How to Find Onion Sites: A Guide to .Onion Addresses and Tor Directories

Onion sites are web services hosted on the Tor network and accessed through .onion addresses rather than standard domain names. A .onion address is a cryptographic identifier that routes traffic through multiple Tor relays, encrypting it at each hop. These addresses are typically 56 characters long (v3 addresses) and appear as random alphanumeric strings followed by .onion. Onion sites serve many purposes: privacy-focused news outlets publish mirrors to reach readers in censored regions, organizations host whistleblowing platforms, and individuals run forums and communication services designed for anonymity. The .onion infrastructure is maintained by the Tor Project and relies on distributed routing rather than centralized DNS servers, making it resistant to takedown and surveillance.

Onion directories function as indexes of active .onion addresses, similar to traditional web directories but specialized for hidden services. These directories crawl onion sites, verify uptime, and catalog them by category. Search engines designed for onion sites use similar indexing methods but allow keyword searches across multiple hidden services. Unlike surface web search engines, onion search tools face challenges because .onion sites are not indexed by standard search infrastructure and many are intentionally unlisted. Directories maintain uptime checks to filter out dead links and phishing clones. Some directories are manually curated, while others use automated crawlers. The most reliable directories display verification information such as PGP signatures, last-checked timestamps, and operator contact details. Users should cross-reference multiple directories to confirm that an address is current and legitimate.

Locating good onion sites requires verification steps to avoid phishing clones and malicious mirrors. First, confirm the .onion address through multiple independent sources—check community discussions, official project pages, and established directories. Phishing clones often use addresses that closely resemble legitimate ones, differing by a single character. Second, verify PGP signatures if the site operator publishes them; this confirms the address has not been altered. Third, check the site's SSL certificate within Tor Browser; legitimate onion sites use HTTPS and display certificate details. Fourth, review the site's history in archived discussions or Reddit communities dedicated to onion sites to see if other users have reported it as active. Fifth, look for consistency in site design and content—sudden changes may indicate a compromise. Never trust an onion site that requests payment or personal information without established reputation and multiple verification sources.

Accessing onion sites requires Tor Browser, which is the official tool maintained by the Tor Project for routing traffic through the Tor network. Installation steps: download Tor Browser from the official Tor Project website, verify the file signature using the provided PGP key, extract the archive, and launch the application. Tor Browser is based on Firefox and includes pre-configured privacy settings that disable JavaScript, block plugins, and prevent DNS leaks. Once launched, Tor Browser automatically connects to the Tor network and displays a connection status. To access an onion site, paste the .onion address into the address bar and press Enter. Connection times vary depending on Tor network load and your relay path; initial connections may take 10-30 seconds. Do not maximize your browser window, as this can reveal your screen resolution to websites. Disable browser extensions and do not install additional add-ons, as they may compromise anonymity. Keep Tor Browser updated to receive security patches.

Onion addresses exist in two versions: v2 (16 characters) and v3 (56 characters). Version 2 addresses were the original standard but are now deprecated due to security vulnerabilities in their cryptographic design. The Tor Project began phasing out v2 addresses in 2020 and completed the deprecation in 2021. Version 3 addresses use stronger elliptic-curve cryptography, making them resistant to brute-force attacks and providing better protection against certain types of network analysis. A v3 address example appears as a long string of lowercase letters and numbers ending in .onion. If you encounter a v2 address (16 characters), the site is either outdated or no longer maintained by its operator. Reliable directories now exclusively list v3 addresses. When searching for onion sites, prioritize v3 addresses and treat v2 addresses as potentially abandoned. The Tor Project's official documentation specifies that v3 is the current standard for all new onion services.

Users accessing onion sites often make operational security errors that undermine anonymity. First, maximizing the browser window reveals screen resolution, which can be used to fingerprint users. Keep the window at default size. Second, enabling plugins or extensions adds attack surface and may leak real IP addresses. Tor Browser disables these by default; do not re-enable them. Third, visiting onion sites while also using your regular internet connection without a VPN can create timing correlations that link your Tor activity to your identity. Use Tor Browser exclusively for onion access. Fourth, filling in personal information on onion sites defeats anonymity; assume all data entered is logged. Fifth, using the same username across multiple onion sites allows correlation attacks. Create unique identifiers for each service. Sixth, visiting onion sites from a shared computer without clearing Tor Browser's cache allows other users to see your browsing history. Always clear cache and cookies after sessions. Seventh, clicking links from untrusted sources may redirect you to phishing sites; verify addresses manually.

Three technologies enable anonymous internet access: Tor, VPN, and I2P. Tor routes traffic through multiple volunteer-operated relays, encrypting it at each layer, and is specifically designed for onion site access. Tor's strength is its decentralized architecture and strong anonymity guarantees; its weakness is slower speeds due to multiple hops. VPN services route traffic through a single provider's server, offering faster speeds but requiring trust in the VPN operator. VPNs do not natively support .onion addresses and are designed for general privacy rather than anonymity. I2P is a decentralized network similar to Tor but optimized for internal communication and file-sharing; it has fewer users and less established infrastructure than Tor. For accessing onion sites specifically, Tor Browser is the only reliable option because .onion addresses are routed exclusively through the Tor network. VPNs and I2P cannot access .onion services. Using a VPN with Tor adds complexity and may reduce anonymity if the VPN logs traffic. The Tor Project recommends using Tor Browser alone for onion site access.