Onion Domains List: Directory of .onion Addresses and How They Work

Onion domains are special-use top-level domains that operate exclusively within the Tor network. Unlike traditional .com or .org domains, onion addresses are not registered through ICANN or any central authority. Instead, they are generated cryptographically by the server operator when they configure a hidden service. The .onion suffix was officially designated by IANA in RFC 7686 as a special-use domain. Each onion address is a hash of the server's public key, which means the address itself proves the server's identity—you cannot spoof an onion domain without possessing the corresponding private key. This self-authenticating property makes onion domains fundamentally different from clearnet domains, which rely on certificate authorities and DNS infrastructure.

Onion addresses come in two versions, each with distinct characteristics. Version 2 (v2) addresses are 16 characters long and use base32 encoding of a 80-bit hash. They were the standard for many years but are now deprecated due to cryptographic weaknesses. Version 3 (v3) addresses are 56 characters long and use base32 encoding of a 256-bit hash, providing significantly stronger security. v3 addresses are based on ed25519 elliptic-curve cryptography and are resistant to known attacks against v2. The Tor Project officially deprecated v2 support in Tor Browser version 9.0 and removed it entirely in later versions. When compiling an onion domains list, v3 addresses should be prioritized. A v3 address looks like this: thehiddenwiki2345678901234567890123456789012345678901234567. The longer format reflects the increased cryptographic strength and is the standard for new onion services.

Phishing clones are fake onion addresses designed to mimic legitimate services. They exploit users who mistype addresses or rely on outdated onion URL lists. To verify a genuine onion address, follow these steps: First, obtain the address from the official source—typically the service's clearnet website or an official announcement channel. Second, check the address format: v3 addresses are 56 characters, v2 are 16 characters. Third, verify the PGP signature if the service provides one; this cryptographically proves the address came from the service operator. Fourth, compare the address character-by-character with multiple independent sources. A single typo creates a completely different address. Many services publish their onion addresses alongside PGP signatures on their clearnet mirrors or in official documentation. Never rely solely on a single onion domains list or Reddit post; cross-reference multiple sources. Bookmarking verified addresses in Tor Browser prevents accidental visits to clones.

Onion routing is the underlying technology that makes onion addresses possible. When you connect to an onion address through Tor Browser, your traffic is encrypted and routed through a series of Tor relays before reaching the hidden service. Each relay decrypts one layer of encryption, revealing only the next relay's address—hence the name 'onion' for the layered encryption. The hidden service itself never learns your IP address; instead, it receives your traffic through Tor's rendezvous point system. The server operator also remains anonymous; their IP address is not exposed to visitors. This mutual anonymity is enforced by Tor's protocol, not by the onion address itself. The address is simply a way to locate and authenticate the service within the Tor network. Encryption happens at multiple levels: between your browser and the first Tor relay, between each relay, and between the final relay and the hidden service. This multi-layered encryption means that even if one relay is compromised, an attacker cannot decrypt the entire connection or identify both endpoints.

Several user errors can leak identity or location when accessing onion addresses, even though Tor Browser is running. First, resizing your browser window can enable fingerprinting; attackers correlate window dimensions with other data to identify users. Second, enabling browser plugins or extensions can bypass Tor and leak your real IP address. Third, maximizing the browser window or changing display settings creates a unique fingerprint. Fourth, visiting onion addresses while also using clearnet services in the same session can correlate your identity across both networks. Fifth, typing queries into search bars that are not Tor-aware can leak information. Sixth, disabling JavaScript or using non-standard Tor Browser configurations can introduce vulnerabilities. Seventh, assuming that accessing an onion address alone provides anonymity is incorrect; your behavior and traffic patterns can still be analyzed. The Tor Browser is designed with specific security defaults; deviating from them introduces risk. Always use the default settings, keep Tor Browser updated, and avoid mixing Tor and non-Tor traffic in the same session.

Tor, VPN, and I2P are three distinct approaches to anonymity and encrypted communication, each with different threat models. Tor provides strong anonymity through a large, decentralized network of relays operated by volunteers; your traffic is routed through at least three relays, and no single entity controls the network. VPNs encrypt traffic and route it through a single provider's server; anonymity depends entirely on the VPN provider's policies and trustworthiness. I2P is a decentralized network similar to Tor but optimized for internal communication and file-sharing; it provides strong anonymity for I2P-to-I2P communication but is less suitable for accessing external websites. Onion addresses are unique to Tor; they cannot be accessed via VPN or I2P. Tor is designed for general-purpose anonymity and accessing hidden services. VPNs are faster but do not provide the same level of anonymity. I2P is more resistant to traffic analysis but has a smaller user base. For accessing onion domains lists and hidden services, Tor is the appropriate tool. Each technology has legitimate uses; the choice depends on your specific privacy and security requirements.

Tor Browser is the official tool for accessing onion addresses safely. To install it securely, follow these steps: First, visit the official Tor Project website through your regular browser. Second, download the version appropriate for your operating system—Windows, macOS, or Linux. Third, verify the file's signature using the PGP key published on the Tor Project website; this confirms the file has not been tampered with. Fourth, extract the downloaded archive to a location of your choice. Fifth, launch Tor Browser by running the executable file. Sixth, allow Tor to connect to the network; this may take 10-30 seconds. Seventh, once connected, open a new tab and test your connection by visiting a Tor-check website. Eighth, do not modify Tor Browser's settings unless you have a specific reason; the defaults are optimized for security. Ninth, keep Tor Browser updated by checking for updates regularly or enabling automatic updates. Tenth, never install additional extensions or plugins unless absolutely necessary. Tor Browser is designed as a complete package; adding third-party software can introduce vulnerabilities. After installation, you can access onion addresses by typing them directly into the address bar, just as you would with clearnet URLs.