Tor URL and .onion Addresses: Complete Technical Guide

Tor URLs, also called .onion addresses, are unique identifiers for services hosted on the Tor network. Unlike standard domain names that resolve through DNS servers, .onion addresses are derived from public cryptographic keys and do not require traditional domain registration. When you visit a Tor URL, your connection is routed through multiple Tor relays before reaching the destination server, encrypting your traffic at each hop. This architecture means neither your ISP nor the site operator can easily identify your location or IP address. Tor URLs matter because they enable communication channels that resist surveillance, censorship, and traffic analysis. They are used for legitimate purposes such as journalism, activism, and privacy-focused services, as well as for illegal marketplaces and content distribution. Understanding how they work is essential for anyone using Tor safely.

Tor URLs are generated through a process called onion address creation. A hidden service operator generates a pair of cryptographic keys—a public key and a private key. The public key is hashed and encoded to create the .onion address, which is typically 16 characters long for v2 addresses or 56 characters for v3 addresses. When you connect to a Tor URL, the Tor browser contacts Tor directory servers to retrieve information about that hidden service's introduction points. Your client then builds a circuit through Tor relays and connects to one of the service's introduction points. The service operator has already published their introduction points to the Tor network, encrypted so only someone with the correct public key can use them. This design ensures that the service's location remains hidden even from Tor exit nodes. The entire process is transparent to the user—you simply enter the .onion address into your Tor browser and the routing happens automatically.

Tor addresses come in two versions, each with different security properties. V2 addresses are 16 characters long and use 1024-bit RSA keys. They were the standard for many years but are now considered cryptographically weaker by modern standards. V3 addresses are 56 characters long and use 3072-bit RSA keys, providing significantly stronger security against cryptographic attacks. V3 addresses also include built-in protections against certain types of attacks, such as those targeting the Tor directory system. The Tor Project began deprecating v2 addresses in 2020 and disabled support for them in Tor Browser version 10.0.1. If you encounter a v2 address, it is likely outdated or abandoned. Most active and reputable onion services now use v3 addresses. When verifying a Tor URL, check whether it is a v3 address—the longer format is a sign that the service operator is following current security best practices.

Phishing clones are fraudulent copies of legitimate .onion sites designed to steal credentials, cryptocurrency, or personal information. They often use addresses that look similar to the genuine site but differ by one or two characters. To verify a genuine Tor URL, follow these steps: First, obtain the address from an official source—the site's own announcement, a verified social media account, or a trusted directory. Second, check for PGP signatures if the site provides them; verify the signature using the site operator's public key. Third, look for security indicators such as HTTPS certificates (though these are less common on onion sites) and consistent branding. Fourth, compare the address character-by-character with the official source—do not rely on memory or partial matches. Many legitimate onion services publish their v3 addresses on multiple channels to make impersonation harder. If a site asks you to verify your password or enter sensitive information immediately after visiting, it is likely a phishing clone. Always navigate directly to the address rather than following links from emails or forums.

Even when using Tor URLs correctly, certain behaviors can leak your identity or location. Resizing your browser window or maximizing it can allow websites to fingerprint your device through screen resolution data. Enabling plugins like Flash or Java bypasses Tor entirely and exposes your real IP address. Logging into personal accounts (email, social media) while on Tor defeats anonymity because the account itself identifies you. Downloading files without caution can expose your identity if the file is malicious or if your download client makes unencrypted requests. Typing personal information into forms, even on .onion sites, creates a record that can be linked to you. Staying logged into multiple services simultaneously increases the risk of cross-site tracking. The Tor Browser is configured to prevent many of these issues by default, but user behavior remains the weakest link. Treat every Tor URL visit as if you are being monitored, and assume that any personal information you enter could be compromised.

Tor, VPN, and I2P are three different privacy technologies with distinct strengths. Tor routes traffic through multiple relays operated by volunteers, providing strong anonymity but slower speeds. VPN services route traffic through a single provider's server, offering faster speeds but requiring trust in the VPN operator. I2P is a decentralized network designed for internal communication, offering good anonymity for peer-to-peer applications but less suitable for general web browsing. Tor URLs are the only standard way to host hidden services that are accessible from the public internet while maintaining server anonymity. VPNs cannot host hidden services in the same way. I2P can host services but they are only accessible within the I2P network. For accessing .onion addresses, Tor is the only option. For general privacy while browsing the regular internet, a VPN or Tor can both be effective, though they work differently. Tor provides stronger anonymity but is slower; VPN is faster but depends on provider trustworthiness. I2P is best for peer-to-peer applications within its network. Choose based on your threat model and use case.

To safely access Tor URLs, download Tor Browser from the official Tor Project website only. Verify the signature of the installer using the Tor Project's public key before running it. Install Tor Browser in a dedicated directory and do not modify its settings unless you understand the security implications. When you first open Tor Browser, it connects to the Tor network and displays a connection status. Wait for the connection to complete before navigating to any .onion address. In the browser settings, keep JavaScript disabled unless you have a specific reason to enable it, as JavaScript can leak your IP address. Do not maximize your browser window; Tor Browser sets a default window size to prevent fingerprinting. Use the Tor Browser's built-in security slider to adjust security levels based on your needs. For accessing Tor URLs, the default settings are appropriate for most users. Keep Tor Browser updated to the latest version to receive security patches. Never use Tor Browser for regular web browsing and then switch to accessing .onion sites without restarting the browser, as this can create timing correlations.