Onion URL List: How to Find and Verify .onion Addresses

An onion URL is a Tor hidden service address, typically a 56-character string (v3 addresses) or 16 characters (deprecated v2 addresses) followed by .onion. These addresses are generated cryptographically and do not resolve on the standard DNS system; they only work within the Tor network. Onion URL lists serve as directories because Tor hidden services have no central registry. Without a list, users must know the exact address beforehand or risk landing on a phishing clone. Legitimate projects publish their onion addresses on official websites, GitHub repositories, or through PGP-signed announcements. A verified list reduces the attack surface by filtering out known fraudulent mirrors and outdated addresses.

Onion addresses are derived from the public key of a Tor hidden service using SHA-3 hashing. The resulting hash is encoded in base32 to produce the readable address. V3 addresses (current standard) are 56 characters long and include a checksum for typo detection. V2 addresses (deprecated since Tor 0.4.6) were 16 characters and are no longer supported. The address itself does not reveal the server's location or IP address; instead, it acts as a cryptographic identifier that Tor uses to route traffic through a series of relays. When you connect to an onion address, your client negotiates a circuit with the hidden service through introduction points, ensuring both parties remain anonymous. This design means that even if an address is listed publicly, the server remains hidden.

Reliable onion URL lists are maintained by independent projects, Tor documentation sites, and community-driven directories. Official Tor project resources provide links to legitimate mirrors and services. Some lists are hosted on GitHub as open repositories where users can contribute verified addresses. Reddit communities dedicated to Tor and the darknet sometimes share onion URLs, though these require extra scrutiny because anyone can post. The most trustworthy approach is to cross-reference multiple sources: check the official project website, verify PGP signatures on announcements, and look for consistency across independent lists. Never rely on a single source. Avoid lists that promise access to illegal marketplaces or claim to be 'complete'—no list is comprehensive, and such claims often signal phishing operations.

Phishing clones are fraudulent copies of legitimate onion sites designed to steal credentials or funds. Detection requires multiple verification steps. First, confirm the address against the official project website or PGP-signed announcement. Second, check the SSL/TLS certificate within Tor Browser—legitimate services display a green lock icon and a certificate issued to the correct onion domain. Third, compare the site's layout, text, and functionality against known screenshots or archived versions. Fourth, look for spelling errors, unusual domain variations, or addresses that are similar but not identical to the official one. PGP signature verification is the gold standard: download the project's public key from their official site, then verify any signed message or address list using a PGP tool. If a signature fails verification, the address is compromised or fraudulent.

V3 onion addresses are the current standard and are 56 characters long, including a checksum that detects typos. They use stronger cryptography (SHA-3 and Ed25519) than their predecessors. V2 addresses were 16 characters and relied on weaker hashing; Tor deprecated them in version 0.4.6 and removed support entirely in later releases. If you encounter a v2 address in an old list, it no longer works. Modern Tor Browser only connects to v3 addresses. When building or consulting an onion URL list, ensure all addresses are v3 format. The longer address may seem cumbersome, but the checksum reduces typos and the stronger cryptography improves security. Any legitimate project has migrated to v3; if a service still advertises a v2 address, it is either abandoned or operating a phishing clone.

Users often compromise their anonymity or security by mishandling onion URLs. Copying and pasting addresses from untrusted sources without verification is the most common error; this can lead to phishing sites that log credentials or inject malware. Using outdated lists or addresses no longer maintained by their operators wastes time and increases exposure to clones. Failing to update Tor Browser leaves you vulnerable to known exploits; always use the latest version. Mixing Tor usage with non-Tor activity on the same browser session can leak identifying information. Disabling JavaScript in Tor Browser is recommended for security, but some onion sites require it; enabling it selectively increases risk. Finally, trusting a single onion URL list without cross-referencing is dangerous. Treat every address as potentially fraudulent until verified through multiple independent sources.

Rather than relying solely on external lists, maintain a personal reference of verified addresses. Start by identifying the projects or services you need, then visit their official websites (not onion addresses initially) and locate their published onion URLs. Record the address, the date you verified it, and the source. Use PGP to verify any signed announcements. Store this reference in an encrypted file or password manager, separate from your Tor Browser profile. Periodically re-verify addresses by checking official sources for updates or deprecation notices. If a project announces a new onion address, update your reference and discard the old one. Document the verification method you used—this helps you spot inconsistencies if you re-verify later. This approach reduces reliance on third-party lists and gives you confidence in the addresses you use.