Understanding Tor URLs and Onion Addresses

A Tor URL is a web address that ends in .onion instead of .com, .org or another standard domain extension. These addresses are generated cryptographically and are not registered through traditional domain registrars. When you visit a Tor URL using Tor Browser, your connection is routed through multiple Tor relays, encrypting your traffic so that neither your internet service provider nor the website operator can easily identify you.

Onion addresses come in two lengths: the older v2 addresses were 16 characters long, but the Tor Project deprecated them in 2021 due to security concerns. Modern v3 onion addresses are 56 characters long and use stronger cryptography. A v3 address looks like this format: thisisanexampleaddressof56characterslong.onion. The long string is not random; it is a hash of the server's public key, which means the address itself proves the server's identity to Tor Browser.

When you access a Tor URL, Tor Browser does not connect directly to the website. Instead, it builds a circuit through at least three Tor relays, with each relay knowing only the previous and next hop in the chain. The final relay, called the exit node, connects to the onion service itself. However, onion services work differently: they do not need an exit node. Instead, the Tor network creates a rendezvous point between your client and the hidden service, so neither party learns the other's IP address.

This architecture means that a Tor URL and the server behind it can remain hidden from each other's network perspective. The website operator cannot see your real IP, and you cannot see theirs without breaking Tor. This is why onion addresses are used by journalists, activists, whistleblowers and organizations that need to protect both their users and their infrastructure from surveillance or censorship.

Many organizations and services operate legitimate Tor URLs. News outlets like ProPublica and BBC maintain onion mirrors so that readers in censored countries can access journalism without detection. Libraries, human rights organizations and government agencies in some countries publish onion addresses to help citizens communicate securely. The Tor Project itself runs an onion address where you can download Tor Browser and read documentation.

Private companies and individuals also run onion services for privacy-conscious users. Some offer email, messaging, file storage or other services exclusively or primarily over Tor. These services exist because their operators believe their users have a legitimate need for strong privacy. The presence of a .onion address does not indicate illegal activity; it indicates a choice to prioritize anonymity and resistance to censorship.

Because onion addresses are long, random-looking strings of characters, they are difficult to remember and easy to mistype. Attackers exploit this by creating fake onion addresses that look similar to legitimate ones, or by spreading links to counterfeit sites that mimic the real service. A user might think they are accessing a forum or marketplace but are actually on a phishing clone designed to steal their credentials or cryptocurrency.

The problem is worse because onion services are not indexed by search engines, so there is no central directory to verify which address is real. If you find a .onion link on Reddit, Twitter or a forum, you cannot assume it is the official address. Scammers have created hundreds of fake mirrors of popular onion sites. The only reliable way to verify a Tor URL is to check a PGP-signed announcement from the official source, or to visit the Useful Resources page of this site where verified addresses are maintained.

Before visiting any onion address, follow these steps to reduce the risk of landing on a phishing clone:

1. Find the official source of the address (the organization's website, a PGP-signed statement, or a trusted security resource).
2. Copy the full .onion address directly from that source; do not type it manually.
3. Paste it into Tor Browser's address bar and verify that the site loads and displays expected content.
4. Check for HTTPS and a valid certificate; Tor Browser will warn you if the certificate is invalid.
5. Look for any security warnings or unusual behavior before entering credentials or sensitive information.

Many legitimate onion services publish their address on their clearnet (regular internet) website as well. If you are unsure whether a Tor URL is real, visit the organization's main website first and look for an official link to their onion address. Never trust a .onion link you found on a random forum or social media post without independent verification.

According to Tor Project documentation and security-vendor incident reports, the most common failure point is user confusion between legitimate onion addresses and phishing clones. Users often bookmark the wrong address or follow a link from an untrusted source, believing they are accessing a real service. This matters because once a user enters credentials or sends cryptocurrency to a fake site, the loss is usually permanent and irreversible.

A second failure point is outdated or abandoned onion addresses. Services go offline, migrate to new addresses, or are seized by law enforcement. If you find a .onion link that was popular years ago, it may no longer be active or may have been taken over by someone else. Court records and law-enforcement press releases document cases where seized onion services were replaced with government takedown notices, but attackers have also taken over abandoned addresses to run scams.

Third, Tor Browser itself requires regular updates to remain secure. Users who run outdated versions of Tor Browser may be vulnerable to attacks that could compromise their anonymity or expose their real IP address. The Tor Project releases security updates frequently, and ignoring them increases risk significantly.

If you need to access a Tor URL, start by ensuring your setup is secure. Download Tor Browser only from the official Tor Project website, never from a mirror or third-party source. Keep it updated to the latest version. Use a dedicated device or virtual machine if you are accessing sensitive services, and consider running Tor Browser inside Tails or Whonix for additional isolation.

When you visit an onion address, assume nothing about its legitimacy until you have verified it independently. Do not enable browser plugins or extensions that might leak your identity. Disable JavaScript in Tor Browser's security settings if you are visiting an untrusted site. Never maximize your browser window to full screen, as this can make your screen resolution visible to websites and reduce anonymity. If a site asks you to download a file, scan it with antivirus software before opening it. Most importantly, treat your Tor activity the same way you would treat any other online activity: assume that the site could be malicious, and protect your credentials and personal data accordingly.