Onions site

Onion sites, also called onion services, are websites reachable only through the Tor network via special .onion addresses. They hide the server's location, encrypt traffic end-to-end without HTTPS, and generate 56-character addresses automatically. (1) (2) (3)

Access requires the Tor Browser downloaded from torproject.org. Enter the full address, confirm the onion icon appears, and verify it against official sources to avoid phishing clones. (1) (4)

Common legitimate uses include SecureDrop for journalists, anonymous file sharing with OnionShare, and privacy-focused publishing. Not all onion activity is illegal. (1) (5) (6)

What Is an Onion Site?#

Onion sites, or onion services, utilize the .onion top-level domain (TLD) and are exclusively accessible through the Tor network. These services were initially referred to as "hidden services" and were designed to provide anonymity for both users and service operators (1) (2). The term .onion was formalized in 2015 through RFC 7686, establishing it as a special-use domain name for anonymous services (7).

Onion services are characterized by their unique v3 addresses, which are 56 characters long and derived from an Ed25519 public key, along with a checksum and version byte encoded in base32 (8). This design ensures that the addresses are both secure and automatically generated, enhancing user privacy.

Accessing a .onion site requires the Tor Browser, which can be downloaded from the official Tor Project website. Users must enter the complete 56-character .onion address into the browser, after which an onion icon will appear, indicating a secure connection to the onion service (1). It is crucial to verify the address against official sources to avoid phishing attempts, as many malicious actors create similar-looking addresses to deceive users (4).

Legitimate uses of onion services include anonymous publishing, SecureDrop for journalist-source communication, and tools like OnionShare for secure file sharing (1) (6). Many users leverage these services to protect their privacy and circumvent censorship. The misconception that all onion sites are associated with illegal activities is inaccurate; a significant portion of Tor traffic is dedicated to legitimate purposes, such as journalism and privacy advocacy (5).

How Do Onion Sites Work?#

Onion sites operate using a method called onion routing, which ensures anonymity and security. In simple terms, onion routing involves sending internet traffic through multiple layers of encryption. Each layer is decrypted at different points in the network, obscuring the original sender's IP address. This process protects users from surveillance and tracking.

Onion services utilize the .onion top-level domain (TLD), which is different from regular domains like .com or .org. The .onion addresses are specifically designed for the Tor network and are not accessible via standard web browsers. A typical v3 onion address consists of 56 characters, derived from an Ed25519 public key, plus a checksum and version byte, all encoded in base32 (8). This structure ensures that the addresses are unique and secure.

The Tor network resolves .onion addresses without relying on public DNS. Instead, it uses its own directory services. When a user enters a .onion address in the Tor Browser, the browser communicates with Tor relays to locate the service. The connection is established within the Tor network, ensuring that the traffic never exits to the public internet (9).

Here are the basic steps for accessing an onion site:

1. Download the Tor Browser from the official Tor Project website.

2. Enter the full 56-character .onion address into the browser.

3. Confirm that the onion icon appears, indicating a secure connection.

4. Verify the address against official sources to avoid phishing attempts (1) (4).

This method of routing and encryption provides end-to-end security, as the service's location is hidden, and communication remains encrypted without the need for HTTPS (3).

How to Access Onion Sites Safely#

To access onion sites securely, follow these steps:

1. Download Tor Browser: Obtain the Tor Browser from the official website, torproject.org. This browser is specifically designed for .onion sites and ensures safe connections.

2. Enter the .onion Address: Input the complete 56-character .onion address into the Tor Browser. This address is unique and derived from an Ed25519 public key (8).

3. Check for the Onion Icon: After entering the address, look for the onion icon in the browser's address bar. This icon indicates a secure connection to an onion service (1).

4. Verify the Address: Always confirm the .onion address against trusted sources to avoid phishing attempts. Phishing can occur through typosquatting, where malicious actors create similar-looking addresses (4).

Recommended Security Settings

For enhanced security while using Tor Browser, adjust the settings to the following:

• Security Level: Set the security level to "Safest" or "Safer." This will disable potentially vulnerable features on unfamiliar sites (4).

• Enable NoScript: Use the NoScript feature to block scripts from running unless explicitly allowed. This helps prevent cross-site scripting attacks.

Warnings

Avoid using regular browsers or VPNs as substitutes for accessing onion sites. Regular browsers do not support .onion addresses, and using a VPN may compromise your anonymity by exposing your IP address to the VPN provider.

Common Mistakes to Avoid

1. Using Standard Browsers: Do not attempt to access .onion addresses using browsers like Chrome or Firefox.

2. Ignoring Address Verification: Failing to verify the .onion address increases the risk of falling for phishing scams.

3. Disabling Security Features: Turning off security settings in Tor Browser can expose users to risks.

4. Accessing Untrusted Links: Clicking on links from unverified sources can lead to malicious sites.

Following these steps and recommendations can significantly enhance your safety when exploring onion sites.

Legitimate Uses of Onion Sites#

Several reputable organizations maintain official onion versions of their websites, enhancing privacy and security. Notable examples include:

• The New York Times: The onion address is nytimes3xbfya.onion, providing access to news while preserving user anonymity.

• BBC: The BBC offers a version at bbcnewsvote3v7z.onion, allowing users to access news content without censorship.

• ProPublica: This investigative journalism organization operates at www.propub3r6espa.onion, ensuring secure access to its reports.

Privacy tools also have a presence on the Tor network. For instance, ProtonMail offers a secure email service via protonmail.com, while DuckDuckGo provides a search engine focused on user privacy at duckduckgo.com.

SecureDrop is a platform designed for secure communication between journalists and their sources. It operates at various .onion addresses, allowing whistleblowers to submit information anonymously. The CIA also maintains a SecureDrop site for secure whistleblowing, accessible through its onion address.

These uses benefit journalists, activists, and users in regions with heavy censorship. In countries where freedom of expression is limited, onion sites allow individuals to share information and communicate securely. The anonymity provided by these services is crucial for protecting sources and facilitating open dialogue.

Accessing these onion sites involves using the Tor Browser to ensure a secure connection. Users must verify the .onion addresses against official sources to avoid phishing attempts, which are common on the dark web. Phishing often occurs through typosquatting, where malicious actors create addresses that closely resemble legitimate ones (4).

In summary, onion sites serve a legitimate purpose beyond illegal activities. They enable privacy-focused services, journalism, and secure communication, making them valuable tools for users seeking anonymity and safety online (5) (8).

Safety and Risks of Onion Sites#

Onion sites provide technical protections such as end-to-end encryption and IP address hiding. When accessed through the Tor network, these services ensure that traffic remains encrypted without the need for HTTPS, as it never leaves the Tor environment (3). This architecture eliminates risks associated with exit-node eavesdropping, which affects traditional web traffic but is irrelevant for onion services.

However, users still face significant risks. Endpoint compromise is a primary concern. If a user's device is infected with malware, their anonymity is at risk, regardless of the protections offered by the Tor network. Phishing attacks also pose a threat, particularly through typosquatting, where malicious actors create addresses similar to legitimate ones (4). Users should always verify .onion addresses against trusted sources to avoid falling victim to these scams (4).

Statistics highlight the dark web's complexity. According to Chainalysis, dark web marketplaces saw over $1.7 billion in sales in 2021, with significant portions attributed to both illegal and legal activities (5). The Tor Project also notes that while some onion services are used for illicit purposes, many serve legitimate needs, including privacy, journalism, and information sharing (5).

For safe usage, follow these guidelines:

1. Verify Addresses: Always check the full 56-character .onion address against official sources to avoid phishing attempts.

2. Use Security Settings: Set the Tor Browser to "Safer" or "Safest" modes for enhanced protection (4).

3. Stay Informed: Keep the Tor Browser updated to benefit from the latest security patches (10).

This approach can help distinguish between safe and dangerous activities on onion sites, ensuring a more secure experience while navigating the dark web.

Common Myths About Onion Sites and the Dark Web#

Several misconceptions exist regarding onion sites and the dark web. One prevalent myth is that all .onion sites are illegal. This is inaccurate; many onion services serve legitimate purposes, including privacy protection, journalism, and secure communication. Studies indicate that a significant portion of Tor traffic is dedicated to these lawful activities (5).

Another common misconception is the belief that Tor equals the dark web. While the Tor network provides access to the dark web, it also hosts the deep web, which includes legal and non-indexed sites not accessible via standard search engines. The dark web specifically refers to parts of the internet that require special software, like Tor, to access and often contains illegal content. In contrast, the deep web encompasses all content that is not indexed by traditional search engines, including databases and private company sites.

It is also incorrect to assume that Google cannot index any .onion content. Google and other standard search engines do not index .onion sites because they are not part of the public DNS and require the Tor network for access (9). This limitation means users must rely on specific tools and directories, such as the official directory maintained by the Tor Project, to find onion services (8).

Understanding the distinctions among the surface web, deep web, and dark web is crucial. The surface web consists of all publicly accessible websites indexed by search engines. The deep web includes content not indexed by search engines, such as private databases and subscription services. The dark web, on the other hand, is a small portion of the deep web that employs anonymity tools like Tor to obscure users' identities and activities.

These distinctions clarify that not all onion sites engage in illegal activities, and the Tor network serves a broader purpose, supporting privacy-focused services and secure communications.

Notable .onion Services Directory#

The following table presents a curated list of notable .onion services. These services are accessible exclusively via the Tor network and offer various functionalities, from secure communication to information sharing. Each entry includes the service name, its .onion URL, its purpose, and a trust level assessment.

These services illustrate the diverse uses of .onion sites beyond illegal activities. They enhance privacy, support journalism, and promote secure communication in an increasingly monitored digital landscape. Always verify .onion addresses against trusted sources to ensure authenticity and protect against phishing attempts (4) (8).

How to Verify an Onion Site’s Authenticity#

Verifying the authenticity of an onion site is crucial to avoid phishing attacks. Phishing often occurs through typosquatting, where malicious actors create addresses similar to legitimate ones. To protect yourself, follow these verification steps.

Check the V3 Onion Address

Modern v3 onion addresses are 56 characters long, derived from an Ed25519 public key, and include a checksum and version byte encoded in base32, ending in 'd' (8). Always verify the full address against trusted sources.

Use Official Links

Access .onion sites only through official links provided on clearnet websites. The Tor Project maintains an official directory at onion.torproject.org, listing verified addresses for its services (8). This directory helps users confirm the authenticity of .onion addresses.

Check for HTTPS

While onion services provide end-to-end encryption without needing HTTPS, some sites may still offer it. If available, HTTPS can provide an additional layer of security, but the absence of HTTPS does not inherently indicate a lack of safety (3).

Observe the Onion Icon

When using Tor Browser, observe the onion icon in the address bar. This icon indicates a secure connection to an onion service. Additionally, check the circuit information in Tor Browser to ensure you are connected to the correct site (4).

Practical Checklist

1. Verify the Full Address: Always check the entire 56-character .onion address against official sources.

2. Use the Official Directory: Reference the Tor Project's directory for verified addresses.

3. Look for HTTPS: If present, use HTTPS for extra security.

4. Check the Onion Icon: Ensure you see the onion icon in Tor Browser.

5. Avoid Unverified Links: Do not click on links from untrusted sources.

Following these steps can significantly reduce the risk of falling victim to phishing attempts on the dark web (4). Adhering to the Tor Project's recommendations is essential for safe browsing in the .onion space.

OnionShare: Secure File Sharing and Collaboration Over Tor#

OnionShare is an open-source tool designed for secure file sharing and collaboration over the Tor network. It allows users to share files, receive anonymous uploads, and host temporary chat sessions without relying on third-party servers or accounts. This tool operates by starting a temporary onion service directly on the user's computer, providing a practical solution for those seeking privacy and security while sharing information.

Main Functions of OnionShare

1. File Sharing: Users can share files securely by generating a unique .onion URL. This URL allows recipients to download files directly from the user's device without exposing their IP address.

2. Anonymous Uploads: OnionShare enables users to receive files anonymously. Anyone with the generated link can upload files directly to the user's device, ensuring that the sender's identity remains hidden.

3. Temporary Chat: The tool also supports temporary chat sessions, allowing users to communicate securely without creating an account or leaving traces of their conversation.

Basic Usage Steps

1. Download OnionShare: Obtain the latest version of OnionShare from the official website at onionshare.com. Ensure that you download it from a trusted source to avoid phishing attempts.

2. Install and Launch: Follow the installation instructions for your operating system. Once installed, launch OnionShare.

3. Start a Service: Choose whether to share files or receive uploads. For file sharing, add the files you wish to share and click "Start Sharing." This action generates a unique .onion URL.

4. Share the Link: Share the generated .onion URL with your intended recipients. They can access the link using the Tor Browser to download the files securely.

5. Receiving Files: To allow others to upload files to you, select the "Receive Files" option. Share the generated link with users who wish to send files.

Using OnionShare ensures that your file sharing and communication remain secure and anonymous, aligning with the privacy-focused ethos of the Tor network. Always verify that you are using the official OnionShare tool to avoid potential security risks.

Onion Site Verification Checklist and Notable .onion Services#

Common questions#

How do I access a .onion website?

Download Tor Browser from torproject.org. Enter the 56-character .onion address in the address bar. Tor Browser displays an onion icon when connected to an onion service. This works only if you use the official Tor Browser and verify the address from trusted sources.

What does the term "onion site" mean?

The term onion site refers to services reachable only via the Tor network. These use the .onion TLD designated by RFC 7686 in 2015. Modern addresses are 56 characters long and end in d. They hide the service location and encrypt traffic end to end.

Is .onion a dark web site?

Onion services form part of the dark web because they require Tor. The claim that all such sites are illegal is false. Legitimate uses include journalism and privacy tools. This holds when operators follow verified practices.

Can Google access .onion sites?

Google cannot access or index .onion sites. These addresses exist outside public DNS and need Tor to resolve. Users must obtain addresses from official directories. Standard search engines fail here.

How do onion services hide location and provide encryption?

Onion services hide both the service IP address and client location. Traffic stays inside the Tor network for end-to-end encryption. No HTTPS is required for this protection. This applies only when both parties use Tor.

What risks come with visiting .onion sites?

Phishing via typosquatting remains a common risk. Attackers create addresses that differ by a few characters. Verify the full 56-character address against official clearnet sources. The Tor Project recommends Safer or Safest security levels for unknown sites.

How can you verify an onion site address in Manchester?

Compare the full address to the operator clearnet page. Check for the onion icon and circuit details in Tor Browser. The Onion-Location header triggers automatic verification prompts. This process works if you avoid unverified directories.

Conclusions#

Three key points stand out from the facts presented. First, onion sites deliver end-to-end encryption and hide both server and client locations only when accessed through official Tor Browser. Second, verification requires checking the full 56-character v3 address against clearnet sources; shortcuts via unverified directories increase phishing risk. Third, legitimate services such as news outlets, secure email, and file-sharing tools demonstrate practical uses beyond illegal activity when operators publish addresses through trusted channels.

Users in the United Kingdom should begin by downloading Tor Browser from torproject.org and setting security to Safer or Safest level before any visit. This approach works in Manchester and elsewhere provided addresses come from official directories.

Next, review official verification steps in Understanding Tor URLs: What You Need to Know.

Footnotes#

[1] What are .onion sites and onion services? - Tor Project

[2] ONION SERVICES | Tor Project | Tor Browser Manual

[3] Tor Project | How do Onion Services work?

[4] Onion services - Features - Tor Browser — Tor

[5] Dark Web Myths and Realities: Separating Hype from Truth | Recorded Future

[6] Sharing files with OnionShare - Using and sharing - About Tor — Tor

[7] RFC 7686: The ".onion" Special-Use Domain Name

[8] Onion Services | Tor Project | Support

[9] I've heard about websites that are only accessible over Tor. What are these websites, and how can I access them? | Tor Project

[10] Is Tor still safe to use? | The Tor Project