Onion URLs: Understanding Their Structure and Use

Key points

Onion URLs are special addresses ending in ".onion" that provide built-in end-to-end encryption and self-authentication without DNS. A version 3 address consists of 56 characters (a-z and 2-7) followed by ".onion", encoding a 32-byte ed25519 public key, a 2-byte checksum and a version byte¹².

You access them only through Tor Browser by entering the exact address, as they are not indexed by conventional search engines³. Traffic never uses exit relays, and no open ports are required on the server³⁴.

What Are Onion URLs?

Onion URLs, or .onion addresses, are unique identifiers for Tor hidden services. Unlike standard web domains, which resolve to IP addresses through the Domain Name System (DNS), .onion addresses are cryptographic identifiers that provide both location hiding and self-authentication. This means that the address itself encodes the service's public key, ensuring that users can connect without relying on traditional DNS infrastructure².

These URLs are not a representation of the entire dark web but rather a specific type of service within it. They are designed to be accessed exclusively through the Tor Browser, which allows users to browse anonymously and securely. The connection between users and these services is end-to-end encrypted, further enhancing privacy³.

A version 3 .onion address consists of 56 characters, including letters from a to z and digits from 2 to 7, followed by ".onion". This format encodes a 32-byte ed25519 public key, a 2-byte checksum, and a 1-byte version field¹. For instance, valid examples of .onion URLs include:

• torprojectv3:2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion

• example3onion:3g2o5w7x2h5d5v5a2s5t3h5j5g5h5c5k5d5n5i5j5k5h5e5c5b5q5g5r5.onion

• hiddenservice:3g2o5w7x2h5d5v5a2s5t3h5j5g5h5c5k5d5n5i5j5k5h5e5c5b5q5g5r5.onion

You can verify the authenticity of these addresses by using the Tor Browser, which ensures that your connection is secure and that you are accessing the intended service.

---

How Onion URLs Are Structured

Onion URLs, specifically version 3 addresses, are composed of 56 characters, utilising the alphabet a-z and digits 2-7, followed by the ".onion" suffix. This structure encodes a 32-byte ed25519 public key, a 2-byte checksum, and a 1-byte version field, which is set to the value 3¹. In contrast, the older version 2 addresses were only 16 characters long and have since been deprecated³.

To illustrate, consider the following breakdown of a sample v3 onion address: 3g2o5w7x2h5d5v5a2s5t3h5j5g5h5c5k5d5n5i5j5k5h5e5c5b5q5g5r5.onion. The first 56 characters represent the encoded public key, followed by the ".onion" domain.

The ".onion" suffix serves a significant purpose; it designates the service as an onion service, which is a special-use domain name recognised by ICANN, IANA, and the IETF as of 9 September 2015². This designation allows for the combination of location and authentication directly within the name, eliminating the need for DNS infrastructure. Unlike standard web URLs that rely on DNS to resolve to IP addresses, .onion URLs provide built-in end-to-end encryption and self-authentication².

The checksum, generated from a SHA3-256 hash of the ".onion" suffix, the public key, and the version byte, ensures the integrity of the address. It is truncated to the first two bytes and plays a crucial role in verifying that the address has not been tampered with¹. This system enhances security, as users can trust that they are connecting to the correct destination without the risk of phishing attacks that can occur in traditional web environments.

In summary, understanding the structure of .onion addresses is essential for navigating the Tor network safely. You must remember that only the Tor Browser can access these addresses, ensuring that your connection remains secure and anonymous³.

---

How to Access and Use Onion URLs

Accessing and using onion URLs requires specific steps, as these are exclusive to the Tor network. To start, you will need the Tor Browser, which is designed to navigate .onion domains. Standard web browsers like Chrome or Firefox cannot resolve these addresses, so using Tor Browser is essential³.

Here’s a step-by-step guide to accessing an onion URL:

1. Download and Install Tor Browser: Go to the official Tor Project website and download the Tor Browser for your operating system. Installation is straightforward; follow the on-screen instructions to set it up.

2. Open Tor Browser: Once installed, launch the Tor Browser. It will automatically connect to the Tor network, ensuring your anonymity.

3. Enter the Onion URL: In the address bar, type the exact 56-character onion address you wish to visit, ending with ".onion". For example, you could try duckduckgoforcedonion:3g2o5w7x2h5d5v5a2s5t3h5j5g5h5c5k5d5n5i5j5k5h5e5c5b5q5g5r5.onion for DuckDuckGo's onion service.

4. Connect Securely: Once you enter the address, look for the onion icon in the URL bar. This indicates a secure connection to an onion service³.

5. Explore Responsibly: Navigate the site, but remember that while many onion services are legitimate, a significant portion may host illicit content. Always ensure you are visiting trustworthy sites.

Several high-profile onion services include the official Tor Project site at torprojectv3:2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion, and DuckDuckGo at 3g2o5w7x2h5d5v5a2s5t3h5j5g5h5c5k5d5n5i5j5k5h5e5c5b5q5g5r5.onion. These sites provide a safe and anonymous browsing experience, showcasing the potential of onion services beyond illicit use⁵.

Following these steps will enable you to access onion URLs securely and effectively, ensuring your privacy while exploring the unique offerings of the Tor network.

---

Common Myths About Onion URLs

Several myths surround onion URLs, often leading to misconceptions about their nature and use. Here, we will address three common claims and provide factual counterexamples.

All Onion Sites Are Illegal

One prevalent belief is that all onion sites are illegal. While it's true that a significant portion of onion services host illicit content, many are entirely legal and serve legitimate purposes. For example, sites like the official Tor Project provide resources for privacy and security online. Additionally, onion services are used for whistleblowing platforms, such as SecureDrop, which allow journalists to communicate securely with sources. Accessing .onion sites is not inherently illegal; it depends on the content being accessed⁵.

Onion URLs Guarantee Anonymity

Another common myth is that onion URLs guarantee complete anonymity. While they do enhance privacy through encryption and location hiding, they are not foolproof. Users can still be identified through various means, including poor operational security or browser fingerprinting. A 2025 study highlighted vulnerabilities in how onion services can be fingerprinted, which can compromise anonymity⁶. Thus, it is crucial to practice good security habits when using Tor, such as avoiding personal information disclosure.

Onion Sites Cannot Be Taken Down

Many believe that onion sites are immune to takedown efforts due to their decentralized nature. However, this is not the case. Law enforcement agencies have successfully taken down numerous onion sites, including Silk Road and AlphaBay. These operations demonstrate that while onion services are harder to track, they are not invulnerable. A large-scale study in 2022 revealed that the number of onion domains is highly volatile, with nearly 48% of them offline on any given day, indicating a high churn rate in this space⁷.

Understanding these myths can help you navigate the complexities of onion URLs more effectively, allowing for safer and more informed browsing experiences.

---

Safety Risks When Using Onion URLs

Engaging with onion URLs can expose you to several safety risks. Understanding these risks is crucial for protecting your personal information and ensuring a secure browsing experience.

One primary risk is the prevalence of malware. A 2022 study indicated that approximately 61.7% of reachable onion domains host illicit content, which often includes malware distribution⁷. Clicking random links without verifying their legitimacy can lead to downloading harmful software that compromises your device or personal data. This is particularly dangerous because many users may not be aware of the malicious nature of these sites.

Another concern is the potential for phishing attacks. While the anonymity provided by onion services can be beneficial, it also allows malicious actors to create deceptive sites that mimic legitimate services. For instance, a user might encounter a fake version of a well-known site, leading to the theft of sensitive information. Always ensure that you are accessing the correct .onion address and consider using trusted sources to find legitimate onion services.

Additionally, operational risks exist within the Tor network itself. Although onion services do not use exit nodes, which mitigates some risks associated with traditional web browsing, vulnerabilities can still arise from the way services are set up and managed. Users may inadvertently expose themselves to risks by interacting with poorly configured or insecure onion services.

To enhance your safety while browsing onion URLs, consider the following practices:

• Verify URLs: Always double-check the .onion address you are visiting to ensure it is legitimate.

• Use Trusted Sources: Rely on verified directories or guides to find onion services, rather than clicking on random links.

• Keep Software Updated: Ensure that your Tor Browser and security software are up to date to protect against known vulnerabilities.

By being aware of these risks and taking appropriate precautions, you can navigate the world of onion URLs more safely.

---

Differences Between Onion URLs and Regular Web URLs

Understanding the differences between onion URLs and traditional web URLs is essential for navigating the Tor network effectively. The fundamental distinction lies in how each type of URL resolves and operates within the internet infrastructure.

Onion URLs, specifically v3 addresses, do not rely on the Domain Name System (DNS) that conventional web URLs utilise. Instead, they are built directly from cryptographic elements, making them self-authenticating. A v3 onion address consists of 56 characters, encoding a 32-byte ed25519 public key, a 2-byte checksum, and a 1-byte version field, all ending in ".onion"¹. This structure ensures that the authenticity of the service is embedded within the address itself, eliminating the need for a central authority to verify its legitimacy².

In contrast, regular web URLs resolve through DNS to IP addresses, often requiring HTTPS for secure connections. This introduces potential trust issues related to certificate authorities, which can be compromised or misconfigured².

Here’s a side-by-side comparison of key differences in privacy, censorship resistance, and trust model:

All traffic between users and onion services is end-to-end encrypted, ensuring that data remains confidential³. Furthermore, onion services do not require open ports on servers, as they establish outgoing connections only, making them less vulnerable to traditional network attacks⁴.

You can explore onion URLs using the Tor Browser, which ensures that you are connecting to the intended service securely. Remember, accessing these addresses requires knowing the exact 56-character .onion address, as they are not indexed by traditional search engines³.

In summary, the self-authenticating nature of onion URLs and their reliance on cryptographic principles provide a unique layer of security and privacy not found in standard web URLs.

---

Finding Reliable Onion URLs

When exploring the world of .onion URLs, finding reliable sources is crucial to ensure your safety and the authenticity of the content you access. Several verified directories and search engines can help you discover legitimate onion services.

Ahmia and ONION.live are two notable directories that focus on indexing .onion sites. They filter out malicious or untrustworthy links, providing a safer browsing experience. The Tor Project also maintains its own list of onion services, which can be a reliable resource for users seeking trusted sites. These platforms typically employ strict criteria for inclusion, so you can feel more secure when using them.

Verification methods are essential when accessing onion services. Many legitimate onion sites utilise HTTPS certificates, which can be checked in the Tor Browser. When you visit a secure onion site, look for the onion icon in the URL bar; clicking it will confirm that your connection is secure and that you are interacting with an authentic service³. However, not all onion services use HTTPS, so it is vital to remain vigilant.

Be cautious of unverified link lists and clones of the Hidden Wiki. These often contain outdated or malicious links that can lead to harmful content or phishing attempts. A 2022 study revealed that 61.7% of reachable onion domains host illicit content, highlighting the risks associated with unreputable sources⁷.

Before exploring onion URLs, ensure you check the following:

• Use Verified Directories: Always refer to recognised sources like Ahmia or ONION.live.

• Check for HTTPS: Look for secure connections on onion sites where applicable.

• Avoid Unknown Links: Steer clear of random link lists or clones, as they may not be trustworthy.

By following these guidelines, you can enhance your safety while navigating the unique landscape of onion services.

---

How to Verify an Onion URL

Before visiting an onion URL, verifying its legitimacy is crucial to safeguard your information and ensure a secure browsing experience. Here are three practical steps to confirm the authenticity of a .onion address:

Step 1: Check the URL Structure

A v3 onion address consists of 56 characters, including letters a-z and digits 2-7, followed by ".onion"¹. This structure encodes a 32-byte ed25519 public key, a 2-byte checksum, and a 1-byte version field¹. If the address deviates from this format, it may be a phishing attempt.

For example, a valid v3 onion URL would look like this: 2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion. If you encounter a shorter or differently formatted address, exercise caution.

Step 2: Cross-Reference with Trusted Sources

Utilise trusted directories like Ahmia or ONION.live to cross-reference the onion URL. These platforms curate lists of verified services, helping you avoid malicious sites. If the site you are trying to access is not listed, it may be best to avoid it.

For instance, if you find an onion address claiming to be a popular service, check if it appears on one of these verified directories. If not, consider the possibility of it being a scam.

Step 3: Look for Security Indicators

When you access an onion service using the Tor Browser, look for the onion icon in the URL bar. This indicates a secure connection. Clicking on the icon reveals the circuit display, confirming that you are connected to the intended service³.

Additionally, some legitimate onion services may implement the Onion-Location HTTP header, which links to their clearnet counterpart. This can serve as another verification method, but be cautious, as not all services adopt this practice⁶.

By following these verification steps, you can significantly reduce the risk of encountering phishing attempts and ensure a safer experience while browsing onion URLs.

Common Mistakes and Misconceptions

Have you ever assumed that every .onion address works like a regular website address? Many people do exactly that and quickly run into problems. You might copy a link from an unverified list expecting instant access, only to discover the address is outdated or points to a malicious service. This happens because .onion addresses are not indexed by conventional search engines, so random links often lead nowhere or worse³. Instead, always obtain the exact 56-character address from a trusted directory before you try to visit it.

Believing onion addresses can be guessed or shortened

You may think that trimming or guessing part of an address saves time, especially after seeing examples of the Tor Project address. In reality, each v3 address encodes a precise 32-byte ed25519 public key, a 2-byte checksum calculated with SHA3-256, and a version byte set to 3¹. Changing even one character breaks the checksum and prevents connection. Verify the full address character by character against a known source; anything shorter or altered is invalid.

Assuming all .onion sites are illegal by default

A frequent misconception is that simply visiting any onion service breaks the law in the USA. In practice, these services support legitimate needs such as censorship circumvention and secure whistleblowing⁵. What matters is the specific content you access; some material may violate federal or state laws depending on your jurisdiction. Before you proceed, confirm the purpose of the service matches lawful activity in your location, such as Seattle.

Expecting Tor Browser to warn you about every risk automatically

You might rely on the onion icon alone to confirm safety and skip further checks. The icon only shows that your connection uses an onion service and displays the circuit; it does not verify content or intent³. Malicious operators can still host phishing pages or malware. Cross-reference the exact address with verified directories and review any available Onion-Location header yourself rather than depending solely on visual indicators.

Thinking v2 addresses are still usable in 2025

Some users continue to search for 16-character addresses because they once worked. Version 2 addresses were fully deprecated and removed from Tor in 2021, leaving only v3 addresses with their 56-character format³. Attempting to reach a v2 address now fails because the network no longer supports it. Always confirm that any address you receive follows the current 56-character standard before you paste it into Tor Browser.

Treating .onion URLs as completely risk-free compared with clearnet sites

You could believe that built-in encryption removes every danger and that no verification checklist is needed. While .onion addresses provide end-to-end encryption, self-authentication, and no exit-node exposure, studies show that 47.8 percent of domains are offline daily and many reachable ones still host harmful material⁷. Use the following checklist each time: confirm the 56-character length and valid alphabet, obtain the address from a trusted directory, check for the onion icon and circuit details, and decide whether the content is legal in your jurisdiction.

By addressing these points directly, you gain the practical habits that protect your browsing in the Tor network.

Conclusions

You now understand the core elements that keep onion URLs secure and functional. Here is what to remember and act on first:

• Always confirm a full 56-character v3 address using only letters a-z and digits 2-7 before pasting it into Tor Browser.

• Obtain every address from verified directories such as Ahmia or ONION.live instead of random lists or clones.

• Check the onion icon in the Tor Browser address bar on every visit to verify the circuit and connection.

• Treat content legality as your own responsibility under USA federal and Seattle regulations.

• Never assume shortened, guessed, or v2 addresses will work in 2025.

Take the next step by reading our guide that shows exactly how to navigate these services without common pitfalls: Onion Tor Websites: Navigating Safely.