see your activity.
With VPN, you can also be anonymous, with the right VPN Service. VPN is a lot faster than TOR. VPN, you connect to a server securely however to your internet provider it just looks like you connected to one IP address or site. After that, they can’t track your activity. You activity is going through the server you connected to. VPN services, most of them tend to log your activity (even paid ones that say they don’t), which often defeats the purpose. There is no way for you to verify that they do or don’t retain your IP address logs. So just assume that they do.
Some people go all out and use both, which is what I would recommend. VPN first then TOR so their internet provider doesn’t see the Tor activity, but it will be slow. It provides the most anonymity.
Also, logging into your personal accounts defeats the purpose of using these things. If you REALLY want to be anonymous, use TOR browser from a public location and never log into anything (your personal gmail, Facebook, Twitter, etc.)... doesn’t make sense to be claim you want to be anonymous but log into an account that clearly can be traced back to you.
If you are serious about cyber security, I would recommend doing a GIAC certification with training done by SANS institute. It’s something you can put on your professional resume. Providers could write it off on taxes. Mine was paid for at my full time job. A lot of practical knowledge is given and you also will meet industry cyber security professionals who may give handy advice in the future.