Onion Router Sites: How Tor Addresses Work and What They Are

Onion router sites are web services hosted on the Tor network and accessed exclusively through .onion addresses. These addresses are cryptographic hashes generated from the site's public key, making them long, seemingly random strings of characters followed by .onion. Unlike standard domain names, .onion addresses are not registered with a central authority; they are derived from the hosting server's configuration. A v3 .onion address, the current standard, is 56 characters long and provides stronger security than the older v2 format. Each .onion address is unique to its service and cannot be spoofed without access to the private key. The Tor routing protocol ensures that traffic to these sites passes through at least three encrypted relays before reaching the destination, meaning neither the user's ISP nor the site operator can easily determine the other's real IP address.

Onion services operate using a multi-layer encryption system. When you connect to an onion router site through Tor, your traffic is encrypted and routed through a series of volunteer-operated relays. The Tor client on your device selects three relays at random: an entry node, a middle relay, and an exit node. For onion sites, the connection terminates at the hidden service itself, not at an exit node, because the .onion address resolves within the Tor network. The site operator publishes their .onion address through Tor's distributed hash table, allowing clients to discover and connect to it. Each layer of encryption is removed as the traffic passes through each relay, so no single relay sees both the originating user and the destination. This design means the site operator cannot determine your real IP address, and your ISP cannot see that you are accessing a specific .onion site, only that you are using Tor.

Phishing clones of legitimate onion sites are a significant security risk. Because .onion addresses are long and difficult to memorize, users often rely on bookmarks or search results, making them vulnerable to redirects to fraudulent mirrors. To verify a genuine onion site, follow these steps:

1. Obtain the .onion address from the official source—typically the site's clearnet (standard internet) mirror or an official announcement from the operators.
2. Check for a PGP signature or cryptographic proof of authenticity published by the site operators.
3. Compare the address character-by-character with the official version; even a single character difference indicates a different site.
4. Look for HTTPS certificates within the Tor browser; legitimate sites often display security indicators.
5. Verify the site's onion address through multiple independent sources before bookmarking it.

Many legitimate onion sites publish their addresses on their clearnet mirrors or through official social media channels. If a site's address differs from what you have recorded, do not proceed until you have confirmed the new address through an official channel.

Onion sites catalog and index resources help users discover legitimate services on the Tor network. These directories vary in scope and curation; some focus on news outlets and privacy tools, while others catalog marketplaces and forums. Official onion site indexes are typically maintained by the services themselves or by community-driven projects. When using an onion sites catalog, verify that the index itself is accessed through a legitimate .onion address and that the links it provides match official sources. Many catalogs include user reviews and verification status, though these should be cross-referenced with official announcements. The Tor Project itself maintains documentation of known onion services, and many privacy-focused organizations publish their own .onion addresses on their clearnet sites. For marketplace verification, consult the Verified Marketplaces section of this site to confirm legitimacy before engaging with any service.

Several operational security mistakes can compromise anonymity when using onion router sites. Maximizing your browser window reveals your screen resolution to the site, allowing fingerprinting attacks; keep the Tor browser window at its default size. Disabling JavaScript in the Tor browser settings is recommended, as malicious scripts can leak your real IP address. Avoid opening multiple tabs to different onion sites simultaneously, as this increases the risk of cross-site tracking. Do not enable plugins or extensions in the Tor browser unless absolutely necessary, as they may bypass Tor routing. Typing in the address bar or using search engines while connected to an onion site can leak queries to your ISP. Never maximize the browser window or change display settings, as these can be used to identify you across sessions. If you use a VPN alongside Tor, ensure it is configured correctly; misconfiguration can create a false sense of security while actually reducing anonymity.

Tor, VPN, and I2P are three distinct privacy technologies with different strengths. Tor routes traffic through multiple volunteer relays and is designed for anonymity; it is slower but provides strong protection against traffic analysis. A VPN encrypts traffic to a single server operated by a commercial provider; it is faster than Tor but relies on the VPN operator's trustworthiness and does not provide the same level of anonymity. I2P is a decentralized network designed for internal communication and file sharing; it is less widely used than Tor and offers different privacy guarantees. For accessing onion router sites, Tor is the only option, as .onion addresses exist only within the Tor network. VPNs and I2P cannot access .onion services. If you use a VPN, it should be configured to route through Tor, not alongside it, to avoid configuration errors. Each technology has legitimate uses; the choice depends on your threat model and the specific service you are accessing.

The Tor browser is the recommended tool for accessing onion router sites. To install it safely, follow these steps:

1. Visit the official Tor Project website through a standard browser.
2. Download the Tor browser from the official download page; verify the file signature using the provided PGP key.
3. Extract the downloaded file to a directory of your choice.
4. Launch the Tor browser executable; do not modify its default settings unless you understand the security implications.
5. Allow the browser to connect to the Tor network; this may take several seconds.
6. Verify your connection by visiting the Tor Project's check page.

Once connected, you can access onion sites by typing their .onion address into the address bar. Keep the Tor browser updated to receive security patches. Do not install additional extensions or modify security settings unless you have a specific reason and understand the consequences. If you are using a shared computer, consider using a dedicated user account for Tor browsing to prevent other users from accessing your bookmarks or history.