Onion URL: Understanding .onion Addresses and Tor Hidden Services

An onion URL is a special-use top-level domain address that exists only within the Tor network. Unlike standard URLs that resolve through the public DNS system, onion addresses are derived from cryptographic keys and do not require traditional domain registration. A v3 onion address consists of 56 alphanumeric characters followed by .onion, while older v2 addresses used 16 characters. Onion URLs are not indexed by conventional search engines and cannot be accessed through standard browsers. The address itself encodes the server's public key, meaning the address serves as both an identifier and a verification mechanism. This design prevents domain hijacking and ensures that an onion URL always points to the intended service, provided the address is correct.

When you connect to an onion URL through Tor Browser, your traffic is encrypted and routed through a minimum of three randomly selected Tor relays before reaching the hidden service. Each relay only knows the previous and next hop in the circuit, preventing any single point from seeing both your identity and the destination. The onion address itself is derived from the server's private key, which remains secret. The Tor network uses onion routing, a technique where each layer of encryption is peeled away at each relay, similar to layers of an onion. This multi-layered encryption means that even if a relay is compromised, only that relay's portion of the circuit is exposed. The hidden service protocol ensures that the server's IP address remains concealed while still being reachable through its onion URL. This architecture makes onion addresses suitable for sites requiring strong anonymity guarantees.

To access an onion URL securely, follow these steps:

1. Download Tor Browser from the official Tor Project website (verify the GPG signature of the installer).
2. Install Tor Browser and launch it; allow it to establish a connection to the Tor network.
3. Once connected, open a new tab and paste the onion URL into the address bar.
4. Tor Browser will route your request through the Tor network and load the hidden service.
5. Check the security indicator in the address bar to confirm you are using Tor.
6. Do not maximize your browser window, as this can leak your screen resolution to websites.
7. Disable JavaScript in Tor Browser settings if you are accessing sensitive sites.
8. Never open files downloaded from onion sites in applications that may reveal your identity.
9. Use a dedicated machine or virtual machine for accessing onion URLs if handling sensitive information.
10. Close Tor Browser when finished to terminate all Tor circuits.

Always verify the onion URL from a trusted source before visiting, as phishing clones are common.

Phishing clones are fraudulent copies of legitimate onion sites designed to steal credentials or funds. To identify a genuine onion URL:

• Verify the address from multiple independent sources; a single source can be compromised.
• Check for official PGP-signed announcements from the service operator.
• Compare the onion address character-by-character; even one wrong character leads to a different site.
• Look for HTTPS certificates issued for the onion domain (though not all legitimate sites use them).
• Examine the site's design and functionality against known screenshots from trusted archives.
• Check if the site displays a security notice or verification method unique to the legitimate service.
• Use onion address directories that verify uptime and authenticity, though treat these as reference points only.
• Be wary of sites requesting immediate action or unusual verification steps.
• Cross-reference the onion URL against community forums and documentation from the service operator.

No verification method is foolproof; always exercise caution and assume any site could be a clone until proven otherwise.

V3 onion addresses replaced the older v2 format to address security vulnerabilities and improve scalability. V3 addresses are 56 characters long compared to v2's 16 characters, providing a vastly larger address space and making brute-force attacks computationally infeasible. The v3 protocol uses stronger cryptography, specifically Ed25519 keys instead of RSA, which resists known attacks better. V3 addresses also include a checksum and version identifier, allowing detection of typos and preventing accidental use of malformed addresses. The Tor Project deprecated v2 support in 2021, meaning new hidden services should use v3. However, some older onion sites may still operate on v2 addresses. When accessing an onion URL, verify whether it is v3 or v2 and ensure your Tor Browser version supports both if needed. V3 addresses are the current standard and offer stronger security guarantees for both users and service operators.

Even when using Tor and onion URLs, user behavior can leak identity:

• Maximizing the browser window reveals screen resolution to websites, aiding fingerprinting.
• Using plugins or extensions in Tor Browser can bypass Tor routing or enable tracking.
• Logging into personal accounts on onion sites defeats anonymity; use separate identities.
• Torrenting over Tor is ineffective; torrent clients typically bypass Tor and expose your IP.
• Enabling JavaScript on untrusted onion sites can execute code that reveals your real IP.
• Using the same username across multiple onion sites allows correlation of your activity.
• Visiting onion URLs while also using a VPN can create confusion about your threat model.
• Leaving Tor Browser open for extended periods increases the window for correlation attacks.
• Adjusting Tor Browser settings from defaults can make your browser fingerprint unique and identifiable.
• Assuming Tor alone protects you from malware; malicious onion sites can still distribute exploits.

Anonymity requires consistent operational security practices, not just technical tools.

Tor, VPN, and I2P are distinct technologies with different anonymity models. Tor routes traffic through multiple relays operated by volunteers worldwide, providing strong anonymity but slower speeds. Onion URLs are native to Tor and offer mutual anonymity between user and server. A VPN encrypts traffic through a single provider's server, offering privacy from your ISP but requiring trust in the VPN operator; VPNs do not natively support onion URLs. I2P is a separate network designed for internal communication with lower latency than Tor but smaller user base and less mature ecosystem. Onion URLs cannot be accessed through VPNs or I2P without Tor. Using a VPN and Tor together adds complexity and does not necessarily increase anonymity; in some cases, it can reduce it by creating a unique fingerprint. For accessing onion URLs specifically, Tor Browser is the intended tool. Each network serves different use cases; Tor is optimal for accessing onion addresses and strong anonymity, while VPNs suit privacy from ISPs, and I2P suits low-latency internal networks.