URL for Dark Web: Understanding .onion Addresses and Onion Links

A .onion URL is a special-use top-level domain that only resolves through the Tor network. Standard web addresses use DNS servers to translate domain names into IP addresses, exposing your location and browsing activity to your ISP. .onion addresses, by contrast, are generated cryptographically and do not require DNS resolution. Each .onion address is a 56-character string (v3 addresses) derived from the server's public key. When you visit a .onion URL through Tor Browser, your connection is routed through multiple encrypted relays, and the server never learns your real IP address. The address itself contains no geographic or identifying information about the server's location, making it fundamentally different from traditional domain names that can be traced to registrars and hosting providers.

The Tor network uses onion routing, a technique where your traffic passes through at least three randomly selected relays before reaching its destination. Each relay knows only the previous and next hop, so no single relay can map your full connection path. When you request a .onion address, your Tor Browser constructs a circuit to an introduction point advertised by the hidden service. The hidden service then builds its own circuit to a rendezvous point, and the two circuits meet there without either party revealing their IP address. This architecture means the server operator cannot determine your location, and you cannot determine the server's physical location. The .onion address itself is derived from the service's public key, so the address is both the identifier and proof of authenticity—if the cryptographic key changes, the address changes, making it impossible for an attacker to silently redirect you to a different server.

V3 onion addresses replaced the older v2 format in 2021. V2 addresses were 16 characters long and used 80-bit keys, which cryptographic analysis suggested could be brute-forced by well-resourced attackers. V3 addresses are 56 characters long and use 256-bit keys, making brute-force attacks computationally infeasible. The longer format also includes additional cryptographic material that prevents certain types of attacks against the onion service itself. V3 addresses are more resistant to enumeration attacks, where an attacker tries to discover hidden services by generating random addresses and probing them. The Tor Project's official documentation recommends that all new onion services use v3 addresses, and most actively maintained services have migrated. If you encounter a v2 address, it likely belongs to an abandoned or unmaintained service, which may indicate security risks or outdated software.

Phishing clones are fake .onion sites designed to mimic legitimate services and steal credentials or funds. Because .onion addresses are cryptographic hashes, they are long and difficult to memorize, making users vulnerable to typos or social engineering. To verify a genuine address: first, obtain the address from multiple independent sources—if a site publishes its address on clearnet mirrors, social media, or official documentation, cross-reference these sources. Second, check for PGP signatures; many legitimate services sign their addresses with a PGP key published long before the address was created. Third, examine the site's security headers and certificate information through Tor Browser's security indicators. A phishing clone will have a different .onion address entirely, since the cryptographic key is different. If you are unsure, visit the site's clearnet mirror or official announcement channels to confirm the correct address. Never click .onion links in emails or messages; always type the address manually or use a bookmark.

Onion directories and search engines index .onion addresses, similar to how standard search engines index the clearnet. These tools crawl onion sites and maintain searchable databases of addresses and descriptions. Some directories are manually curated, while others use automated indexing. When using a directory or search engine, verify that you are accessing the correct .onion address for that tool itself—many phishing clones exist for popular directories. Directories typically organize sites by category: marketplaces, forums, news outlets, privacy tools, and so on. Search results may include inactive sites, so check whether a site is currently online before relying on it. Some directories include user ratings or verification badges, though these should not be trusted as absolute proof of legitimacy. For sensitive activities, consult multiple sources and cross-reference information. This site maintains a verified directory of onion addresses checked for availability; refer to the Verified Marketplaces page for curated listings of active services.

Even with a correct .onion address, user behavior can leak identifying information. Resizing your browser window or using plugins can allow websites to fingerprint you; Tor Browser's default window size is standardized to prevent this. Logging into personal accounts (email, social media, usernames) while on Tor defeats anonymity, since the account itself identifies you. Downloading files from .onion sites without caution can expose your real IP if the file contains embedded content that bypasses Tor. Using the same username across multiple .onion sites allows correlation attacks, where an observer links your activity across services. Enabling JavaScript in Tor Browser can allow certain attacks; the browser disables it by default for this reason. Visiting .onion sites while also using clearnet services on the same device can create timing correlations that link your activities. To maintain anonymity, use Tor Browser's default settings, avoid logging into personal accounts, disable plugins, and consider using a dedicated device or virtual machine for sensitive onion activities.

Tor, VPN, and I2P are three distinct approaches to anonymity, each with different threat models and use cases. Tor routes traffic through multiple relays operated by volunteers worldwide, and .onion addresses provide bidirectional anonymity—both client and server are hidden. A VPN encrypts your traffic and routes it through a single provider's server, hiding your activity from your ISP but not from the VPN provider itself. I2P is a network designed for internal communication and uses unidirectional tunnels; it is less suitable for accessing external websites. Tor is the only system that provides robust protection against traffic analysis by a global adversary, and .onion addresses are the only way to host a service that is both anonymous and resistant to takedown. However, Tor is slower than VPN or clearnet access due to the multiple relays. For accessing .onion sites, Tor is the only viable option. For general privacy, a VPN may be sufficient. For maximum anonymity in both directions, Tor with .onion addresses is the standard.