Onion URLs: What They Are and How to Find Verified Addresses

Onion URLs are special-use top-level domain addresses ending in .onion, generated through Tor's hidden service protocol. Each onion address is a 56-character alphanumeric string (v3 addresses) derived from the site operator's public key, making it mathematically tied to the server's identity. When you connect to an onion URL through Tor Browser, your traffic is encrypted and routed through multiple Tor relays before reaching the hidden service. This multi-layer encryption is why the system is called onion routing. The address itself contains no geographic information and cannot be resolved through standard DNS lookups. Instead, Tor's distributed directory stores information about active onion services, allowing your client to locate and connect to them securely.

Onion addresses come in two versions. V2 addresses are 16 characters long and use older cryptographic standards; Tor deprecated v2 support in 2021 due to security vulnerabilities. V3 addresses are 56 characters and use modern elliptic-curve cryptography, providing stronger security against brute-force attacks and cryptanalysis. All new onion services should use v3 format. When evaluating onion URLs, verify that the address is v3 (56 characters) rather than v2. The longer address space in v3 makes it computationally infeasible to generate vanity addresses or impersonate existing services through collision attacks. If you encounter a v2 address, treat it with caution as it may no longer receive security updates.

Phishing clones are fake onion sites designed to steal credentials or private keys by mimicking legitimate services. To verify a genuine onion URL: first, confirm the address through multiple independent sources (official project documentation, PGP-signed announcements, or established directories). Second, check for HTTPS certificates and valid security indicators in Tor Browser. Third, verify PGP signatures on any downloads or messages from the site operator using their published public key. Legitimate onion services often display their v3 address prominently and may publish it alongside a PGP fingerprint. Never trust an onion URL from a single source, especially if it arrives via email or chat. Cross-reference addresses on the Verified Marketplaces page or through official project channels before entering sensitive information.

To access onion URLs safely, download Tor Browser from the official Tor Project website (not mirrors or third-party sources). Verify the PGP signature of the installer using the Tor Project's public key before running it. Install Tor Browser in a dedicated directory and do not modify its default security settings. Launch Tor Browser and wait for the connection to complete; the browser will display a green onion icon when connected. Once connected, you can enter any onion URL into the address bar. Tor Browser automatically routes traffic through the Tor network and blocks plugins that could leak your IP address. Keep Tor Browser updated to receive security patches. Do not maximize the browser window, as this can reveal your screen resolution to websites. Disable JavaScript in Tor Browser's security settings if you need additional protection against fingerprinting attacks.

Users often undermine their anonymity through operational security failures. Do not maximize your Tor Browser window, as websites can detect your screen resolution and use it for fingerprinting. Avoid logging into personal accounts while accessing onion URLs, as this links your anonymous activity to your real identity. Do not enable plugins, extensions, or JavaScript unless absolutely necessary, as they can bypass Tor and leak your IP address. Never open files downloaded from onion sites in applications connected to the internet; use an isolated environment or air-gapped device. Do not assume that using Tor makes you anonymous if you provide identifying information voluntarily. Avoid using the same username across multiple onion sites. Do not resize or reposition your browser window, as this metadata can be used for tracking. If you need to access onion URLs from a restrictive network, use Tor bridges (configured in Tor Browser settings) to disguise your Tor traffic as regular HTTPS.

Tor, VPN, and I2P serve different purposes for privacy and anonymity. Tor routes traffic through multiple volunteer-operated relays and is designed for anonymity; onion URLs are only accessible through Tor. VPNs encrypt traffic through a single provider's server and are designed for privacy rather than anonymity; they require trusting a centralized provider. I2P is a decentralized network similar to Tor but optimized for internal communication; it has fewer exit nodes and is less suitable for accessing the public internet. Tor onion URLs provide stronger anonymity guarantees because the service operator does not learn your IP address, whereas VPN providers can see your traffic. However, Tor is slower due to multiple relay hops. For accessing onion URLs specifically, Tor Browser is the only secure option. VPNs and I2P cannot access .onion addresses. Choose Tor if anonymity is your priority; choose a VPN if you need speed and privacy from your ISP.

Onion directories and search engines index active .onion addresses, but not all listings are verified or legitimate. Use established directories that manually verify onion URLs and check for uptime regularly. When searching for a specific onion service, cross-reference the address across multiple sources before visiting. Look for directories that display verification status, uptime history, and PGP fingerprints alongside each listing. Avoid directories that accept unverified submissions or do not remove dead links. If you are looking for a particular service, start with official project documentation or PGP-signed announcements rather than directory searches. Some directories categorize onion URLs by type (forums, markets, news, etc.), which can help you identify legitimate services. Be aware that some onion URLs may host both legal and illegal content; directories may not distinguish between them. Always verify the address independently before trusting it with sensitive information or credentials.