Tor URL: Understanding Its Structure

Key points

A Tor URL is a .onion address that serves as the self-authenticating hostname for an onion service reachable only through the Tor network. Version 3 addresses are exactly 56 characters long before the ".onion" suffix and always end in the letter "d" because they encode a 32-byte ed25519 public key, a two-byte checksum, and the version byte 0x03 in base32.¹²

You can verify any .onion address by obtaining it directly from the organisation’s clearnet HTTPS site or by checking the Onion-Location HTTP header in Tor Browser.³

What Is a Tor URL?

A Tor URL, specifically a .onion address, is not a typical web domain. Instead, it acts as a cryptographic identifier for an onion service, which can only be accessed through the Tor network. This self-authenticating hostname encodes the service's public key, ensuring that users can verify the authenticity of the service they are connecting to⁴.

The structure of a .onion address differs significantly from standard URLs. For example, a version 3 .onion address is exactly 56 characters long, excluding the ".onion" suffix. It consists of a base32 encoding of three components: a 32-byte ed25519 public key, a two-byte checksum, and a version byte (0x03)¹. Notably, every valid version 3 address will end with the letter 'd' due to the encoding rules of base32².

To illustrate, here’s a simplified version of a v3 .onion address structure:

[32-byte ed25519 public key][2-byte checksum][0x03].onion

In contrast, the older version 2 .onion addresses, which were deprecated in 2021, were only 16 characters long and based on a different cryptographic method using RSA-1024¹. Version 3 addresses offer improved security features, including reduced information leakage and stronger resistance to impersonation attacks⁵.

When dealing with .onion URLs, it is crucial to understand that these addresses are not human-readable and can be easily misremembered. Therefore, always verify any .onion address through trusted channels, such as the organisation's clearnet HTTPS site or the Onion-Location HTTP header in Tor Browser³.

---

The Structure of a .Onion Address

Understanding the structure of a .onion address is essential for navigating the Tor network securely. A .onion address is unique and consists of specific components that contribute to its functionality as a self-authenticating identifier for onion services.

Components Breakdown

1. Version: The version of the .onion address is indicated by the first byte. For version 3 addresses, this byte is always 0x03, while version 2 addresses were deprecated and are no longer supported as of October 2021¹⁶.

2. Public Key: In version 3 addresses, the public key is a 32-byte ed25519 public key that serves as the identity of the onion service. This key is crucial for establishing secure connections¹⁵.

3. Checksum: Following the public key, a 2-byte checksum is included. This checksum is calculated using the SHA3-256 algorithm, which ensures the integrity of the address¹.

4. Suffix: Every .onion address ends with the suffix ".onion". For version 3, all addresses will end with the letter 'd', a result of the encoding process².

Diagrammatic Breakdown

Here’s a simplified textual representation of a version 3 .onion address:

[32-byte ed25519 public key][2-byte checksum][0x03].onion

The total length of a version 3 .onion address is 56 characters, excluding the ".onion" suffix. The encoding used for version 3 is base32, which includes the characters A-Z and 2-7. In contrast, version 2 addresses were only 16 characters long and used base32 encoding derived from a SHA1 hash of an RSA-1024 key¹.

Key Characteristics

• Character Count:

  • v3: 56 characters + ".onion"

  • v2: 16 characters + ".onion"

• Alphabet Used:

  • v3: Base32 (A-Z, 2-7)

  • v2: Base32 (A-Z, 2-7)

Understanding these components will help you navigate the complexities of .onion addresses, ensuring secure and reliable connections to onion services. Always verify addresses through trusted channels to avoid phishing attempts and impersonation attacks⁷.

---

v2 vs v3 Onion Addresses

When comparing version 2 (v2) and version 3 (v3) onion addresses, the differences are significant in terms of length, security, and cryptographic methods used.

v2 onion addresses are 16 characters long and are based on the first 80 bits of a SHA1 hash of an RSA-1024 identity key, encoded in base32. This version was deprecated due to its weaker cryptographic standards, which made it more vulnerable to various attacks. Support for v2 addresses was fully removed after October 2021, meaning all v2 services became unreachable¹⁶. An example of a v2 onion address is abc123def456ghi7.onion, which illustrates the short and less secure nature of this format.

In contrast, v3 onion addresses are significantly more robust, consisting of 56 characters (plus the ".onion" suffix) and employing a more secure cryptographic framework. The v3 structure includes a 32-byte ed25519 public key, a two-byte checksum, and a version byte (0x03)¹. This design not only enhances security but also reduces information leakage and improves resistance to impersonation attacks⁵. A typical v3 onion address might look like abcdefgh123456ijklmnopqrstu.onion, showcasing its longer and more complex format.

The advantages of v3 over v2 are clear. The transition to ed25519 and SHA3-256 cryptographic methods provides stronger security features, making it harder for attackers to compromise the service or impersonate it⁵. For anyone operating or accessing onion services, understanding these distinctions is crucial for ensuring secure connections and avoiding outdated protocols.

As you navigate the Tor network, always verify onion addresses through trusted channels to mitigate risks associated with phishing and impersonation⁷.

---

How Tor URLs Are Generated

The generation of a Tor URL, specifically a .onion address, involves a cryptographic process that utilises public and private keys. For version 3 (v3) addresses, this process employs the ed25519 cryptographic algorithm, which provides enhanced security features compared to older versions.

A v3 .onion address is derived from a 32-byte ed25519 public key, which serves as the identity of the onion service. This public key is critical for self-authentication, allowing users to verify the integrity and authenticity of the service they are connecting to⁴. The structure of a v3 address consists of three main components: the public key, a two-byte checksum, and the version byte (0x03). These components are encoded using base32, resulting in a fixed length of 56 characters, plus the ".onion" suffix¹.

The checksum is generated using the SHA3-256 hashing algorithm, which ensures that the address has not been altered. Specifically, the checksum is the first two bytes of the SHA3-256 hash computed from the concatenation of the string ".onion checksum", the public key, and the version byte¹. This process not only adds a layer of security but also makes the address self-authenticating, as the checksum can be verified upon connection.

When a client connects to an onion service, it retrieves a signed descriptor from the distributed hash table of hidden service directories. This descriptor is verified against the public key embedded in the .onion address, ensuring that the connection is authentic and secure⁴. The design of v3 addresses aims to mitigate risks such as impersonation attacks and information leakage, which were more prevalent in the older version 2 addresses that relied on less secure RSA-1024 keys⁵.

To summarise, the creation of .onion addresses involves a sophisticated interplay of cryptographic principles, ensuring that each address is unique, secure, and self-authenticating. Understanding this process is essential for anyone navigating the Tor network and engaging with onion services safely.

---

Common Myths About Tor URLs

Several misconceptions surround Tor URLs, particularly .onion addresses. Addressing these myths is crucial for a clearer understanding of how the Tor network operates.

Myth 1: "Tor URLs are impossible to track"

While it is a common belief that Tor offers complete anonymity, the reality is more nuanced. Tor provides significant protections against traffic analysis for most adversaries, but it does not guarantee untraceability against a global passive adversary who can monitor both ends of a Tor circuit. Official documentation acknowledges that while Tor makes tracking difficult, it is not infallible⁸. Law enforcement agencies, such as the FBI, have successfully tracked specific Tor users through targeted investigations using techniques like timing analysis and exploiting vulnerabilities⁹. Therefore, while Tor enhances privacy, it is not entirely immune to tracking.

Myth 2: "All .onion sites are illegal"

This myth overlooks the diversity of .onion sites available. While some .onion addresses host illegal content, many legitimate services operate on the Tor network. For instance, the Tor Project itself maintains a .onion site that provides resources and information about using the Tor network safely¹⁰. Additionally, various organisations use .onion addresses to protect user privacy and provide secure communication channels. Thus, not all .onion sites are illegal; many serve beneficial purposes.

Myth 3: "You need special software beyond Tor Browser"

This misconception suggests that accessing .onion sites requires additional software or tools. In reality, the Tor Browser is specifically designed to access .onion addresses without needing any extra software. It is crucial to keep the Tor Browser updated and configured correctly to ensure optimal security and functionality¹¹. By using the Tor Browser, you can seamlessly navigate .onion sites without any special requirements, making access straightforward for users who wish to explore the Tor network safely.

By dispelling these myths, you can better understand the capabilities and limitations of Tor URLs, enabling a more informed approach to navigating the network.

---

Significance of Onion Addresses on the Dark Web

Onion addresses, specifically .onion URLs, play a crucial role in ensuring anonymity and censorship resistance within the dark web. The structure of these addresses is designed to facilitate secure, private communications between users and onion services while protecting their identities.

One of the key features of .onion addresses is their self-authenticating property. Each .onion address encodes the service's identity public key, which allows clients to verify the authenticity of the service they are connecting to. This self-authentication is achieved through a cryptographic process that includes a checksum, ensuring that the address has not been tampered with⁴. When a client connects to an onion service, it retrieves a signed descriptor that is verified against the public key embedded in the .onion address, thus achieving end-to-end authentication⁴. This mechanism significantly reduces the risk of impersonation attacks and enhances the overall security of the connection.

The structure of version 3 .onion addresses further strengthens anonymity and censorship resistance. These addresses are 56 characters long, composed of a 32-byte ed25519 public key, a 2-byte checksum, and a version byte¹. Unlike older version 2 addresses, which were shorter and based on less secure cryptographic methods, version 3 addresses utilise SHA3 and ed25519, offering improved security and reducing information leakage to directory servers⁵. The absence of a central registrar for .onion addresses means that these services operate independently, allowing users to access them without fear of censorship or external control⁴.

In the context of topic links 3.0 onion directories, the significance of .onion addresses becomes even more apparent. These directories facilitate the discovery of onion services while maintaining user privacy. By using self-authenticating addresses, the risk of fraudulent or malicious services is mitigated, providing users with a safer browsing experience.

Understanding the significance of .onion addresses is essential for anyone navigating the dark web. Their unique structure not only supports anonymity but also fosters a resilient environment against censorship, enabling users to access a diverse range of services securely.

---

How to Verify a Tor URL

Verifying a Tor URL, particularly a .onion address, is essential to ensure that you are connecting to a legitimate service. Here’s a practical checklist to help you confirm the authenticity of an onion address:

Checklist for Verification

1. Length Check: Ensure the address is 56 characters long (plus the ".onion" suffix) for version 3 addresses. If it’s shorter, it may be a deprecated v2 address, which is no longer supported¹.

2. Ending Character: Confirm that the address ends with the letter 'd'. This indicates it is a v3 address, as all v3 addresses end with this character due to the encoding process².

3. Obtain from Trusted Sources: Get the .onion address directly from the organisation’s clearnet HTTPS site. Look for an Onion-Location HTTP header that prompts a '.onion available' button in the Tor Browser³.

4. Checksum Validation: Understand the checksum mechanism. For v3 addresses, the first two bytes of the SHA3-256 hash of the concatenation of ".onion checksum", the public key, and the version byte create the checksum. This checksum helps verify that the address has not been altered¹.

5. Use Verification Tools: Consider using tools provided by the Tor Project that can help validate .onion addresses. These tools often check the integrity and authenticity of the service you are trying to access.

Red Flags to Watch For

• Unusual Characters: If the address contains characters outside of the A-Z or 2-7 range, it is likely invalid. v3 addresses use base32 encoding, which limits the character set to these ranges¹.

• Suspicious Links: Avoid relying solely on directories or search results for finding .onion addresses. Many phishing attempts occur through misleading links⁷.

• Missing Security Features: If the service does not offer features like HTTPS or does not provide a way to verify its identity through a TLS certificate, be cautious.

By following this checklist and being vigilant about potential red flags, you can significantly reduce the risk of connecting to fraudulent onion services. Always prioritise direct and verified sources for obtaining .onion addresses to maintain your security while navigating the Tor network.

---

Popular .Onion Sites and Their URLs

Navigating the .onion landscape can seem daunting, but several well-known and historically stable onion services can help you get started. Here’s a list of some prominent .onion sites by category, along with their respective URLs. Keep in mind that addresses can change, so always verify through official sources.

Search Engines

• Ahmia: This search engine indexes .onion sites and provides a user-friendly interface for exploring the dark web. Its current address is http://ahmia.fi (access via Tor Browser).

Email Services

• ProtonMail: A privacy-focused email service, ProtonMail offers a .onion version to enhance user anonymity. Its .onion address is protonmail.com (ensure you visit the official site for verification).

Directories

• The Hidden Wiki: A well-known directory of .onion sites that provides links to various services, both legal and illegal. Its address has changed over time; always check the most current version through trusted channels.

News and Information

• The Tor Project: The main site for the Tor Project, which provides resources and updates about the Tor network. Its .onion address is http://torproject.org¹⁰.

Marketplaces

• Dream Market: Historically one of the largest dark web marketplaces, it has been accessible via a .onion address. However, note that many marketplaces frequently change URLs or become inactive, so verify current addresses through reliable sources.

By using these services, you can explore the Tor network while prioritising safety and security. Always ensure you are accessing the correct addresses, as the dark web can be rife with phishing attempts and scams. For a more comprehensive list of verified .onion sites, consider visiting resources like the Onion Link Directory.

Typical Errors and Misconceptions

You might wonder why so many people still get .onion addresses wrong despite clear technical rules. Several persistent mistakes appear across forums and older guides. Each one stems from overlooking the cryptographic construction defined in the specification.

Assuming any 16-character address still works

Many users search for short addresses because they remember the older format and expect compatibility. In practice this fails because version 2 addresses relied on RSA-1024 and were fully removed after October 2021; any attempt to reach them returns an unreachable error¹⁶. You should always generate or request a fresh 56-character address by adding a new HiddenServiceDir entry with the default version 3 in your torrc file.

Treating the .onion string as a random identifier

People often copy partial prefixes or assume the address is simply a hash they can shorten for convenience. This exposes you to phishing because the full base32(PUBKEY | CHECKSUM | VERSION) structure is required for self-authentication; truncation breaks the checksum and prevents descriptor verification¹⁷. Always copy the complete 56 characters plus the .onion suffix and verify it against the organisation’s clearnet HTTPS site before use.

Believing the address itself guarantees total untraceability

A frequent myth holds that simply using a .onion link makes every connection invisible to all observers. Tor protects against traffic analysis for most adversaries yet cannot defend against a global passive adversary who observes both ends of a circuit, as stated in project documentation⁸. Law enforcement has tracked targeted users through timing analysis, malicious relays or endpoint compromises, so you must combine the address with updated Tor Browser at Safer or Safest security levels¹¹⁹.

Relying on directory listings or search results alone

Users frequently paste addresses found in generic indexes without further checks, assuming the listing guarantees legitimacy. Such sources have enabled impersonation attacks because .onion addresses are self-generated locally with no central registrar⁴⁷. You should obtain the address directly from the organisation’s clearnet site, watch for the Onion-Location header that triggers the “.onion available” button, or confirm via a TLS certificate issued to that exact .onion name³.

Ignoring the fixed suffix and length when validating

Some attempt to validate by eye and accept any string that looks plausible, overlooking that every valid version 3 address ends with the letter “d”. This happens because the version byte 0x03 always produces that base32 suffix after the checksum². Before you connect, count exactly 56 characters, confirm the final letter is “d”, and optionally recompute the checksum yourself from the 32-byte ed25519 public key to match the embedded value¹.

Expecting human-readable or memorable names

Many newcomers complain that .onion addresses are impossible to remember and therefore treat them casually. The design deliberately derives the name from the ed25519 master public key to satisfy Zooko’s triangle principles without a central authority, so memorability is traded for cryptographic self-authentication⁴. You must store the full address securely or retrieve it each time from a verified clearnet location rather than relying on memory or untrusted bookmarks.

Conclusions

You should remember these core points before exploring further.

• Always use full 56-character version 3 addresses that end in the letter “d” and stay within the base32 character set A-Z and 2-7.

• Obtain every address directly from the service’s clearnet HTTPS page rather than directories or search results to avoid phishing.

• Verify the checksum yourself or confirm the presence of an Onion-Location header and a matching TLS certificate before you connect.

• Keep Tor Browser updated to at least version 16.0 and select Safer or Safest security levels to limit JavaScript exposure.

• Treat no address as permanently safe; re-check integrity each time you plan to visit.

Next, strengthen your starting point by visiting the Onion Link Directory: Your Go-To Resource for verified entry points.