Understanding Onion URLs and Tor Hidden Services

An onion URL is a Tor hidden service address that routes traffic through multiple encrypted relays before reaching the server. The address itself is a long string of characters followed by .onion, such as a 56-character v3 address. Unlike a regular domain name, which is registered with a registrar and tied to an IP address, an onion URL is generated directly from the server's cryptographic keys. This means no central authority issues it, and the server's physical location remains hidden from visitors and network observers. The Tor Project documentation explains that onion services use a multi-layer encryption scheme where the server publishes its public key, and clients encrypt their requests so that only the server can decrypt them. This architecture makes onion URLs fundamentally different from traditional web addresses.

When someone sets up a Tor hidden service, the Tor software generates a public and private key pair. The onion address is derived from a hash of the public key, making it unique and deterministic. Version 3 onion addresses, the current standard, are 56 characters long and include a checksum to prevent typos from leading to unrelated sites. The server operator keeps the private key secret and uses it to prove ownership of the address. This cryptographic binding means that the same onion address always leads to the same hidden service, provided the operator has not changed the keys. If someone claims to run a service at a particular onion URL but cannot prove they hold the corresponding private key, that claim is false. This is why verifying an onion address through PGP-signed announcements or official channels matters: it confirms the operator controls the keys behind that address.

Onion services are used by journalists, activists, whistleblowers, and ordinary people in countries with heavy internet censorship or surveillance. News organizations like BBC and ProPublica operate onion mirrors to allow readers in restricted regions to access their content without detection. Libraries and civil-rights groups host onion services to protect vulnerable populations. Researchers study onion services to understand how hidden networks operate and what security flaws exist. The Tor Project itself documents legitimate onion services in its directory. Even some corporate security teams use onion addresses for internal communication or to receive vulnerability reports from security researchers. The existence of an onion URL does not indicate illegal activity; the technology is neutral and serves many lawful purposes. However, because onion services also provide strong anonymity, they have attracted illegal marketplaces and forums, which has shaped public perception.

Phishing is the primary risk when visiting onion URLs. Attackers register similar-looking onion addresses or create fake mirrors of popular sites to steal credentials, cryptocurrency, or personal data. Because onion addresses are long and difficult to remember, users often rely on bookmarks or search results, making them vulnerable to typos or redirects. A single character difference in a 56-character address leads to a completely different site. The safest way to verify an onion URL is to check the official announcement from the service operator, which should be PGP-signed with their public key. Many legitimate onion services publish their addresses only on their official clearnet website or through official social media accounts. If you cannot find a PGP-signed announcement or an official source, do not assume the address is real. Bookmark verified addresses and avoid clicking onion links from untrusted sources. The Useful Resources page of this site lists verified onion addresses for major services.

To visit an onion URL, you need the Tor Browser, which is the official tool maintained by the Tor Project. Tor Browser is a modified version of Firefox that routes all traffic through the Tor network and includes security hardening. Download Tor Browser only from the official Tor Project website, not from mirrors or third-party sources, to avoid malware. Once installed, open Tor Browser and paste the onion URL into the address bar. The browser will connect through the Tor network and display the site. Do not maximize your browser window or change display settings, as this can reduce anonymity by making your browser fingerprint unique. Disable JavaScript in Tor Browser settings if you visit untrusted onion sites, as malicious scripts can compromise your anonymity. Keep Tor Browser updated to receive security patches. If a site asks you to download software or enable plugins, be extremely cautious, as this is a common phishing tactic.

Onion services are not invulnerable. Law enforcement has successfully identified and shut down hidden services by exploiting operational security mistakes, not by breaking Tor's encryption. Court records from major darknet market seizures show that investigators often gained access through server compromise, malware, or the operator's own mistakes rather than by defeating the Tor protocol. Academic research on onion services, published by security researchers, documents that many hidden services have poor security practices, outdated software, and vulnerable configurations. The Tor Project's own documentation warns that running a hidden service requires careful operational security; mistakes in server administration, firewall rules, or metadata handling can leak the server's real IP address. This matters because it means that the existence of an onion address does not guarantee the operator is skilled or trustworthy. Many onion services disappear, change addresses, or turn out to be scams. The anonymity provided by Tor protects users from surveillance, but it also means you cannot easily verify the reputation or legitimacy of a service before visiting it.

Several red flags indicate a fake or malicious onion site. If a site asks you to send money or cryptocurrency upfront without a clear, verifiable reason, it is likely a scam. If the site's design is crude, contains spelling errors, or looks like a hastily copied version of another site, be suspicious. If the site claims to offer services that are illegal in most jurisdictions and asks for payment, assume it is either a scam or a law-enforcement honeypot. Legitimate onion services usually have a clear purpose, consistent branding, and a way to contact the operator. They often publish PGP keys for encrypted communication. If you cannot find any independent verification of a service's legitimacy, do not use it. Check whether the service is mentioned in security research, news articles, or community forums by people who claim to have used it. Even then, remember that onion services can be compromised or abandoned at any time. Never assume that because a site has been around for a while, it is safe.

The core principle is simple: never visit an onion URL unless you have verified it through an official or PGP-signed source. Start by identifying why you want to visit a particular onion service. If it is a news organization, journalist, or civil-rights group, find their official website and look for a link to their onion address. If it is a forum or community, check whether established security researchers or journalists have written about it and confirmed its address. Bookmark verified addresses in Tor Browser and do not rely on search results or links from other sites. If you encounter an onion URL in a forum post or social media, treat it as unverified until you can cross-check it. Keep Tor Browser updated and use a dedicated device or virtual machine if you plan to visit many onion sites. The Useful Resources page on this site contains links to verified onion addresses and guides for further reading. Start there before exploring on your own.