Tor Links URL Directory: Locating and Verifying Onion Addresses

Tor links are URLs with .onion domains that point to hidden services accessible only through the Tor browser. These addresses are generated by the Tor network itself when a service operator configures a hidden service. Unlike regular websites, onion addresses are not registered through traditional domain registrars and do not appear in standard search engines. V3 addresses, the current standard, are 56 characters long and provide stronger cryptographic security than older V2 addresses. The .onion suffix is reserved by IANA specifically for Tor hidden services. Each onion address is derived from the service's public key, making it mathematically tied to the server's identity. This design means the address itself proves the service's authenticity if you verify it through official channels.

The Tor network maintains a distributed directory of onion services through directory authorities and relays. When a hidden service starts, it publishes its descriptor to the Tor directory, which includes the onion address and introduction points. The Tor browser downloads this directory information to route connections to hidden services. Directory authorities are trusted nodes that validate and sign directory information, preventing attackers from injecting false entries. This system is decentralized, meaning no single entity controls the directory. However, the directory does not function like a searchable index or search engine. Instead, you must already know the onion address or obtain it from a trusted source. Phishing operators exploit this by creating fake directories or mirrors that list fraudulent addresses alongside legitimate ones.

Legitimate onion addresses are published through official channels maintained by the service operators themselves. Many projects host their onion addresses on their clearnet websites, often in a dedicated section or security page. Official documentation, GitHub repositories, and PGP-signed announcements are reliable sources. Community forums and discussion boards sometimes share verified addresses, but these require cross-referencing with official sources. The best tor links are those confirmed through multiple independent channels. For marketplace or directory services, check the Verified Marketplaces page on this site for guidance on trusted resources. Never rely on a single source or unverified directory listing. Social media posts, email, and random forum links are high-risk sources for phishing clones. Always verify the address through the official project website before accessing any onion service.

Verification begins with obtaining the address from the official source. Check the project's clearnet website, official social media accounts, and PGP-signed announcements. PGP signatures prove that a message came from the key holder and has not been tampered with. Many projects publish their onion address alongside a PGP signature from their official key. To verify, import the project's public key, then use your GPG tool to check the signature against the signed message. If the signature is valid, the address is authentic. Phishing clones often use addresses that look similar to legitimate ones, differing by only one or two characters. Compare addresses character-by-character when copying them. V3 addresses are harder to spoof than V2 because of their length and cryptographic strength. If a service has moved or changed its address, this information should be announced through official channels with a PGP signature. Be suspicious of any address that appears only on third-party directories without official confirmation.

V3 onion addresses are the current standard for Tor hidden services, replacing the older V2 format. V3 addresses are 56 characters long and use stronger elliptic curve cryptography. The longer format makes them resistant to brute-force attacks that were theoretically possible against V2 addresses. V3 addresses also support better key rotation and improved resistance to certain types of cryptographic attacks. The Tor project deprecated V2 addresses in 2021, and most legitimate services have migrated to V3. If you encounter a V2 address, verify whether the service has officially announced a migration to V3. Scammers sometimes maintain old V2 addresses as phishing clones while the legitimate service operates on V3. The address format itself tells you nothing about the service's legitimacy, only about the cryptographic standard used. Always verify through official channels regardless of whether the address is V2 or V3.

Resizing your browser window or maximizing it can leak your screen resolution to websites, allowing fingerprinting. Keep the default window size or use the Tor browser's built-in privacy settings. Enabling plugins or extensions in the Tor browser defeats its privacy protections by allowing scripts to identify you. Use only the Tor browser without modifications unless you understand the security implications. Mixing Tor and non-Tor traffic on the same device can correlate your identity across networks. Use a dedicated device or virtual machine for Tor activities if conducting sensitive work. Visiting onion services over an insecure connection or without HTTPS exposes your traffic to exit node operators. Always check for HTTPS and verify the certificate matches the expected onion address. Logging into personal accounts while using Tor links your anonymous activity to your real identity. Assume that any account you access over Tor can be traced back to you if the service logs IP addresses or browser fingerprints. Downloading files from untrusted onion services and opening them without scanning exposes you to malware.

Tor routes traffic through multiple relays operated by volunteers, providing strong anonymity but slower speeds. The Tor browser is specifically designed to access .onion services and provides integrated protections. VPNs encrypt traffic to a single server operated by a company, offering privacy from your ISP but not anonymity from the VPN provider. VPNs cannot access .onion addresses directly and are not designed for hidden service access. I2P is a separate anonymity network with its own hidden services using .i2p addresses. I2P uses a different routing architecture and is optimized for different threat models than Tor. For accessing tor links and onion addresses, the Tor browser is the only tool designed for this purpose. Using a VPN before Tor adds a layer between your ISP and the Tor network but does not improve access to onion services. I2P services are separate from Tor and require the I2P router, not the Tor browser. Each network has different security properties and use cases; choose based on your specific needs.