Best Tor Websites and Onion Services Directory

Tor websites, also called onion services or hidden services, are web applications hosted on the Tor network and accessible only through the Tor browser. They use .onion domain names generated from cryptographic keys rather than traditional DNS. These sites matter because they enable censorship resistance, protect journalist sources, support political dissidents, and provide platforms where users can communicate without IP address exposure. Unlike surface web sites, onion services route traffic through multiple Tor relays, making user location and identity difficult to trace. The Tor Project's official documentation describes onion services as infrastructure for anonymous hosting, not inherently illegal—they support legitimate uses including whistleblowing platforms, privacy-focused email services, and uncensored news outlets.

Onion addresses are 56-character strings (v3 addresses) or 16-character strings (deprecated v2 addresses) that function as both a location and a public key. When you connect to an onion service through Tor, your traffic passes through at least three Tor relays before reaching the destination. The Tor browser automatically routes requests through this multi-hop circuit, encrypting each layer separately. The onion service itself runs on a hidden server that does not expose its IP address; instead, it publishes its .onion address through Tor's distributed hash table. This architecture means neither the user nor the service operator can easily identify each other's location. V3 addresses, introduced in 2017, use stronger cryptography than v2 and are now the standard for new onion services.

Legitimate Tor websites span multiple categories. News and media outlets operate onion mirrors to reach readers in censored regions. Privacy-focused email and messaging services provide encrypted communication without requiring phone numbers or personal data. Library and archive projects preserve information and academic resources. Discussion forums and community platforms enable anonymous conversation on sensitive topics. Whistleblowing platforms accept encrypted submissions from sources. Cryptocurrency services and wallets operate on onion addresses for additional privacy. Documentation and educational resources teach Tor usage and digital security. Government and NGO sites maintain onion mirrors for accessibility. Each category serves distinct user needs—journalists use them for source protection, activists for organizing, researchers for accessing restricted information, and privacy-conscious users for everyday communication without surveillance.

Phishing clones are fake onion services designed to steal credentials or distribute malware. Verify authenticity using these methods: (1) Check the official source—visit the organization's surface web site or social media for the correct .onion address; (2) Verify PGP signatures if provided—download the organization's public key and verify any signed announcements; (3) Look for HTTPS certificates—legitimate onion services use valid TLS certificates (the Tor browser shows a green lock); (4) Check the address format—v3 addresses are 56 characters, v2 are 16 characters; (5) Use the Tor Project's official directory or reputable onion link aggregators. Never trust an onion address shared in a forum post without independent verification. Phishing sites often use similar-looking addresses with subtle character differences. Always bookmark verified addresses after first visit and compare carefully before returning.

Users compromise anonymity through preventable errors. Maximizing browser window size reveals screen resolution, which combined with other data can identify you—keep the window at default size. Logging into personal accounts (email, social media) while using Tor defeats anonymity; the account itself identifies you. Downloading files without caution exposes your real IP if the file type is not handled by Tor browser—use extreme care with PDFs and documents. Enabling plugins like Flash or Java bypasses Tor entirely. Typing personal information into forms, even on onion sites, creates linkable data. Assuming all onion sites are safe—many host malware or scams. Running Tor alongside a VPN can actually weaken security if misconfigured. Visiting onion sites with JavaScript enabled in certain configurations can leak your real IP. The Tor browser documentation recommends disabling JavaScript for maximum security, though this breaks some sites.

Tor, VPN, and I2P are distinct technologies with different strengths. Tor routes traffic through multiple volunteer-run relays, making it difficult for any single entity to correlate your traffic; it is designed for anonymity and censorship resistance but is slower due to multiple hops. VPN services encrypt traffic through a single provider's server; they are faster but require trusting the VPN provider with your IP address and traffic metadata. I2P (Invisible Internet Project) is a decentralized network similar to Tor but optimized for internal communication rather than accessing external sites; it has smaller user base and fewer exit nodes. Tor is best for accessing censored information and publishing anonymously. VPN is better for general privacy and speed. I2P suits peer-to-peer communication and file sharing. Tor websites specifically require Tor browser for access; VPN users cannot access .onion addresses without also running Tor.

Safe access requires deliberate steps: (1) Download Tor browser only from the official Tor Project website, never from mirrors or third-party sources; (2) Keep Tor browser updated to the latest version; (3) Use the default security settings—do not disable security features for convenience; (4) Connect to Tor before opening any browser tabs; (5) Use a dedicated device or virtual machine if accessing sensitive information; (6) Disable JavaScript in Tor browser settings if maximum security is needed; (7) Do not resize the browser window; (8) Do not install additional extensions or plugins; (9) Use a strong, unique password for any accounts created on onion sites; (10) Assume any onion site could be compromised and avoid entering personal information unless necessary. For marketplace access, refer to the Verified Marketplaces page for additional vetting guidance.