Onion Link: What You Need to Know for Safe Browsing

What an Onion Link Actually Is

An onion link is a web address ending in .onion that you can only reach through the Tor network. Unlike regular domain names registered through ICANN, the .onion top-level domain exists solely within Tor's routing system. When you visit an onion link, your connection passes through at least three encrypted relays before reaching the destination service, and the service itself never learns your IP address.

Version 3 vs Version 2 Addresses

Current onion addresses use version 3, which contains 56 characters before the .onion suffix. A v3 address is generated as base32(PUBKEY | CHECKSUM | VERSION) + ".onion", where PUBKEY is the 32-byte ed25519 master public key of the service[1]. This structure makes the address self-authenticating: the public key is embedded directly in the address, so you can verify you're connecting to the correct cryptographic identity.

Version 2 addresses were 16 characters long and relied on a hash of the public key rather than the full key[2]. The Tor Project deprecated v2 in 2021, and Tor Browser 11.0 (released November 8, 2021) stopped supporting them entirely[4]. If you encounter a 16-character onion address today, it will return an "Invalid Onion Site Address" error.

What an Onion Link Is Not

An onion link is not a search engine result you can open in Chrome or Firefox. It requires Tor Browser or another Tor-capable client. It is not a browser extension, a downloadable file, or a protocol like https://. The .onion suffix is a special-use top-level domain reserved exclusively for Tor's onion routing protocol.

All traffic between you and an onion service is end-to-end encrypted by the Tor protocol itself, so HTTPS is not required for confidentiality[5]. However, an onion address alone does not prove the site's identity—only that you reached the holder of the corresponding private key[5].

How Onion Links Differ from Regular URLs

When you type a regular web address into your browser, your computer queries the Domain Name System to translate the domain into an IP address, then establishes a direct connection to that server. An onion link bypasses DNS entirely. The Tor network resolves .onion addresses internally by looking up the service's descriptor in a distributed hash table maintained by directory relays, not by asking a centralised name server[1]. No DNS query leaves your machine, so your ISP never sees which onion service you're visiting.

No Certificate Authority Validation

Surface-web HTTPS relies on certificate authorities to verify a site's identity: your browser checks that a trusted CA signed the site's certificate. Onion services work differently. A version 3 onion address is self-authenticating because it embeds the service's full ed25519 public key directly in the 56-character address[1][2]. When you connect, Tor verifies that the service's cryptographic identity matches the public key in the address. No third-party CA is involved, and no one can impersonate the service without stealing its private key.

This design means you don't need HTTPS for confidentiality when visiting an onion service—the onion protocol already encrypts traffic end-to-end[5]. However, the address alone does not tell you who operates the service, only that you reached the holder of the corresponding private key[5]. If an attacker controls the private key, the address will authenticate the attacker's service perfectly.

No Indexing by Google

Search engines cannot crawl onion services because they require a Tor connection to resolve. Google, Bing, and other surface-web engines will never list an onion link in their results. Specialised directories such as Ahmia and The Hidden Wiki index some onion services manually, but coverage is incomplete and often outdated. Most onion services remain invisible unless you already know the address or find it through a trusted referral.

What Happens in a Standard Browser

If you paste an onion link into Chrome, Firefox, or Safari, the browser will attempt a DNS lookup for the .onion domain. Because .onion is not a real DNS top-level domain, the lookup fails immediately and you see an error such as "This site can't be reached" or "Server not found." The browser never contacts the Tor network. You must use Tor Browser or configure another application to route traffic through Tor before an onion link will resolve.

What Onion Links Are For

Onion links serve a straightforward purpose: they let you reach websites and services without revealing your IP address or location to the site operator. This design benefits anyone who needs privacy-preserving access to information, not just users engaged in illegal activity. Journalists, whistleblowers, activists in restrictive countries, and ordinary readers who want to browse without surveillance all rely on onion services for the same technical reason—end-to-end encryption and no centralised point of control[6].

Legitimate Public Services

Many established organisations run onion mirrors of their surface websites. The BBC operates an onion service so readers in countries that block the BBC's regular domain can still access news content. The New York Times, ProPublica, and Deutsche Welle each maintain onion versions of their sites, advertised through the Onion-Location HTTP header that causes Tor Browser to display a purple '.onion available' pill in the URL bar[5]. When you click the pill, Tor Browser redirects you to the onion mirror automatically.

SecureDrop is a widely deployed whistleblower platform that news outlets and NGOs host as onion services. Sources upload documents through an authenticated onion address, which requires the client to provide an authentication token before accessing the service[5]. Tor Browser displays a small grey key icon in the URL bar when you connect to an authenticated service, confirming that the session is protected by client authentication as well as the usual onion encryption.

Secure email providers such as ProtonMail offer onion gateways so you can check your inbox without exposing your IP address to the mail server. DuckDuckGo runs an onion service for its search engine, giving you a way to search the surface web through Tor without exit-node surveillance. These services are public, indexed by directories such as Ahmia, and documented on the operators' surface websites.

Private and Invite-Only Services

Not every onion service appears in a directory. Some are deliberately unlisted: a research group might share data through an onion address known only to collaborators, or a support forum might require an invitation link. The 56-character v3 address is effectively unguessable—there is no way to stumble upon a private service by chance[1][2]. If you don't have the full address, you cannot reach the service.

Authenticated onion services add a second layer of access control by requiring a cryptographic token before the service will respond[5]. This design is common for internal tools, private file-sharing, and any scenario where the operator wants to restrict access to a known set of users. The address itself remains hidden from Tor's public onion-service directories, and even if someone learns the address, they cannot connect without the authentication credential.

What Onion Services Are Not

Onion links are not synonymous with illegal marketplaces or criminal forums. While such sites do exist on the Tor network, they represent a subset of onion services—not the majority. Tor Metrics publishes daily counts of unique v3 onion addresses, extrapolated from aggregated relay statistics, and a 2025 PoPETs paper reports that onion services collectively serve traffic at nearly 4 Gbit/s across applications ranging from news to chat to whistleblowing[7][6]. The technology itself is neutral; the use case determines legality.

Framing the dark web as inherently criminal ignores documented, lawful applications and discourages people who would benefit from privacy-preserving tools. If you need to access information without surveillance, onion links offer a practical solution backed by transparent cryptography and a decade of operational history.

How to Open an Onion Link Safely

Opening an onion link requires three steps: download Tor Browser from the official source, verify the download, and paste the address into the browser. No VPN is required, and adding browser extensions will break your anonymity. The process takes five to ten minutes if you follow the documented procedure.

Install Tor Browser from the Official Source

Visit torproject.org and download Tor Browser for your operating system. Do not download from third-party mirrors, app stores, or search-engine results that claim to offer Tor—these may bundle malware or surveillance code. The Tor Project signs every release with a PGP key published on the official site. After downloading, verify the signature by following the instructions on the download page. If the signature check fails, delete the file and download again.

Tor Browser is a modified version of Firefox configured to route all traffic through the Tor network. It includes HTTPS-Only Mode, which forces encrypted connections to sites that support them[8]. The browser does not require installation on Windows or macOS—you can run it directly from the downloaded folder.

Open the Browser and Paste the Onion Link

Launch Tor Browser. The first time you open it, you will see a connection screen that establishes a circuit through three Tor relays. This process takes 10 to 30 seconds on a typical broadband connection. Once connected, the browser displays a search page. Paste the full 56-character onion address into the URL bar, including the .onion suffix, and press Enter.

Tor Browser will resolve the address by querying Tor's distributed directory system, not DNS[1]. If the service is online, the page will load. If you see 'Invalid Onion Site Address', the address is either a deprecated v2 link (which has been unsupported since November 2021[4]) or contains a typo. Version 3 addresses are 56 characters long; version 2 addresses were 16 characters and no longer work.

Adjust the Security Slider for JavaScript Risks

Tor Browser includes a security slider accessible through the shield icon in the URL bar. The 'Safest' level disables JavaScript by default on all sites and only allows features required for static pages[9]. Many onion services rely on JavaScript for basic functionality—forums, search engines, and file-upload forms often break when JavaScript is disabled. You can lower the slider to 'Safer' or 'Standard' for specific sites, but understand the trade-off: JavaScript can fingerprint your browser, exploit vulnerabilities, or de-anonymise you if the site is malicious.

For onion links you do not trust, leave the slider on 'Safest'. For documented public services such as DuckDuckGo's onion search or the BBC's onion mirror, 'Safer' is a reasonable compromise. The slider applies per-session—if you restart Tor Browser, it resets to your chosen default.

What Not to Do

Do not install browser extensions in Tor Browser. Extensions can leak your real IP address, bypass Tor routing, or fingerprint your browser configuration. The Tor Project explicitly warns against adding plugins, and doing so voids the anonymity guarantees of the browser.

Do not use a VPN alongside Tor Browser unless you understand the specific threat model. A VPN does not improve anonymity for onion services—all traffic is already end-to-end encrypted by the Tor protocol[5]—and it introduces a single point of observation (the VPN provider) that can log your activity. If your threat model requires hiding Tor use from your ISP, a bridge is the documented solution, not a VPN.

Do not maximise the browser window. Tor Browser opens in a fixed size to prevent websites from fingerprinting your screen resolution. Resizing the window makes your browser configuration more unique and easier to track across sessions.

Where Onion Links Come From and How to Verify Them

Onion links are not registered through a central authority or domain registrar. Each address is generated directly from a cryptographic public key, which means anyone can create an onion service without permission, payment, or identity verification[1]. A version 3 onion address is calculated as base32(PUBKEY | CHECKSUM | VERSION) + '.onion', where PUBKEY is the 32-byte ed25519 master public key of the service and CHECKSUM is the first two bytes of SHA3_256('.onion checksum' | PUBKEY | VERSION)[1]. The resulting address is 56 characters long, excluding the '.onion' suffix[2]. This design makes onion addresses self-authenticating—the address itself proves you have reached the holder of the corresponding private key—but it also means there is no registry you can consult to confirm who operates a given service.

How Onion Links Are Distributed

Because onion services do not appear in DNS or surface-web search engines, operators distribute links through four main channels: directories, specialised search engines, direct sharing, and Onion-Location headers. Directories such as The Hidden Wiki list onion addresses manually, organised by category. Coverage is incomplete and often outdated, because directory maintainers rely on submissions and manual curation. Ahmia is a search engine that crawls publicly accessible onion services and indexes their content, similar to how Google indexes the surface web. You can search Ahmia from its own onion address or through its clearnet gateway.

Direct sharing is common for private or invite-only services. An operator posts the onion link on a trusted forum, sends it through encrypted messaging, or publishes it on their surface website. Onion-Location is an HTTP header that surface websites use to advertise their onion mirror[5]. When you visit a site over Tor Browser that includes this header, the browser displays a purple '.onion available' pill in the URL bar. Clicking the pill redirects you to the onion version automatically, removing the need to search for the address manually.

Verification: Cross-Check Across Two Independent Sources

The self-authenticating property of onion addresses does not tell you who operates the service, only that you reached the holder of the private key[5]. If an attacker controls the private key, the address will authenticate the attacker's service perfectly. To reduce the risk of phishing or impersonation, cross-check any onion link across at least two independent sources before you visit it. For example, if you find a link to a news outlet's onion service in The Hidden Wiki, confirm it by visiting the outlet's official surface website and looking for the same address in their documentation or footer. If the addresses match, you have reasonable confidence the link is legitimate.

Check that the address is exactly 56 characters long, excluding '.onion'[2]. Version 2 addresses were 16 characters and have been unsupported since November 2021[4]. If you encounter a shorter address, it will not resolve in current versions of Tor Browser. Be cautious of addresses that differ by only one or two characters from a known service—phishing sites often register look-alike addresses to trick users. Onion addresses are case-insensitive, but the character set is limited to base32 (a–z and 2–7), so any address containing the digit '0', '1', '8', or '9' is invalid.

If you cannot find a second independent confirmation, treat the link as untrusted. Use Tor Browser's 'Safest' security level to disable JavaScript, do not enter credentials, and do not download files until you have verified the service through a documented channel.

Common Mistakes That Break Anonymity or Lead to Scams

Even when you use Tor Browser correctly, five documented failure patterns can expose your identity or deliver you to a fraudulent service. Each mistake has a specific technical consequence and a corrective action you can take immediately.

Opening Onion Links in a Non-Tor Browser

Pasting an onion address into Chrome, Firefox, or Safari will produce a DNS error, because .onion is not a real top-level domain and standard browsers do not route traffic through the Tor network[1]. Some users then search for the address in a search engine, which logs the query and associates it with your IP address. If you need to visit an onion link, you must use Tor Browser—there is no workaround that preserves anonymity. Download Tor Browser from torproject.org, verify the signature, and paste the address into the URL bar after the connection screen completes.

Enabling JavaScript on Untrusted Onion Sites

JavaScript can fingerprint your browser configuration, exploit vulnerabilities in the rendering engine, or execute code that de-anonymises you by leaking your real IP address through WebRTC or other side channels. Tor Browser's 'Safest' security level disables JavaScript by default and only allows features required for static pages[9]. Many onion services break at this setting—forums, search engines, and file-upload forms often require JavaScript to function. If you lower the slider to 'Safer' or 'Standard' for a site you do not trust, you accept the risk that the site can fingerprint or attack your browser. The corrective action is to leave the slider on 'Safest' for any onion link you have not verified across two independent sources, and only lower it for documented public services such as DuckDuckGo's onion search or news outlets' onion mirrors.

Logging Into Personal Accounts Over Tor

If you log into your email, social media, or cloud-storage account through Tor Browser, the service associates your Tor session with your real identity. Even if the connection is encrypted and routed through three relays, the service provider sees your username and can link subsequent activity to you. If you later visit an onion service in the same browser session, timing analysis or session correlation may reveal that the same person accessed both the personal account and the onion link. The corrective action is to use Tor Browser exclusively for anonymous browsing—never log into accounts that contain your real name, phone number, or payment information. If you need to access a personal account securely, use a separate browser outside Tor.

Downloading Files From Unknown Onion Services

Files downloaded through Tor Browser can contain malware, tracking pixels, or metadata that reveals your identity when you open them outside the browser. A PDF may embed your real IP address if you open it in a viewer that makes network requests, or a Word document may contain author metadata that links to your real name. If you download a file from an onion service you have not verified, do not open it on your main operating system. The corrective action is to open downloaded files inside a virtual machine or a dedicated offline environment, and to strip metadata using a tool such as exiftool before moving the file to your main system. For onion services you trust, check that the file hash matches a published hash on the service's official surface website or documentation.

Trusting Cloned or Lookalike Onion Addresses

Because onion addresses are 56 random-looking characters, phishing sites register addresses that differ by one or two characters from a known service[2]. If you mistype the address or copy it from an untrusted source, you may reach an imposter site that collects credentials, distributes malware, or redirects you to a scam. The self-authenticating property of onion addresses means the address you visit will always authenticate the holder of the corresponding private key—but it does not tell you who that holder is[5]. The corrective action is to bookmark verified onion links in Tor Browser after you confirm them across two independent sources, and to check that the address is exactly 56 characters long (excluding .onion) before you press Enter. If a site asks for login credentials or payment information and you have any doubt about the address, close the tab and verify the link again through the service's official documentation.

What Onion Links Cannot Do

Onion routing provides transport anonymity—it hides who you are talking to and where you are connecting from—but it does not verify that the server you reach is honest, does not protect you once data leaves the Tor network, and does not defend against malware or malicious content[5]. Understanding these boundaries is essential, because many users assume that visiting an onion link guarantees safety or that the Tor network itself filters out scams and exploits. It does not.

Onion Links Do Not Guarantee the Server Is Honest

A version 3 onion address proves you have reached the holder of the corresponding private key, but it does not tell you who that holder is or whether they operate the service honestly[5]. If an attacker controls the private key, the address will authenticate the attacker's service perfectly. Documented cases of malicious onion services include phishing clones of cryptocurrency exchanges, counterfeit marketplaces that steal deposits, and honeypot forums operated by law enforcement to collect user data. The self-authenticating property of onion addresses means you can trust the cryptographic connection, but you must independently verify the operator's identity through cross-checking and reputation signals before you trust the service with credentials, payments, or sensitive information.

Tor Does Not Encrypt Data After It Leaves the Exit Node

When you visit a surface-web site through Tor Browser, your traffic passes through three relays: the entry guard, a middle relay, and the exit node. The exit node decrypts the final layer of encryption and forwards your request to the destination server in plaintext[5]. If the destination site uses HTTP instead of HTTPS, anyone monitoring the exit node can read your traffic, inject malicious code, or log the sites you visit. This limitation does not apply to onion services, because all traffic between you and an onion service is end-to-end encrypted by the Tor protocol and never passes through an exit node[5]. For surface-web browsing, Tor Browser includes HTTPS-Only Mode to force encrypted connections wherever possible[8], but you remain vulnerable if a site does not support HTTPS or if you disable the setting.

Exit-node monitoring is a documented attack. Researchers have published studies showing that a small number of malicious exit nodes can capture passwords, session cookies, and other unencrypted data from users who visit HTTP sites. The corrective action is to treat Tor as transport anonymity only—always verify that the URL bar shows 'https://' before you enter credentials or personal information on a surface-web site, and prefer onion services for sensitive activities because they eliminate the exit-node risk entirely.

Onion Links Do Not Protect You From Malware

An onion service can host malware, exploit kits, or phishing pages just as easily as any surface-web site. Tor Browser includes security features such as NoScript and the JavaScript security slider[9], but these do not prevent you from downloading a malicious file or visiting a site that exploits an unpatched vulnerability in the browser. If you lower the security slider to 'Safer' or 'Standard' to access a feature-rich onion service, you accept the risk that JavaScript on that site can fingerprint your browser, exploit rendering bugs, or execute code that leaks your real IP address through side channels such as WebRTC.

The Tor network does not scan or filter content. It routes your traffic anonymously, but it does not inspect packets for viruses, block known-bad addresses, or warn you when you visit a fraudulent service. Protecting yourself from malware requires the same precautions you would take on the surface web: keep Tor Browser updated, leave the security slider on 'Safest' for untrusted sites, do not download files from services you have not verified, and open any downloaded files in a virtual machine or offline environment before moving them to your main system.

Your ISP Can See That You Are Using Tor

Tor does not hide the fact that you are using Tor from your internet service provider. When you connect to the Tor network, your ISP sees that you have established a connection to a known Tor entry guard, because the list of Tor relays is public[7]. The ISP cannot see which onion services you visit or what data you transmit—that information is encrypted—but the connection pattern itself is visible. In jurisdictions where Tor use is legal, this is not a problem. In environments where using Tor may attract suspicion or investigation, the Tor Project recommends using a bridge—a private entry relay not listed in the public directory—to obscure the fact that you are connecting to Tor. A VPN does not improve anonymity for onion services and introduces a single point of observation (the VPN provider) that can log your activity; bridges are the documented solution for hiding Tor use from network observers.

Onion routing is a powerful tool for transport anonymity, but it is not a substitute for endpoint security, content verification, or operational security practices. You must verify the operator of each onion service, keep your browser updated, disable JavaScript for untrusted sites, and understand that Tor hides your location and identity from the server—not the server's intentions from you.

Checking Whether an Onion Link Is Currently Reachable

Onion services can go offline without notice, and a link that worked yesterday may return a connection error today. Unlike surface-web sites with uptime monitoring and status dashboards, most onion services operate without public infrastructure, so you must verify reachability at the time you intend to use the link. Tor Browser's connection behaviour and a handful of third-party tools provide the only reliable signals.

Using Tor Browser's Connection Status

When you paste an onion address into Tor Browser and press Enter, the browser attempts to build a circuit to the service's introduction points. If the service is reachable, the page loads within 10–30 seconds. If the connection fails, you will see one of three error messages: 'Unable to connect' means Tor could not establish a circuit to the service's introduction points; 'Onionsite Not Found' means the address is correctly formatted but no service is publishing descriptors for that address; 'Invalid Onion Site Address' means the address does not match the 56-character v3 format or contains a checksum error[1][2]. The first two errors indicate the service may be temporarily offline or permanently shut down. The third error means you have mistyped the address or copied a malformed link.

If you receive 'Unable to connect', wait two minutes and try again—onion services sometimes take longer to publish fresh descriptors after a restart. If the error persists after three attempts, the service is likely offline. Do not assume the address is wrong; version 3 addresses embed a cryptographic checksum, so Tor Browser will reject any address with a typo before it attempts to connect[1].

Checking Public Directories and Status Pages

Some onion services publish a status page on their surface-web site or list their current onion address in a public directory such as Ahmia. If the service operator maintains a clearnet mirror, check whether that mirror is reachable and whether it advertises the same onion address you are trying to visit. If the surface site is offline, the onion service is probably offline as well. Public directories do not monitor uptime in real time—they index addresses that were reachable when the directory last crawled the network—so an address listed in Ahmia or The Hidden Wiki may still be unreachable when you visit it.

Using Onion-Lookup for Metadata Checks

Onion-lookup is a third-party service that checks whether an onion address is publishing introduction-point descriptors to the Tor network. You submit the address through a web form, and the service queries the Tor directory authorities to see if the address has active descriptors. If descriptors are present, the service is reachable; if not, the service is offline or the address does not exist. Onion-lookup does not visit the service or verify its content—it only checks the network metadata. This is useful for confirming that an address is structurally valid and currently advertising itself, but it does not tell you whether the service will load correctly or whether the operator is honest.

The limitation is that onion-lookup itself is a third-party service, so you are trusting it not to log the addresses you check. Use it only for addresses you would be comfortable revealing to a network observer, and do not rely on it as the sole verification method.

Understanding That Services Disappear Permanently

Onion services have no domain registrar, no renewal fees, and no public ownership records. An operator can shut down a service at any time by deleting the private key, and once the key is gone, the address can never be recovered[1]. If a service goes offline and does not return within a few weeks, assume it is permanently unavailable. There is no central registry to query and no way to contact the operator unless they have published contact information on a surface-web site. This is why you should bookmark verified onion links immediately after you confirm them and re-check reachability each time before you rely on the service for sensitive activity.

For further context on how onion services fit into the broader dark web ecosystem, see Dark Web Onion: Understanding Its Role.

Legal and Policy Context for Onion Links

Using Tor and accessing onion services is legal in most countries, including the United Kingdom, the United States, and the European Union. The Tor Project operates openly, publishes its source code, and receives funding from research institutions and human-rights organisations. No law in these jurisdictions criminalises the act of downloading Tor Browser, connecting to the Tor network, or visiting an onion address. The technology itself is neutral—law enforcement and journalists use onion services for secure communication, and the Tor Project's transparency reports document cooperation with researchers studying network security.

However, accessing an onion link does not grant you immunity from the law. Actions you take through Tor are subject to the same criminal and civil statutes that apply to surface-web activity. If you use an onion service to purchase controlled substances, distribute child-abuse material, commit fraud, or engage in any other illegal conduct, you can be investigated, arrested, and prosecuted. Documented cases include Operation Onymous in 2014, which resulted in the seizure of multiple darknet marketplaces and the arrest of operators and users, and the 2021 takedown of a ransomware infrastructure hosted on onion services. Law enforcement agencies infiltrate onion services, operate honeypots, and use traffic correlation, operational-security mistakes, and cooperating witnesses to identify suspects. Tor hides your IP address from the service, but it does not erase digital evidence, prevent informants, or protect you from mistakes such as reusing usernames, logging in without Tor, or revealing identifying details in messages.

Restrictions in Authoritarian States

A small number of countries restrict or ban Tor use outright. China, Iran, and Turkmenistan employ deep-packet inspection to block connections to known Tor entry guards, and possession of Tor Browser or circumvention tools can attract state attention. In these environments, the Tor Project recommends using bridges—unlisted entry relays that are harder to block—but you must assess the legal and personal risk before you connect. Tor's transparency reports document requests from governments for user data, though the Tor Project cannot provide such data because it does not log user activity or store identifying information.

The legal status of onion services is the same as the legal status of the content and transactions they host. Running an onion service is not inherently illegal, but hosting illegal material or facilitating illegal transactions through one is prosecuted under existing laws. If you operate an onion service, you are responsible for its content and compliance with the laws of the jurisdictions in which you and your users are located. If you visit an onion service, you are responsible for your actions on that service. Tor provides transport anonymity, not legal immunity.

Common Mistakes and Misconceptions

Assuming HTTPS means you are on the right onion site

Many users think that seeing a padlock or an HTTPS URL on an onion service confirms the site is legitimate. Onion services are already end-to-end encrypted, so HTTPS does not add confidentiality, and the onion icon in Tor Browser does not by itself authenticate the site's identity[5]. An attacker can set up a phishing onion service with a valid HTTPS certificate for a lookalike domain. Verify the operator through an independent channel—such as a signed message or a clearnet site you already trust—rather than relying on the certificate.

Treating all 16-character onion addresses as still valid

Some people save old onion links and assume they will work indefinitely. Version 2 onion addresses used 16 characters, but v2 support was removed from the Tor codebase on July 15, 2021, and Tor Browser 11.0 disabled v2 entirely on November 8, 2021[2][10][4]. Visiting a former v2 address now returns an 'Invalid Onion Site Address' error. If you encounter a 16-character address, discard it and look for a 56-character v3 replacement from the operator's current channel[2].

Believing the Tor Browser's onion icon confirms site authenticity

The onion icon in the URL bar tells you that you are connected to an onion service, not that you are connected to the right one. For onion services served over HTTP, the icon provides no information about whether the site is the one you intended to visit, because the onion protocol's encryption does not authenticate the operator's identity[5]. Only an authenticated onion service—indicated by a small gray key icon in the URL bar—offers cryptographic proof that the service requires a client token[5]. For ordinary onion links, cross-check the address from a source you already trust.

Expecting onion services to stay online like surface-web sites

Surface-web sites have registrars, hosting contracts, and public ownership records, so downtime is often temporary and recoverable. Onion services have none of that infrastructure: an operator can delete the private key at any time, and once the key is gone, the address can never be recovered[1]. If a service goes offline for more than a few weeks, assume it is permanently unavailable. Bookmark verified links immediately and re-check reachability each time before you rely on the service for sensitive activity.

Leaving JavaScript enabled on untrusted onion services

Tor Browser's default security level allows JavaScript, which many onion services need for login forms or interactive features. On unknown or high-risk services, JavaScript can be used for browser fingerprinting or exploit delivery. Set the security slider to 'Safest' before visiting a service you have not verified, which disables JavaScript by default and only allows features required for static sites and basic services[9]. If the site breaks, decide whether the functionality is worth the added exposure.

Assuming a vanity address means a trustworthy service

Vanity onion addresses are generated so the address starts with a pre-chosen sequence of characters, usually a meaningful name[11]. Some users interpret this as a sign that the operator is legitimate or invested in the service. In practice, generating a vanity address requires computational work but no identity verification, and anyone can produce an address that starts with a familiar brand name. Treat a vanity address as a memorability aid, not as evidence of authenticity.

What to Remember

• A v3 onion address has 56 characters before the '.onion' suffix; discard any 16-character v2 link, since v2 support was removed in 2021[2][10][4].

• HTTPS on an onion service does not prove you are talking to the right operator; verify the address through a source you already trust[5].

• Never open the same account outside Tor Browser, because your real IP address can then be linked to your onion activity.

• Set the security slider to 'Safest' before visiting an unverified service, and treat vanity addresses as memorability aids, not trust signals[9][11].

When you are ready to go further, read Dark Web Onion: Understanding Its Role to see how onion services fit into the wider Tor ecosystem.