Onion Web Pages: Understanding .onion Addresses and Hidden Services

Onion web pages are services hosted on the Tor network and accessed exclusively through Tor. Each onion site has a .onion address—a cryptographic identifier derived from the site's public key. Modern v3 onion addresses are 56 characters long and provide stronger security than older v2 addresses. The .onion domain is not a traditional top-level domain but a special-use top-level domain reserved by IANA for use with Tor. When you visit an onion web page, your connection is routed through multiple Tor relays, encrypting your traffic and masking your IP address. The site operator's server location is similarly hidden behind Tor's infrastructure. This mutual anonymity makes onion web pages fundamentally different from standard websites, which operate on the clearnet and require traditional domain registration.

Tor uses a three-layer encryption system and a network of volunteer-operated relays to route traffic. When you connect to an onion web page, Tor selects a random path through at least three relays: an entry node, a middle relay, and an exit node. Each relay decrypts one layer of encryption, revealing only the next relay's address. For onion services, the exit node is bypassed entirely—your connection terminates at the Tor network itself. The .onion address acts as a public key fingerprint. When you request an onion site, Tor uses the address to locate the service's introduction points, which are Tor relays the site operator has designated. Your client then negotiates a rendezvous point with the service, creating an encrypted tunnel. This architecture means neither party learns the other's IP address, and traffic cannot be intercepted or monitored by ISPs or network administrators.

Accessing onion web pages requires the Tor Browser, which is the official and recommended tool. Download Tor Browser only from the official Tor Project website to avoid compromised versions. Installation is straightforward: extract the archive, run the executable, and allow it to connect to the Tor network. Once connected, open the browser and paste the .onion address into the address bar. Do not modify Tor Browser settings unless you understand the security implications. Common mistakes include disabling JavaScript, maximizing the browser window (which can reveal screen resolution for fingerprinting), or installing additional extensions. Keep Tor Browser updated to receive security patches. When visiting an onion site, treat it like any other website: verify the address carefully, check for HTTPS indicators, and avoid downloading files unless necessary. If you need to verify an onion address's legitimacy, cross-reference it with multiple independent sources or check for PGP-signed announcements from the service operator.

Phishing clones are fraudulent copies of legitimate onion sites designed to steal credentials or distribute malware. Because .onion addresses are long and difficult to memorize, attackers exploit this by registering similar-looking addresses. To verify a genuine onion mirror: first, obtain the address from the official clearnet website or a trusted announcement channel. Check for HTTPS and a valid certificate (though onion sites often use self-signed certificates). Look for consistency in design, branding, and functionality compared to known versions. Many legitimate onion sites publish their address alongside a PGP signature; verify the signature using the site operator's public key. Be skeptical of sites requesting sensitive information immediately upon access. If a site's address differs by even one character from what you expected, do not proceed. Bookmark verified addresses to avoid re-entering them manually. When in doubt, access the clearnet version of the service and look for an official .onion link there.

Version 3 (v3) onion addresses are the current standard and represent a significant security upgrade over v2 addresses. V3 addresses are 56 characters long, compared to v2's 16 characters, and use stronger cryptography based on the SHA-3 hash function and Ed25519 elliptic-curve signatures. The longer address space makes it computationally infeasible to generate a vanity address through brute force, eliminating a class of attacks that affected v2. V3 addresses also support improved onion service descriptors, which are less vulnerable to enumeration attacks. According to official Tor Project documentation, v2 addresses were deprecated and are no longer supported in current Tor Browser versions. If you encounter a v2 address, it indicates the service is outdated or abandoned. Always prefer v3 addresses when available. The transition to v3 was completed to strengthen the security model of the entire Tor network and reduce the attack surface for onion service operators.

Several common errors can undermine the anonymity provided by Tor and onion web pages. Resizing your Tor Browser window to full screen reveals your screen resolution, which can be used for fingerprinting. Disabling JavaScript or modifying security settings without understanding the consequences can expose your real IP address. Logging into personal accounts (email, social media) while using Tor defeats anonymity, as the service can link your session to your identity. Downloading files from onion sites and opening them in your regular operating system can expose your IP if the file contains tracking code. Using plugins like Flash or Java bypasses Tor entirely. Torrenting over Tor is ineffective and can leak your IP address. Enabling plugins or extensions not included with Tor Browser introduces unknown security risks. Running Tor Browser alongside a VPN is unnecessary and may reduce anonymity if the VPN logs traffic. If anonymity is critical to your use case, research operational security practices specific to your threat model and adjust your behavior accordingly.

Tor, VPN, and I2P are three distinct privacy technologies with different architectures and use cases. Tor routes traffic through multiple volunteer-operated relays, providing strong anonymity but slower speeds. Tor is designed for anonymity against network-level adversaries and is the only practical method for accessing onion web pages. A VPN encrypts traffic and routes it through a single provider's server, hiding your IP from websites but requiring trust in the VPN operator. VPNs are faster than Tor but provide weaker anonymity if the provider logs traffic. I2P is a decentralized network optimized for internal communication and file sharing, with different threat models than Tor. I2P does not provide exit nodes to the clearnet, so it cannot be used to access standard websites anonymously. Each technology serves different purposes: Tor for anonymous web browsing and accessing onion services, VPN for encrypting traffic on untrusted networks, and I2P for peer-to-peer communication. Combining Tor with a VPN is possible but adds complexity and may not improve security depending on your threat model.