Onion Address: Complete Guide to .onion Domains and Tor Hidden Services

An onion address functions as a unique identifier for a hidden service on the Tor network. Unlike standard domain names that resolve through DNS servers, onion addresses are generated cryptographically by the Tor software itself. When you connect to an onion address, your traffic is encrypted and routed through a series of Tor relays, with each relay only knowing the previous and next hop in the circuit. This layered routing is why the network is called Tor—The Onion Router. The address itself is derived from the service's public key, meaning the address is mathematically tied to the server's identity. This prevents impersonation at the protocol level, though phishing clones using similar addresses remain a practical threat.

Tor hidden services use two main address formats. Version 2 (v2) addresses are 16 characters long and use 80-bit keys, but they were deprecated in 2021 due to cryptographic vulnerabilities. Version 3 (v3) addresses are 56 characters long and use 256-bit keys, providing stronger security against brute-force attacks and future cryptanalysis. All new onion services should use v3 addresses. When accessing an onion site, check which version you are using—Tor Browser displays this information in the connection details. If you encounter a v2 address, be aware it may no longer receive security updates from the Tor Project. The transition to v3 is ongoing, and legitimate services continue migrating their addresses.

Accessing an onion address requires Tor Browser, the official tool maintained by the Tor Project. Install Tor Browser from the official source only, never from third-party mirrors. Open Tor Browser, wait for the connection to establish, then enter the onion address in the address bar. Tor Browser will route your traffic through the Tor network automatically. Do not maximize your browser window—this can leak your screen resolution to websites. Disable JavaScript in Tor Browser settings if you are accessing sensitive content, as JavaScript can potentially bypass Tor routing. Keep Tor Browser updated to receive security patches. Never use a VPN in front of Tor or Tor in front of a VPN unless you have a specific threat model requiring it; this can degrade anonymity.

Phishing clones are fraudulent onion sites designed to mimic legitimate services and steal credentials or funds. To verify a genuine onion address, obtain it from multiple independent sources—official websites, PGP-signed announcements, or community forums. Check for PGP signatures on address announcements; legitimate services publish their public keys and sign address updates. Compare the full address character-by-character; phishing clones often use similar but slightly different addresses. Bookmark verified addresses in Tor Browser to avoid typing errors. Be skeptical of addresses shared in unverified channels. If a site asks for credentials or payment, verify the address before proceeding. The Tor Project's official documentation lists known legitimate onion services; cross-reference unfamiliar addresses there.

Several behaviors can leak your identity despite using Tor. Logging into personal accounts on onion sites while also using them on clearnet sites allows correlation attacks linking both identities. Filling out forms with real personal information defeats anonymity. Maximizing your browser window reveals screen resolution, which combined with other data can identify you. Using plugins or extensions not vetted for Tor can introduce vulnerabilities. Torrenting over Tor is ineffective because BitTorrent leaks your IP address outside Tor; use Tor for HTTP/HTTPS traffic only. Assuming Tor alone protects you from malware is dangerous—malware can still capture keystrokes or exfiltrate data. Visiting onion addresses from a non-Tor browser or using Tor Browser with JavaScript enabled on untrusted sites increases attack surface. Treat Tor as one layer of a broader security practice, not as complete protection.

Tor, VPN, and I2P are three distinct privacy tools with different architectures. Tor routes traffic through volunteer-run relays and is designed for anonymity; onion addresses are native to Tor and provide bidirectional anonymity. VPNs route traffic through a single provider's server; they offer encryption but rely on provider trustworthiness and do not provide the same anonymity guarantees as Tor. I2P is a decentralized network similar to Tor but optimized for internal communication; it does not natively support clearnet access like Tor does. Onion addresses only work on Tor—they cannot be accessed via VPN or I2P. For accessing onion addresses, Tor is the only option. For general privacy, VPNs and Tor serve different use cases; Tor is stronger for anonymity but slower, while VPNs are faster but require trusting the provider. I2P is useful for specific peer-to-peer applications but has a smaller user base.

Onion address directories and search engines help users discover legitimate hidden services. These directories maintain lists of verified onion sites with descriptions and uptime status. Unlike clearnet search engines, onion indexes do not crawl the entire hidden service space; they rely on submissions and manual verification. Directories typically display whether a site is currently online and may show historical uptime data. Some directories include user reviews and PGP signature verification. When using a directory, verify the directory's own onion address through multiple sources to avoid accessing a phishing clone of the directory itself. Best practices include checking multiple directories for consistency and cross-referencing addresses with official project announcements. Directories are useful starting points but should not be your only source of verification for sensitive services.