What Is a Tor URL and How Do Onion Addresses Work

A Tor URL is a web address that points to a hidden service running on the Tor network. These addresses are not registered with any central authority and do not appear in DNS lookups. Instead, they are derived from cryptographic keys generated by the server operator.

Onion addresses come in two formats. Version 2 addresses are 16 characters long and use a shorter key format, though they are now deprecated by the Tor Project due to security improvements. Version 3 addresses are 56 characters long and use stronger encryption, making them the current standard for new hidden services.

When you visit a Tor URL, your browser does not connect directly to the server. Instead, your traffic is routed through multiple Tor relays, each removing one layer of encryption, until it reaches the hidden service. This process is called onion routing, which is where the .onion domain suffix gets its name.

A Tor hidden service operator generates a public and private key pair. The public key is hashed to create the onion address that users see. This means the address is mathematically tied to the server's identity, so the same server will always have the same address.

Verifying a Tor URL is critical because attackers create phishing clones with similar-looking addresses to steal credentials or distribute malware. The legitimate address is typically published on the operator's official website, social media, or in PGP-signed announcements.

To verify a Tor link URL, follow these steps:

1. Find the official address from a trusted source, such as the project's main website or a PGP-signed statement
2. Compare the full address character by character, not just the first few letters
3. Check whether the site uses HTTPS and displays a valid certificate
4. Look for any security warnings from your Tor browser
5. Bookmark the correct address to avoid typing it again and risking a typo

Never rely on search results or third-party directories alone to find a Tor web link. Attackers often register similar addresses and rank them in search results.

A regular web link uses DNS resolution to translate a domain name into an IP address, which is then used to route traffic to a server. This process is visible to your internet service provider and can reveal which websites you visit.

A Tor URL bypasses DNS entirely. Instead, the Tor network itself resolves the onion address and routes your traffic through multiple relays. Your ISP sees only that you are using Tor, not which hidden services you access.

This difference has important implications. Regular websites can be taken offline by seizing the server or the domain registrar. Tor hidden services are harder to shut down because they have no central point of failure. However, this also means that Tor URLs can be used for both legitimate and illegal purposes. Law enforcement has successfully identified and seized hidden services by compromising the Tor network or by using traditional investigative techniques, as documented in court records from major darknet market seizures.

Many people assume that a Tor market URL follows a predictable pattern or that you can guess a legitimate address by looking at similar ones. This is false and dangerous. Each onion address is unique and randomly generated from cryptographic keys.

Another misconception is that all Tor URLs are illegal or that accessing one puts you at legal risk. In reality, many legitimate organizations run Tor hidden services, including news outlets, human rights groups, and privacy-focused companies. The Tor Project itself publishes official Tor links for downloading the browser and accessing documentation.

A third myth is that a Tor URL is permanent and cannot change. While the mathematical relationship between the key and the address is permanent, a server operator can generate a new key pair and move to a new address. This is sometimes done for security reasons or when a service is compromised. Attackers exploit this by creating new phishing clones whenever the legitimate address changes.

According to security-vendor incident reports and Tor Project documentation, phishing clones are among the most common threats on the Tor network. Attackers create fake versions of popular marketplaces and forums with addresses that look similar to the legitimate ones, often differing by only one or two characters.

The reason this works is that Tor addresses are long and difficult to remember. Users often type them from memory or copy them from untrusted sources, making typos or falling for lookalike addresses. Some attackers also compromise the servers hosting mirrors or directory listings and replace legitimate addresses with their own clones.

Law enforcement has documented cases where exit scams and market seizures were followed by waves of phishing clones. When a popular marketplace goes offline, users search for mirrors, and attackers flood the results with fake versions. This matters to ordinary users because losing credentials or funds to a phishing clone is indistinguishable from being scammed by the legitimate service, except that the legitimate service has no record of your transaction and cannot help you recover.

The Tor Project and security researchers recommend that users verify addresses through multiple independent sources and use PGP signatures to confirm authenticity whenever possible.

Finding a legitimate Tor URL requires more care than finding a regular website. Search engines do not index .onion addresses, so you cannot use Google to find them reliably.

Here are the safest ways to locate a Tor link URL:

1. Visit the operator's official clearnet website and look for a link to their onion address
2. Check PGP-signed announcements published on the operator's social media or mailing list
3. Use the Useful Resources page on this site, which maintains a curated list of verified addresses
4. Look for addresses published in academic research or security reports that cite their sources
5. Ask in trusted communities, but verify the answer against official sources before using it

Once you have found a candidate address, verify it by checking multiple sources. If three independent sources give you the same address, it is much more likely to be legitimate. If you find conflicting addresses, assume all of them are potentially compromised and wait for an official announcement before proceeding.

Bookmarking verified addresses in your Tor browser is safer than searching for them repeatedly. This reduces the chance of typos and limits your exposure to phishing clones.

Understanding Tor URLs is important because they represent a different model of web access. Unlike regular websites, which are centralized and can be monitored or censored, Tor hidden services are distributed and resistant to takedown.

For journalists, activists, and people living under censorship, Tor URLs provide a way to access information and communicate without revealing their location or identity. For ordinary users, understanding how Tor URLs work helps you recognize scams and protect yourself from phishing.

The key takeaway is this: a Tor URL is not inherently safe or unsafe. The address itself is just a cryptographic identifier. Safety depends on verifying that you are connecting to the intended server, understanding what that server does, and using it with appropriate operational security practices.

Start by learning to verify a single Tor URL that you trust. Use the Useful Resources page on this site to find an official address, compare it character by character with any address you encounter elsewhere, and bookmark it. This one habit will protect you from most common phishing attacks and give you a foundation for exploring the Tor network safely.