List of Tor Sites: Finding Legitimate Onion Services

A Tor site is a web service hosted on the Tor network and accessed via a .onion address rather than a standard domain. These sites route traffic through multiple Tor relays, encrypting it at each hop, which masks both the user's location and the server's physical location. Unlike surface web sites that rely on traditional DNS and IP addresses, Tor sites use onion routing—a layered encryption protocol that makes traffic analysis extremely difficult. The .onion address itself is a cryptographic identifier derived from the site's public key, not a geographic or organizational marker. Tor sites can host anything from news organizations and privacy-focused communication platforms to research archives and legitimate marketplaces. The key distinction is that Tor sites are designed for anonymity on both ends of the connection, whereas surface web sites typically log user data and operate under standard internet infrastructure.

Tor site directories organize .onion addresses into categories to help users find services by function rather than browsing randomly. Common categories include news and media, communication and messaging, research and documentation, privacy tools, and verified marketplaces. These directories typically display the onion address, a brief description, the site's purpose, and sometimes verification information such as PGP signatures or v3 address status. Some directories are maintained by individual researchers or community volunteers; others are hosted as onion sites themselves to avoid censorship. A well-organized list includes metadata such as whether a site is actively maintained, whether it has a v3 address (the current standard), and whether mirrors exist on the surface web. The most reliable directories cross-reference multiple sources and flag known phishing clones. Users should note that no single directory is comprehensive; legitimate Tor sites often exist outside major lists to reduce visibility to bad actors.

Phishing clones are fraudulent .onion sites designed to mimic legitimate services and steal credentials or funds. To identify a genuine onion address, verify the address through multiple independent sources—never rely on a single link. Legitimate sites often publish their official .onion address on their surface web presence, in PGP-signed announcements, or in official documentation. Check for v3 addresses, which are 56 characters long and use the current Tor protocol; v2 addresses (16 characters) are deprecated and more vulnerable. Examine the site's security certificate and HTTPS status in the Tor browser address bar. Legitimate services typically display a PGP public key fingerprint on their site, allowing you to verify signed messages. Watch for spelling variations in the address—phishing clones often use similar-looking characters or slight misspellings. If a site requests unusual verification steps, asks for payment before access, or displays poor design quality, treat it with suspicion. Cross-reference any .onion address with multiple trusted directories before entering credentials or sensitive information.

Legitimate Tor sites serve diverse purposes across news, privacy, research, and communication. News organizations maintain .onion mirrors to ensure access in countries with internet censorship, allowing journalists and citizens to publish and read uncensored reporting. Privacy-focused communication platforms use Tor to protect user metadata and conversations from surveillance. Research archives and libraries host academic papers, historical documents, and information that may be restricted in certain jurisdictions. Whistleblowing platforms accept anonymous submissions and use Tor to protect sources. Privacy tool repositories distribute software and documentation for encryption, anonymity, and secure communication. Community forums and discussion boards operate on Tor to facilitate uncensored conversation. Verified marketplaces for legal goods exist on Tor, though users should consult the Verified Marketplaces page for current, authenticated listings. Government agencies and NGOs maintain Tor sites to provide services to citizens in restrictive environments. Each category serves a legitimate function; the Tor network itself is neutral technology used for lawful purposes by journalists, activists, researchers, and privacy-conscious individuals worldwide.

Begin by installing the official Tor browser from the Tor Project's website, not from third-party sources. Once installed, access a trusted directory by typing the .onion address directly into the address bar or by finding it through a verified source such as official documentation or PGP-signed announcements. Before clicking any link, hover over it to see the full .onion address and verify it matches the source. Use the Tor browser's built-in security features: keep JavaScript disabled unless necessary, use the highest security level, and avoid maximizing your browser window to prevent fingerprinting. When accessing a Tor site list, cross-reference addresses across multiple directories. If a site requires you to download files, scan them with antivirus software before opening. Never disable Tor or switch to a VPN while browsing Tor sites, as this defeats the purpose of anonymity. Keep your Tor browser updated to the latest version to receive security patches. If you encounter a site that appears suspicious or requests unusual permissions, close it immediately and verify the address through another source.

A frequent mistake is maximizing the browser window, which allows sites to determine your screen resolution and operating system, reducing anonymity. Logging into personal accounts while using Tor defeats anonymity; if you use the same username or email on Tor as on the surface web, your identity can be linked. Disabling Tor or using a VPN simultaneously creates confusion about your actual IP address and can leak your real location. Downloading files from Tor sites and opening them immediately in your regular operating system can expose your identity if the file contains tracking code. Enabling plugins like Flash or Java in the Tor browser bypasses Tor's encryption and reveals your real IP. Typing personal information into Tor sites, even anonymously, can be correlated with other data to identify you. Assuming all .onion sites are trustworthy is dangerous; many are honeypots or scams. Failing to verify PGP signatures on official announcements leaves you vulnerable to phishing. Using outdated versions of the Tor browser exposes you to known vulnerabilities. Browsing with JavaScript enabled on untrusted sites can allow attackers to execute code that reveals your identity.

Tor, VPN, and I2P are three distinct privacy technologies with different architectures and use cases. Tor routes traffic through a minimum of three relays operated by volunteers worldwide, with each relay knowing only the previous and next hop; this makes traffic analysis extremely difficult but can be slower. A VPN routes all traffic through a single provider's server, which can see your real IP and all your traffic; VPN providers are commercial entities with privacy policies and potential legal obligations to log data. I2P uses a similar onion-routing model to Tor but is designed primarily for internal network communication rather than accessing external sites; it offers strong anonymity for I2P-to-I2P communication but limited access to the surface web. Tor is optimized for accessing both .onion sites and the surface web anonymously; it has a larger user base and more exit nodes. VPNs are faster for general browsing but provide weaker anonymity guarantees. I2P is more resistant to certain attacks but has a smaller network and fewer exit nodes. For accessing Tor site lists and .onion services, Tor is the appropriate choice. For general privacy on the surface web, a VPN may be sufficient. I2P is best for decentralized, peer-to-peer communication within the I2P network itself.