Understanding Tor Website Addresses and Onion URLs

A Tor website address is a cryptographic identifier that routes traffic through the Tor network to a hidden service. The address itself is a string of characters followed by .onion, such as a 16-character v2 address or a 56-character v3 address. These addresses are not assigned by a central authority; instead, they are generated by the Tor software when someone sets up a hidden service.

The .onion domain is a special-use top-level domain reserved by the Internet Engineering Task Force specifically for Tor hidden services. When you visit a .onion address, your browser connects through multiple Tor relays, and the server's identity remains hidden from your internet service provider and the website operator cannot see your real IP address. This mutual anonymity is the core purpose of onion addresses.

Tor has evolved its address format twice. Version 2 (v2) addresses are 16 characters long and were the standard for years. Version 3 (v3) addresses are 56 characters long and were introduced to address security weaknesses in v2 cryptography.

V3 addresses use stronger encryption and are resistant to certain attacks that could theoretically compromise v2 addresses. The Tor Project deprecated v2 support in 2021, meaning new hidden services should use v3. If you encounter a short 16-character .onion address, it may be outdated or a phishing clone. Legitimate projects like the Tor Project itself, news organizations, and privacy advocates have migrated to v3 addresses. When verifying a tor website address, checking whether it uses the v3 format is one early indicator of legitimacy.

When someone creates a hidden service on Tor, the Tor software generates a keypair. The public key is hashed to produce the onion address. This means the address is mathematically tied to the server's identity; you cannot forge an onion address without possessing the corresponding private key.

However, this does not mean the address is human-readable or memorable. The long string of characters is essentially a fingerprint. Because of this, phishing attacks on Tor are common: an attacker can create a new hidden service with a completely different address and clone the appearance of a legitimate site. Users who rely on memory or hastily copied links can easily land on a fake version. This is why the Tor Project and security researchers emphasize the importance of bookmarking official addresses and verifying them through PGP-signed announcements or official channels.

A standard website address uses a domain name registered through a registrar and tied to a real-world entity or IP address. A Tor website address is self-generated and anonymous by design. This fundamental difference reflects the different threat models: regular websites prioritize discoverability and trust through branding, while Tor hidden services prioritize anonymity and resistance to censorship.

Because onion addresses are not human-readable, they are often shared through directories, forums, or word-of-mouth. Some legitimate projects publish their addresses on clearnet mirrors or official social media accounts. The lack of a recognizable brand name in the address itself means you must verify the address through an independent, trusted source. Bookmarking the correct address is far safer than searching for it each time.

According to Tor Project documentation, the only reliable way to verify a Tor website address is to obtain it from an official, PGP-signed announcement or a trusted mirror controlled by the same organization. This matters because phishing clones are trivial to create; an attacker simply registers a new .onion address and copies the website's appearance.

Court records and law-enforcement press releases show that when darknet markets or forums have been seized, clones appeared within hours, often hosted by the same operators as exit scams. Users who did not verify the address lost funds or had their data compromised. Security researchers studying onion services have documented that v2 addresses were more vulnerable to enumeration attacks, which is why v3 adoption is critical. For ordinary users, this means: bookmark official addresses, verify them through multiple independent sources, and be skeptical of any .onion link found in casual conversation or search results.

A Tor website address can become unreachable for several reasons. The hidden service may be temporarily offline for maintenance. The server hosting the service could have crashed or run out of disk space. The Tor daemon itself might have stopped, or the operator may have deliberately taken the service offline.

Law enforcement actions also take sites offline. When a hidden service is seized, the address becomes inaccessible, though the address itself still exists as a cryptographic identifier. Some operators intentionally rotate addresses to avoid being targeted or to shed associations with past activity. If a tor website address is down, checking the official clearnet mirror or social media account of the organization can confirm whether the outage is temporary or permanent. Avoid assuming that a down address means the site is a scam; many legitimate services experience outages.

Setting up a hidden service requires running a Tor relay configured as a hidden service and pointing it to a local web server. The operator generates the onion address during this setup. Unlike clearnet hosting, there is no central registry or hosting provider that assigns addresses; the address is intrinsic to the service.

Operators can configure their hidden service to use a static address that persists across restarts, or they can allow Tor to generate a new address each time. Most legitimate services use static addresses so users can bookmark them. Some operators use address rotation as a security measure, publishing new addresses through official channels when they do so. Understanding this helps explain why tor website links are not centrally managed and why verification is the user's responsibility.

When you find a .onion link, follow these steps before visiting:

1. Check whether the address is v3 (56 characters) or v2 (16 characters); v3 is more trustworthy.
2. Verify the address through the organization's official clearnet website, PGP-signed announcement, or a trusted directory.
3. Bookmark the correct address in your browser so you do not have to search for it again.
4. If the site claims to be a marketplace or forum, cross-reference the address with security research or news articles about that service.
5. Never visit a .onion address based solely on a recommendation from an untrusted source or a casual mention in a forum.

If you are unsure whether an address is legitimate, the safest action is not to visit it. Phishing clones and scams rely on users making quick decisions without verification.