Tor Onion Links: Verified Directory of Active Hidden Services

Onion links are special-use top-level domain addresses ending in .onion that exist only within the Tor network. When you access a .onion address through the Tor Browser, your connection is routed through multiple Tor relays, encrypting your traffic and masking your IP address. The onion routing protocol works by wrapping your data in multiple layers of encryption, each relay removing one layer before passing the packet to the next. This design ensures that no single relay knows both your origin and destination. Onion services themselves run on servers that are also hidden behind Tor, meaning the server's location and IP address remain concealed. The .onion domain is not registered through traditional DNS; instead, Tor maintains a distributed directory of onion addresses. Each .onion address is derived from the public key of the hidden service, making the address itself a cryptographic proof of the service's identity. This architecture prevents DNS-based censorship and allows services to operate without revealing infrastructure.

Onion addresses come in two versions: v2 and v3. V2 addresses are 16 characters long and use RSA-1024 encryption; they were the standard until 2021 but are now deprecated due to security concerns. V3 addresses are 56 characters long and use elliptic-curve cryptography (Ed25519), offering stronger security and better resistance to future attacks. The Tor Project officially disabled v2 address support in October 2021, meaning older 16-character .onion links no longer function. When searching for active onion links, you will only find v3 addresses in current directories. V3 addresses also support longer domain names and better key rotation, reducing the risk of address compromise. If you encounter a 16-character .onion link in an old list, it is no longer valid. Legitimate services have migrated to v3 addresses, and any site claiming to operate on a v2 address is either abandoned or fraudulent.

Phishing clones are fraudulent copies of legitimate onion services designed to steal credentials or funds. Verification requires multiple steps. First, confirm the .onion address matches the official source—check the service's public announcements, PGP-signed statements, or official mirrors on clearnet sites. Second, verify PGP signatures if the service publishes them; a valid signature proves the announcement came from the service operator. Third, check for HTTPS certificates; legitimate v3 onion services often use self-signed certificates, but the certificate fingerprint should match across visits. Fourth, look for security indicators like onion-specific security headers or Tor Browser warnings. Fifth, cross-reference the address in multiple independent sources rather than relying on a single directory. Phishing clones often use similar-looking addresses with character substitutions (for example, replacing 'l' with '1'). Always copy and paste .onion addresses rather than typing them manually. If a service asks you to log in immediately without displaying expected content, it may be a clone. Legitimate services rarely change their .onion address; if you see a 'new address' announcement, verify it through PGP signature before switching.

Onion services fall into several broad categories based on their function. Marketplace links host commerce platforms, though many operate illegally; users should verify legitimacy independently. News and information sites include publications that publish from hidden locations to protect sources and avoid censorship. Communication services include encrypted messaging platforms, forums, and discussion boards. Whistleblowing platforms allow anonymous submission of documents and information. Library and archive services preserve information and provide access to books, academic papers, and historical documents. Security and privacy tools include Tor project mirrors, documentation, and related software repositories. Directory and search services index other onion addresses, though many become outdated or contain fraudulent links. Social platforms include forums and communities organized by interest or geography. Financial services include cryptocurrency exchanges and wallet services, many of which operate in legal gray areas. Each category carries different risks; users should research the reputation and operational history of any service before use. This directory organizes links by category to help users find specific service types while noting verification status and known risks.

Even when accessing legitimate onion links, user behavior can leak identifying information. The most common mistake is maximizing the Tor Browser window; websites can detect screen resolution and use it to fingerprint users. Keep the window at default size or smaller. Second, avoid using plugins or extensions; they may bypass Tor or leak your real IP address. Third, do not enable JavaScript in the Tor Browser unless absolutely necessary; JavaScript can reveal your real IP through certain attacks. Fourth, do not open files downloaded from onion services in applications that connect to the internet; use an air-gapped device or virtual machine for sensitive documents. Fifth, do not mix Tor and non-Tor traffic; using a regular browser alongside Tor can correlate your activities. Sixth, do not assume onion links are inherently safe; phishing, malware, and scams operate on the darknet. Seventh, do not reuse usernames or personal information across onion services; each service should have a unique identity. Eighth, do not assume end-to-end encryption is automatic; verify that services use HTTPS and check certificate fingerprints. Ninth, do not stay logged in across multiple sessions; log out and clear cookies between visits. Tenth, do not assume your ISP cannot see that you are using Tor; use a VPN before Tor if your threat model requires hiding Tor usage from your ISP.

Accessing onion links safely requires proper setup and configuration. First, download the Tor Browser only from the official Tor Project website; verify the signature of the installer using the provided PGP key. Second, install Tor Browser in a dedicated location and do not modify its configuration unless you understand the security implications. Third, open Tor Browser and allow it to connect to the Tor network; this may take 30 seconds to several minutes depending on network conditions. Fourth, once connected, navigate to the onion address by typing or pasting it into the address bar. Fifth, wait for the page to load; onion services are often slower than clearnet sites due to the routing through multiple relays. Sixth, check the Tor Browser's security level; set it to 'Safer' or 'Safest' depending on your threat model, though this may break some sites. Seventh, do not resize the browser window to avoid fingerprinting. Eighth, do not enable plugins or extensions. Ninth, if you need to download files, use a separate device or virtual machine to open them. Tenth, close Tor Browser completely when finished; this clears cookies and temporary data. For added security, consider running Tor Browser inside a virtual machine isolated from your main system.

Tor, VPN, and I2P are three different privacy technologies with distinct strengths and weaknesses. Tor routes traffic through multiple relays operated by volunteers, providing strong anonymity but slower speeds; it is designed for anonymity against network-level observers. VPN routes traffic through a single provider's server, offering faster speeds but requiring trust in the VPN operator; it is designed for privacy against ISPs and local networks but not against determined adversaries. I2P is a decentralized network designed for internal communication and file-sharing; it offers good anonymity for peer-to-peer applications but is less suitable for accessing external websites. Tor onion links are only accessible through Tor; they cannot be accessed via VPN or I2P. For accessing onion services, Tor is the only option. For general privacy while browsing clearnet sites, a VPN may be faster but offers less anonymity than Tor. For peer-to-peer file-sharing and internal communication, I2P may be more efficient. For maximum anonymity against sophisticated adversaries, Tor provides the strongest protection. Many users combine technologies; for example, using a VPN before Tor adds a layer of protection against ISP-level observation, though it requires trusting the VPN operator. The choice depends on your specific threat model and use case.