Tor Websites: A Directory of Onion Services and Hidden Sites

Tor websites operate on the Tor network using .onion domain names instead of standard .com or .org addresses. These sites are hosted on hidden services, which means their server location is concealed and only accessible through the Tor browser. An onion address is a 56-character string (v3 addresses) that functions as a cryptographic identifier, generated from the site's public key. Unlike regular websites that resolve through DNS servers, onion addresses are resolved directly by the Tor network, preventing ISPs and network observers from seeing which site you're visiting. The .onion suffix was originally a special-use top-level domain designated for this purpose. Tor websites serve legitimate purposes including privacy-focused communication platforms, news outlets operating in censored regions, whistleblowing platforms, and technical documentation repositories. They also host illegal marketplaces and services, which is why distinguishing between genuine and fraudulent onion sites is critical.

When you access a Tor website, your connection passes through at least three randomly selected relays before reaching the destination. Each relay only knows the previous and next hop in the circuit, so no single relay can see both your IP address and the site you're visiting. Onion addresses use public-key cryptography: the server generates a keypair, and the public key is hashed to create the .onion address. This means the address itself proves the server's identity without requiring a certificate authority. The Tor network maintains a distributed directory of onion services, allowing the Tor browser to locate them without exposing your query to external observers. When you connect to an onion site, the Tor browser establishes a rendezvous circuit with the hidden service, creating an encrypted tunnel that both parties can verify. This architecture prevents man-in-the-middle attacks and ensures that even the site operator cannot determine your real IP address unless you voluntarily reveal it through your behavior or browser configuration.

The Tor browser is the official tool for accessing Tor websites and onion services. Download it only from the official Tor project website to avoid malicious versions. Installation steps: (1) Download the Tor browser package for your operating system, (2) Verify the signature using the provided PGP key to confirm authenticity, (3) Extract the archive to a location of your choice, (4) Run the executable and allow it to connect to the Tor network, (5) Wait for the connection to establish before opening the browser window. After launch, the Tor browser functions like Firefox but routes all traffic through Tor. Configure security by adjusting the security slider in settings: higher levels disable JavaScript and certain plugins that could leak your identity. Do not maximize your browser window, as screen resolution is a fingerprinting vector. Disable plugins and extensions unless absolutely necessary. Never open multiple tabs to different onion sites simultaneously if you're concerned about correlation attacks. Keep the Tor browser updated to patch security vulnerabilities. On public or shared computers, use a dedicated user account for Tor browsing and clear the cache after each session.

Phishing clones are fraudulent onion sites designed to mimic legitimate ones and steal credentials or funds. Verification methods: (1) Check the site's official announcement channels (social media, email lists, or linked pages) for the correct onion address, (2) Verify PGP signatures on any address announcements using the site operator's public key, (3) Compare the full 56-character v3 address character-by-character, as typosquatting exploits visual similarity, (4) Look for HTTPS certificates on onion sites that support them, though many legitimate sites do not use them, (5) Check if the site is listed on reputable onion directories with verification metadata. Red flags for phishing clones include newly registered addresses, poor grammar or design inconsistencies, requests for sensitive information you wouldn't normally provide, and URLs that appear in search results but lack corroborating evidence. V3 onion addresses are more resistant to brute-force attacks than older v2 addresses, making them more trustworthy. If a site claims to be a marketplace or service, cross-reference its address on multiple independent sources before interacting with it. Never trust an onion address shared in casual forums or chat rooms without independent verification.

Tor, VPN, and I2P are distinct privacy tools with different architectures and use cases. Tor routes traffic through three relays operated by volunteers worldwide, providing strong anonymity but slower speeds due to multiple hops. The Tor network is designed for accessing the public internet anonymously and hosting hidden services. VPNs encrypt traffic and route it through a single provider's server, offering faster speeds but requiring trust in the VPN operator, who can see your traffic and IP address. I2P (Invisible Internet Project) is a network designed for internal communication and file-sharing, using a different routing algorithm than Tor and offering better performance for peer-to-peer applications but less suitable for accessing the regular internet. Tor is best for accessing Tor websites and onion services, protecting against network-level surveillance, and accessing censored content. VPNs are better for general privacy while browsing the regular internet and hiding your activity from your ISP. I2P excels at peer-to-peer communication and distributed applications. Combining these tools (e.g., VPN before Tor) adds complexity but may increase fingerprinting risk. For accessing onion sites specifically, using only the Tor browser is the recommended approach.

User behavior often undermines Tor's technical protections. Common mistakes include: (1) Maximizing the browser window, which reveals screen resolution for fingerprinting, (2) Enabling plugins or extensions that bypass Tor, (3) Visiting onion sites while logged into accounts linked to your real identity, (4) Torrenting over Tor, which leaks your IP address because BitTorrent clients ignore proxy settings, (5) Adjusting browser settings that make your Tor browser unique and identifiable, (6) Using the same username across multiple onion sites, (7) Disabling JavaScript protections to access sites with poor compatibility, (8) Visiting multiple onion sites in a single session without considering correlation attacks, (9) Typing in the address bar instead of using bookmarks, which may leak queries, (10) Assuming Tor protects against phishing or malware. Tor protects your network-level privacy but does not prevent you from revealing yourself through your actions. If you log into a personal account on an onion site, the site operator knows you're the same person across sessions. Operating system fingerprinting can also compromise anonymity if you run unusual software or configurations. Treat Tor as a tool for network privacy, not a complete anonymity solution.

Onion directories and indexes catalog .onion addresses by category, similar to traditional web directories. They serve as discovery tools for users seeking specific services or information. Categories typically include news outlets, privacy tools, communication platforms, documentation repositories, whistleblowing platforms, and marketplaces. Onion indexes work by aggregating addresses submitted by site operators or discovered through network crawling, then organizing them with descriptions and verification status. Some indexes verify addresses by connecting to them and confirming they're operational, while others rely on community reporting. Indexes do not guarantee legitimacy; they simply organize addresses. Many indexes are maintained by volunteers and may contain outdated or fraudulent entries. Reputable indexes display verification metadata such as last-checked dates, PGP signatures, and operator contact information. Some indexes use mirrors to ensure availability if the primary address goes offline. When using an index, cross-reference any address you find with multiple sources before visiting it. Be aware that indexes themselves can be targets for phishing; verify the index's address through official channels before trusting its listings. This site maintains a verified directory of onion services organized by category and checked for availability.