Tor V3 Links: What They Are and How They Work

Tor v2 addresses were 16 characters long and used RSA-1024 encryption, which became vulnerable to computational advances. Tor v3 addresses are 56 characters and use Ed25519 elliptic-curve cryptography, providing stronger security against brute-force attacks and future decryption methods. The Tor Project deprecated v2 support in October 2021, making v3 the only functional standard for new onion services. A v3 address encodes the service's public key directly into the address itself, meaning the address cannot be spoofed or enumerated by attackers scanning the network. This design eliminates a class of attacks where adversaries could generate fake addresses and attempt to impersonate legitimate services.

When you access a v3 onion address through Tor Browser, your client performs several steps. First, it contacts a distributed hash table (DHT) of Tor directory servers to locate the service descriptor for that address. The descriptor contains the service's introduction points—relay nodes that accept incoming connections. Your Tor client builds a circuit to one of these introduction points and sends an encrypted request. The hidden service then builds a circuit back to you through a rendezvous point, creating a bidirectional encrypted tunnel. Neither your IP address nor the service's IP address is revealed; all traffic is encrypted end-to-end. The v3 address itself is derived from the service's public key, so only the legitimate service operator can prove ownership of that address by signing messages with the corresponding private key.

Phishing clones are fraudulent onion services designed to mimic legitimate ones and steal credentials or funds. To verify authenticity: (1) Check the address against official sources—the legitimate service's clearnet website, official social media accounts, or PGP-signed announcements from the service operator. (2) Look for PGP signatures—many services publish their v3 address signed with a long-term PGP key. Verify the signature using the service's public key from multiple independent sources. (3) Examine the address format—v3 addresses are always 56 characters of lowercase alphanumeric text ending in .onion. Typosquatting attacks use similar-looking addresses; compare character-by-character. (4) Check for HTTPS certificates—legitimate services often use self-signed certificates; verify the certificate fingerprint matches what the service publishes. (5) Test functionality—phishing clones often lack full functionality or contain subtle UI differences. Compare the layout and features against screenshots from trusted sources.

Users often undermine their own security through operational security (OpSec) failures. Resizing your browser window reveals your screen resolution to websites, allowing fingerprinting across sessions. Keep your Tor Browser window maximized or use a standard resolution. Enabling plugins like Flash or Java defeats Tor's protections by leaking your real IP. Disable all plugins and use only Tor Browser's built-in capabilities. Mixing Tor and non-Tor traffic—such as logging into accounts with identifying information while on Tor—links your anonymous activity to your real identity. Maintain strict separation between Tor and clearnet browsing. Downloading files without caution can expose your IP if the download manager bypasses Tor. Use Tor Browser's built-in download handler only. Visiting v3 sites with JavaScript enabled can allow malicious scripts to reveal your IP or fingerprint your system. Tor Browser disables JavaScript by default; do not enable it unless absolutely necessary and only on trusted sites.

Use only the official Tor Browser from the Tor Project's website to access v3 addresses. Verify the browser's signature using the Tor Project's PGP key before installation. Keep Tor Browser updated to the latest version; security patches are released regularly. Use a dedicated device or virtual machine for sensitive Tor activity to isolate it from your primary system. Enable Tor Browser's security slider to the highest level, which disables JavaScript, WebGL, and other potentially dangerous features. Use a VPN before connecting to Tor only if you trust your VPN provider; this adds latency but can hide the fact that you're using Tor from your ISP. Never maximize your browser window beyond standard resolutions to avoid fingerprinting. Disable plugins and extensions entirely. When accessing v3 links, assume the service operator can see your Tor exit node's IP address if you interact with the service. Avoid revealing identifying information through your behavior, typing patterns, or account details. Use strong, unique passwords for each v3 service you access.

Tor, VPN, and I2P are distinct anonymity tools with different threat models. Tor routes traffic through multiple relays operated by volunteers worldwide, providing strong anonymity against network-level surveillance but slower speeds. A VPN encrypts your traffic and routes it through a single provider's server, hiding your activity from your ISP but concentrating trust in the VPN operator. I2P uses a similar multi-hop routing model to Tor but is optimized for internal network communication rather than accessing the clearnet. For accessing v3 onion services, Tor is the only appropriate tool—VPNs and I2P cannot reach .onion addresses. Tor provides the strongest protection against identifying your location or IP address to the service you're accessing. However, Tor does not protect against malware, phishing, or social engineering. VPNs offer faster speeds but provide weaker anonymity guarantees and require trusting a single entity. I2P is suitable for peer-to-peer applications within the I2P network but lacks the maturity and adoption of Tor for general anonymity.

Legitimate v3 links are published by service operators on their official clearnet websites, often accompanied by PGP signatures or certificate fingerprints. Search engine results and social media posts are unreliable sources; always verify addresses through official channels. Onion directories index v3 addresses but vary in reliability and curation. Some directories are maintained by community volunteers and include user submissions, which may contain phishing clones or outdated addresses. Cross-reference any v3 address against multiple independent sources before accessing it. The Tor Project's official website publishes v3 addresses for its own services and provides guidance on verifying addresses. For marketplace and service directories, consult this site's Verified Marketplaces page for curated, vetted links. Never trust a single directory or source; phishing operators actively maintain clones of popular directories to distribute fraudulent addresses. When in doubt, access the service's clearnet website first and locate the official v3 address from there.