Where ten minutes of circuit life comes from
Tor carries a setting named MaxCircuitDirtiness. Its default is six hundred seconds and it is documented in the manual that ships with the software. No assumption sits behind that figure and nothing an operator does affects it.
A circuit is the path your traffic takes through the network, three relays deep. The setting governs how old a circuit may be before new streams stop attaching to it. Streams already open are left where they are, so a download in progress does not snap at the ten minute mark. What changes is where the next request goes.
new stream at 9 min 59 the existing path
new stream at 10 min 01 a freshly built path
Reaching a mars market onion address puts both ends inside the network, so there is no exit relay in the ordinary sense. The rotation still applies to the path your own client builds toward the service.
What the ten minute rotation explains
It explains the most common false alarm in this subject. A page loads, you read it, you click something several minutes later and the click fails. Nothing went away. Your client built a new path and a relay on it is slow, loaded or simply unlucky. Reload and it usually works, because the attempt after that builds a different path again.
That is why one failure is worthless as evidence. A single failed load describes one path at one moment and says nothing about a service, which is precisely why this site publishes no availability figure and never will. The zero page sets out that decision and what it costs a reader.
It also explains why two people comparing notes disagree so completely about whether something works. They were never on the same path. That is the strongest argument for waiting a day before treating a failure as news.
What people get wrong about the ten minutes
The large error is believing a new circuit means a new identity. A circuit is transport. If your session cookie is still going out with every request, the service sees the same account it saw a minute ago arriving from what looks like a different direction. Rotating the path changes nothing about who the far end thinks you are, and the thing that does end a session is the idle timer.
The second is expecting to notice it. There is no notification and no visible break. People assign a slow moment to the market when the honest answer is that a relay in the middle was swapped.
The third is adjusting the setting. Lowering it does not make anybody safer and unusual configuration is itself a thing that stands out. The default was chosen as a balance, and there is no prize sitting behind a different number.
What changes the ten minutes
A line in the configuration file changes it everywhere. The browser control that requests a new circuit for a site changes it immediately for that site alone. Tor Browser also keeps separate circuits per site, so the ten minutes runs independently for each one you have open.
The Tor Project could change the default in a future release, and the manual would say so. That is the entire dependency list. No market and no operator has any say in it, which is what makes this the counted number here.
Questions people ask
Does the circuit change while I am downloading?
No. Existing streams stay on the circuit they began on. The setting only decides which circuit new streams attach to.
Is a new circuit the same as logging out?
Not remotely. The session is held by a cookie rather than by the path, so a fresh circuit leaves you logged in exactly as you were.
Can I confirm the ten minutes myself?
Yes. It appears in the Tor manual as MaxCircuitDirtiness, written as six hundred seconds. Being checkable by anyone is what makes it counted rather than judged.