Onion Sites List 2024: How to Find and Verify Active .Onion Addresses

An onion sites list is a curated or automated index of .onion addresses—services accessible only through the Tor network. These lists serve as directories because onion addresses are long, random strings (v2 addresses are 16 characters; v3 addresses are 56 characters) that users cannot easily guess or remember. Without a list or directory, discovering active services requires either word-of-mouth, forum posts, or trial-and-error. Lists matter because the Tor network is dynamic: services go offline, migrate to new addresses, or are seized by law enforcement. A 2024 list reflects current operational status, whereas older directories may point to dead addresses or honeypots. Verification is critical because attackers create phishing clones—fake mirrors of popular sites—to harvest credentials or deploy malware.

An onion address is a cryptographic identifier generated by a Tor hidden service. When you connect to an .onion site, your traffic is routed through multiple Tor relays before reaching the destination, and the destination's location remains hidden from you. The Tor network uses onion routing: your data is encrypted in layers, and each relay removes one layer, learning only the next hop. V3 addresses (introduced in 2019) use stronger cryptography than v2 addresses and are now the standard. The address itself encodes the service's public key, so the address cannot be spoofed—if the address changes, it is a different service. This design means onion sites do not have traditional DNS entries; they are discovered through directories, word-of-mouth, or direct sharing of the address. A list aggregates these addresses for convenience, but the list itself is not authoritative—only the service operator controls the true address.

A phishing clone is a fake .onion site designed to look identical to a legitimate service but hosted at a different address. Attackers use clones to steal login credentials, private keys, or personal data. To verify a genuine mirror or service, follow these steps:

1. Check the official announcement channel—visit the service's clearnet (regular internet) website or official social media account for the correct .onion address.
2. Verify PGP signatures if provided—many services publish their onion address signed with a PGP key. Download the key from multiple sources and verify the signature matches.
3. Compare the address with multiple independent sources—if five different directories list the same address, it is more likely legitimate than if only one source mentions it.
4. Look for HTTPS and certificate warnings—onion sites often use self-signed certificates; this is normal, but the certificate subject should match the service name.
5. Test with a small transaction or action first—do not immediately trust a site with sensitive data; verify basic functionality.
6. Check the site's onion address history—services that have operated for years at the same address are less likely to be clones than newly created addresses.

Phishing clones often have slightly different addresses (one character off) or appear in only one or two directories. If you cannot verify an address through official channels, treat it as unverified.

V2 onion addresses are 16 characters long and use RSA-1024 encryption. V3 addresses are 56 characters long and use elliptic-curve cryptography (Ed25519). Tor deprecated v2 addresses in 2021 because RSA-1024 is considered weak by modern standards; v2 addresses are no longer functional on the Tor network as of late 2021. V3 addresses offer stronger security: they are harder to brute-force, resistant to certain cryptographic attacks, and support better key rotation. If you encounter a list that includes v2 addresses, it is outdated. A current 2024 onion sites list should contain only v3 addresses. The longer v3 address format also makes typos more likely, so double-check addresses character-by-character when entering them manually. Many services have migrated from v2 to v3; if you find an old v2 address, the service has likely moved to a new v3 address.

An onion index or catalog is a searchable database of .onion addresses, often organized by category (forums, markets, news, services). Indexes are maintained by volunteers or automated systems that crawl the Tor network. Some indexes are centralized (hosted on a single server), while others are distributed (mirrored across multiple addresses). Centralized indexes are faster but vulnerable to seizure; distributed indexes are more resilient but may have inconsistent data across mirrors. Most indexes do not verify whether listed addresses are active—they rely on user reports or automated checks. This means a list may include dead addresses or honeypots. A reliable index typically includes metadata such as last-seen date, category tags, and user ratings. Some indexes are available as free, downloadable lists (often on GitHub or similar platforms), while others are only accessible via .onion addresses. When using a list, cross-reference addresses with multiple sources to reduce the risk of following a phishing clone.

Even if you access an onion site through Tor, mistakes can leak your identity. Common errors include:

1. Running plugins or extensions that bypass Tor—disable JavaScript, Flash, and browser plugins before visiting onion sites.
2. Maximizing your browser window—websites can detect your screen resolution; use the Tor Browser's default window size to blend in with other users.
3. Typing personal information—do not use usernames, email addresses, or details linked to your real identity.
4. Mixing Tor and clearnet activity—do not visit your regular email or social media accounts in the same browser session as onion sites.
5. Enabling plugins or extensions—the Tor Browser disables these by default for security; do not re-enable them.
6. Using outdated Tor Browser versions—update regularly to patch security vulnerabilities.
7. Assuming Tor alone is sufficient—use additional OpSec measures such as a dedicated virtual machine or operating system.
8. Clicking on links without verifying the address—phishing links can redirect you to clearnet sites or malicious .onion clones.

The Tor Browser is designed to prevent these mistakes, but user behavior remains the weakest link. Always assume that the site operator can see your username, posts, and activity on their server—Tor protects your IP address, not your account privacy.

A current onion sites list can be found through several methods:

1. Search GitHub repositories—many developers maintain public lists of active onion addresses, often updated regularly by the community.
2. Visit established onion news sites—some news outlets maintain directories of other onion services.
3. Check forum announcements—active Tor forums often have pinned threads listing verified services.
4. Use onion search engines—specialized search engines index .onion sites, though results vary in accuracy and freshness.
5. Access distributed mirrors—some lists are mirrored across multiple .onion addresses to prevent single points of failure.

When accessing a list, use the Tor Browser and verify the address through multiple independent sources before trusting it. Lists hosted on clearnet sites (regular internet) are accessible without Tor but may be outdated or incomplete. Lists hosted on .onion addresses are more current but require Tor access. Always cross-reference a list with official announcements from the services you plan to use. If you are looking for verified marketplaces or specific services, consult the Verified Marketplaces page on this site for curated, regularly updated information.