Understanding Tor Onion Links: Verification and Safety

An onion link is a special-use top-level domain address that points to a hidden service on the Tor network. Instead of routing through standard DNS and internet infrastructure, traffic to a .onion address is encrypted and bounced through multiple Tor relays before reaching the destination server. The address itself is derived from the server's public key, which means the address is cryptographically tied to the service.

Onion links were designed by the Tor Project to enable websites and services to operate without revealing their physical location or IP address. This makes them useful for journalists, activists, whistleblowers, and ordinary people in countries with heavy internet censorship. However, the same anonymity that protects legitimate users also attracts bad actors. Understanding the technical basis of these links is the first step to using them safely.

When you type a .onion address into the Tor browser and press Enter, your browser does not contact a traditional DNS server. Instead, the Tor client resolves the address by querying the Tor network's distributed directory. The Tor network then establishes a connection through a series of encrypted relays, eventually reaching the hidden service.

This process is slower than visiting a regular website because your traffic is encrypted and routed through multiple hops. The trade-off is that neither the hidden service nor any observer on the network can easily determine your real IP address. The onion address itself is a long string of characters (typically 16 characters in v2 addresses, 56 in v3 addresses) that serves as both the identifier and a proof of the service's authenticity. If the address changes, the service has changed, and you should verify it through an official channel before trusting it.

Because onion addresses are long, difficult to remember, and not human-readable, users often rely on links shared in forums, on Reddit, or in chat messages. This creates an opportunity for attackers. A scammer can register a new .onion address and set up a website that looks identical to a popular marketplace or forum. Users who paste the wrong link or click a typo-squatted address end up on the fake site instead.

Phishing clones of popular onion services have been documented repeatedly. An attacker might create a site that mimics the login page of a well-known forum or market, harvest credentials, and then disappear. Because onion addresses do not have a human-readable name, there is no brand protection in the traditional sense. The only way to verify that you are on the real site is to confirm the address through an official, PGP-signed announcement or a trusted source that has verified the address independently.

Verification requires multiple steps and a healthy skepticism of any link you find online.

1. Find the official announcement channel for the service. This might be a PGP-signed post on a forum, a Twitter account, or a dedicated verification page.
2. Check the PGP signature on the announcement using the service's public key. If the signature is valid, the announcement has not been tampered with.
3. Compare the onion address in the signed announcement with the link you are about to visit. They must match exactly, character for character.
4. Verify the PGP key itself by checking it against multiple independent sources. Do not trust a key from a single location.
5. If you cannot find a signed announcement, do not visit the site. Wait until you can verify it through an official channel.

Many services publish their onion addresses on the Useful Resources page of this site and on the Tor Project's official listings. Cross-referencing multiple sources reduces the risk of landing on a clone.

Users often make predictable errors that expose them to phishing and scams. The most common mistake is clicking a link from an untrusted source without verifying the address. A link shared on Reddit, in a forum post, or in a private message may be outdated, typo-squatted, or intentionally malicious. Even if the person sharing it had good intentions, they may have been fooled themselves.

Another mistake is assuming that a site is legitimate because it has a professional appearance or because other users claim to have used it. Clones can be very convincing. A third mistake is visiting an onion link without running the Tor browser. If you use a regular browser or a VPN to access a .onion address, your traffic will not route through Tor, and the connection will fail or expose your real IP address. Always use the official Tor browser or a properly configured Tor client when visiting onion links.

Law-enforcement agencies have successfully identified and shut down onion services by exploiting operational security mistakes, not by breaking Tor encryption. Court records from high-profile cases show that operators were caught through traditional investigative work: payment analysis, metadata leaks, or mistakes in how they configured their servers. The Tor network itself has not been broken.

When a service is seized, its .onion address stops resolving, and users see a connection timeout or an error message. Scammers then register new addresses and claim to be the "official" successor, often with a message like "the old site was seized, use this new address instead." This is a classic social engineering tactic. If a service you used has been seized, verify any new address through independent sources before trusting it. The fact that a service went offline does not make a new address legitimate just because someone claims continuity.

Before visiting any onion link, work through this checklist.

• Do I have a specific reason to visit this address, or am I browsing out of curiosity. Curiosity alone is not a good reason.
• Have I verified this address through an official, PGP-signed announcement.
• Does the address match exactly with what I found in the signed announcement. No typos, no substitutions.
• Am I using the official Tor browser or a properly configured Tor client.
• Have I disabled JavaScript in the Tor browser settings to reduce attack surface.
• Do I understand what this service is and what I am about to do there.
• Am I prepared to lose any money or data I enter on this site.

If you cannot answer yes to most of these questions, do not visit the link. The safest onion links are the ones you never need to use. If you do need to visit one, verification and caution are your only real defenses.