What Are .Onion Addresses
An .onion address is a special-use top-level domain suffix designating an anonymous hidden service reachable via the Tor network. These addresses are not registered through traditional domain registrars. Instead, they're generated cryptographically when someone configures a Tor hidden service. A v3 .onion address consists of 56 characters followed by .onion, derived from the public key of the service. This design means the address itself proves the service's identity—you cannot forge or impersonate an .onion address without possessing the corresponding private key. The address is both the location and the cryptographic proof of authenticity.
How .Onion Names Are Generated
When a server operator sets up a hidden service on Tor, the software generates a public-private key pair. The public key is hashed to create the .onion address. This process is deterministic: the same key always produces the same address. Operators cannot choose vanity addresses easily—generating a custom .onion name requires significant computational effort, making human-readable onion addresses rare and computationally expensive to produce. Older v2 addresses (16 characters) have been deprecated due to security improvements in v3 (56 characters). The longer v3 format provides stronger cryptographic guarantees and resistance to brute-force attacks.
Legitimate vs. Fraudulent Dark Web Site Names
Distinguishing real services from scams requires verification. Legitimate dark web sites typically appear on curated directories with uptime checks and community verification. Cross-reference any .onion address across multiple sources before accessing it. Scammers create lookalike addresses hoping users mistype or forget the exact domain. Always bookmark verified addresses rather than searching for them repeatedly. Official projects like the Tor Project publish their .onion addresses on their clearnet websites. If a service claims to be legitimate but has no verifiable history or independent confirmation, treat it with extreme caution. Phishing sites mimicking popular platforms are common on the dark web.
Security Risks and Common Mistakes
Never assume an .onion address is safe simply because it exists. Malicious actors operate hidden services designed to steal credentials, distribute malware, or harvest personal data. Do not enable JavaScript in Tor Browser, as it can compromise anonymity. Avoid maximizing your browser window—fingerprinting attacks can identify you based on screen resolution. Never open files downloaded from onion sites without scanning them first. Do not mix Tor and non-Tor traffic by logging into clearnet accounts while browsing hidden services. Use a dedicated device or virtual machine if accessing sensitive dark web services. Keep your Tor Browser updated to patch security vulnerabilities.
Using VPN with Tor for Enhanced Privacy
Running Tor through a VPN adds a layer of obfuscation, though it introduces trade-offs. A VPN before Tor hides your ISP-visible Tor usage but allows the VPN provider to see you're using Tor. A VPN after Tor (inside Tor) is technically difficult and not recommended for most users. If you choose VPN plus Tor, use a reputable provider with a no-logs policy and consider the added latency. Never use both simultaneously expecting to hide from the Tor exit node—the exit node still sees your traffic. For most users, Tor alone provides sufficient anonymity. Only combine tools if you have a specific threat model requiring additional protection.
Finding and Verifying Onion Addresses
Curated directories maintained by security researchers list verified .onion addresses with uptime status. These directories test links regularly to confirm services are live. Check the site's verification methodology—reputable directories document how they confirm legitimacy. The Tor Project's official website lists approved resources. Reddit communities dedicated to Tor sometimes share recommendations, but verify independently rather than trusting user claims alone. Search engines designed for onion sites (like those listed in verified directories) index hidden services, but results are less reliable than traditional search. Always approach new .onion addresses with skepticism and cross-reference before accessing.
Best Practices for Safe Navigation
Maintain a written list of verified .onion addresses you trust, stored securely offline. Use Tor Browser's built-in security features and keep it updated. Disable plugins and extensions unless absolutely necessary. Cover your webcam. Use strong, unique passwords for any accounts on onion services. Enable two-factor authentication where available. Assume every interaction could be monitored or compromised. Never download files unless necessary, and scan them with antivirus software before opening. Avoid clicking links within onion sites—navigate directly by typing addresses. Treat the dark web with the same caution you'd apply to any untrusted network.
Frequently asked questions
Can I create my own .onion address?
Yes, if you run a Tor hidden service. The software generates an address automatically from your service's public key. You cannot choose a custom address without significant computational effort. Most users access existing services rather than hosting their own.
Why are .onion addresses so long?
V3 addresses use 56 characters to provide stronger cryptographic security than older v2 addresses. The length encodes the service's public key, making the address tamper-proof and impossible to forge without the private key.
Is accessing an .onion site illegal?
Accessing an .onion address itself is not illegal in most jurisdictions. However, the content or services available may be illegal. The legality depends on what you access and your location's laws.
How do I know if an .onion site is a scam?
Check multiple verification sources, look for community history and reputation, verify the address against official sources, and avoid sites with no verifiable background. Scammers often create lookalike addresses or new sites with no track record.
Should I use a VPN before connecting to Tor?
It depends on your threat model. A VPN before Tor hides Tor usage from your ISP but lets the VPN provider see you're using Tor. For most users, Tor alone is sufficient. Only combine if you have specific privacy requirements.
