Tor Onion .com Addresses: Technical Guide to Onion Sites and the Tor Network

A .onion address is a special-use top-level domain designating an anonymous hidden service on the Tor network. Unlike .com or .org domains, which resolve through the standard DNS system and route over the public internet, .onion addresses are generated cryptographically and exist only within the Tor network. Each .onion address is derived from a public key belonging to the hidden service operator. When you visit a .onion site, your connection is routed through multiple Tor relays before reaching the destination server, which itself remains hidden behind the Tor network. This architecture means the server's physical location and IP address are not exposed to visitors. The address itself contains no geographic or identifying information about the server. V2 addresses were 16 characters long and used 80-bit keys; V3 addresses are 56 characters long and use 256-bit keys, providing stronger cryptographic security against future attacks.

When you access a .onion address through Tor Browser, your request does not use DNS lookups. Instead, Tor maintains a distributed hash table (DHT) of introduction points for hidden services. Your Tor client connects to three randomly selected relays, forming a circuit. The final relay in this circuit connects to an introduction point advertised by the hidden service. The hidden service operator also maintains a separate circuit to the same introduction point. Through this rendezvous point, the two circuits meet without either party knowing the other's IP address. The .onion address itself is a hashed version of the service's public key, so the address serves as both an identifier and a cryptographic proof of authenticity. This design ensures that the .onion address cannot be spoofed or redirected by DNS hijacking, network operators, or man-in-the-middle attacks. All traffic is encrypted end-to-end, and the service operator cannot see the visitor's real IP address.

1. Download Tor Browser only from the official Tor Project website (torproject.org). Verify the GPG signature of the installer using the project's public key to confirm authenticity.
2. Install Tor Browser in a dedicated directory and do not move or rename files after installation.
3. Launch Tor Browser and allow it to connect to the Tor network. The first connection may take 30–60 seconds as it bootstraps relays.
4. Once connected, the onion icon in the address bar will be solid.
5. To visit a .onion address, paste it into the address bar and press Enter. Do not modify the address or add http:// prefixes manually.
6. Keep Tor Browser updated to the latest version to receive security patches.
7. Do not maximize your browser window, as this can reveal your screen resolution to websites.
8. Disable plugins and extensions unless absolutely necessary, as they can bypass Tor routing.
9. Do not open files downloaded from .onion sites in applications that may connect to the internet without Tor.
10. Use a dedicated device or virtual machine for sensitive Tor activities if operational security is critical.

Phishing clones are fake .onion sites designed to steal credentials or private keys by mimicking legitimate services. Because .onion addresses are cryptographically tied to their public keys, the address itself is the only reliable identifier of authenticity. A genuine mirror will have the same .onion address every time; if the address changes, it is not the same service. Verify addresses through multiple independent sources: official project documentation, PGP-signed announcements, or community discussions on platforms like Reddit where users discuss tor onion sites. Check for HTTPS certificates within Tor Browser; legitimate .onion services often use self-signed certificates, which is normal and does not indicate fraud. Look for security headers and consistent design elements. Phishing clones often have subtle differences in layout, spelling, or functionality. If a site asks you to enter credentials or private keys, verify the .onion address before proceeding. Use browser developer tools to inspect network requests and ensure traffic is not leaking outside Tor. Never trust a .onion address shared in unsolicited messages or advertisements. Cross-reference addresses with archived versions or historical records if available.

V3 onion addresses are the current standard for hidden services on the Tor network. They are 56 characters long, compared to 16 characters for the older V2 format. V3 addresses use 256-bit elliptic curve cryptography, whereas V2 used 1024-bit RSA. This stronger cryptography protects against potential future attacks on the address generation algorithm. V3 addresses also include a checksum, allowing Tor Browser to detect typos or corruption in the address before attempting connection. The longer address length makes V3 addresses harder to brute-force or guess. Services that migrated from V2 to V3 have different addresses; the old V2 address will not resolve if the service has fully transitioned. V3 addresses are more resistant to enumeration attacks, where an attacker attempts to discover hidden services by generating random addresses and checking if they respond. The Tor Project recommends that all new hidden services use V3 addresses. Existing V2 services are gradually being deprecated as operators migrate to the newer standard. When accessing a .onion site, check whether it uses a V3 address; if it still uses V2, consider whether the service has been maintained recently.

Maximizing the browser window reveals your screen resolution to websites, which can be used to fingerprint your device. Disabling JavaScript in Tor Browser is recommended for security, but some sites require it; enabling JavaScript increases the risk of deanonymization through exploits. Torrenting over Tor is ineffective and dangerous; torrent clients typically leak your real IP address even when Tor is enabled. Visiting both Tor and clearnet sites in the same browser session can link your identities if you log into accounts on both networks. Using plugins or extensions in Tor Browser bypasses Tor routing for certain traffic types. Downloading files and opening them in applications that connect to the internet without Tor can expose your identity. Entering personal information or usernames associated with your real identity defeats the purpose of anonymity. Assuming that Tor alone provides complete security is a mistake; operational security practices are equally important. Connecting to Tor from a network that monitors traffic (such as a workplace or school) may flag your use of Tor, even if the content of your traffic is encrypted. Using outdated versions of Tor Browser leaves you vulnerable to known exploits. Visiting .onion sites through VPN services that claim to provide Tor access is risky; use Tor Browser directly instead.

Tor routes traffic through multiple volunteer-operated relays, with each relay knowing only the previous and next hop in the circuit. This design provides strong anonymity against network-level surveillance. VPNs route all traffic through a single provider's server, which can see your real IP address and all your traffic; anonymity depends entirely on the provider's policies and trustworthiness. I2P (Invisible Internet Project) uses a similar circuit-based approach to Tor but is designed primarily for internal network communication rather than accessing external sites. Tor is optimized for accessing both hidden services (.onion sites) and the regular internet anonymously. VPNs are faster than Tor for general browsing but do not hide your use of a VPN from your internet service provider. I2P has lower latency than Tor, making it better for real-time applications, but has a smaller user base and fewer exit nodes. Tor's strength is its large network of relays and widespread adoption, which makes traffic analysis more difficult. VPNs are easier to set up and faster, but they centralize trust in a single entity. I2P is more specialized and requires additional configuration for accessing external sites. For accessing .onion sites specifically, only Tor Browser provides native support; VPNs and I2P cannot directly resolve .onion addresses.