Short answer: A v3 .onion string is a public key, not a brand. Cryptography proves you reached whoever holds that key — not that the operator is honest. Take addresses from a primary source you already trust, compare all 56 characters, and bookmark them. Community wikis and search results are how clones spread. TorBible records onions we already hold; we do not invent strings or scrape another directory’s table.
This is a directory-hygiene guide, not a shopping list. Pair it with phishing detection and the onion services explainer.
What an onion address is
An onion service is reachable only through Tor. The hostname is derived from the service’s identity key, not from DNS. The Project’s overview is the technical source: the client fetches a signed descriptor from a distributed hash table, checks that signature against the key encoded in the address, then meets the service at a rendezvous point. Neither side needs to publish an IP.
Because the address is the key, a correctly typed v3 URL authenticates the endpoint. Impersonation of that exact string is not a DNS trick. The remaining attack is social: get you to type a different key that looks similar.
v2 versus v3
| v2 (retired) | v3 (current) | |
|---|---|---|
Length before .onion | 16 characters | 56 characters |
| Crypto (simplified) | RSA-1024 / SHA-1 era | Ed25519 identity, SHA-3, Curve25519 |
| Status | Unreachable in current Tor | Default since Tor 0.3.2; only version that works |
The Tor Project published a deprecation timeline in 2020 and removed v2 from the network in 2021 (Tor 0.4.6 and Tor Browser 11.0). A 16-character bookmark that “used to work” is not a slightly old mirror — it is a dead protocol. Current Tor Browser reports an invalid onion address. There is no supported fallback.
v3 is longer because the address carries a full Ed25519 public key plus a checksum and a version byte, encoded in Base32. The checksum catches many typos. It does not catch a different valid key that an attacker generated to share a prefix with a famous service.
Vanity tools grind keys until the first few characters spell a word. Operators use that for branding. Phishers use the same trick so a glance at the start of the string looks “right.” The check that fails is always the same: people do not read the middle.
Why directories exist — and why they fail
Nobody memorizes 56 characters. So people copy from:
- Primary sources: the organization’s own clearnet site, a PGP-signed canary, a newsroom’s published SecureDrop URL.
- Editorial directories: staff-written catalogs that claim they re-check addresses (uptime probes, canary comparison, community cross-checks).
- Community wikis: anyone can edit; clones replace rows; the page still looks like an index.
- Search and chat: indexes and forwards that treat every onion equally.
Legacy Hidden Wiki pages mixed all four. Vandalism and phishing clones are the documented failure mode — see What is the Hidden Wiki?. An editorial directory is a different design: one team owns the table, timestamps matter, user graffiti is not a feature. That design reduces casual vandalism. It does not make the table an oracle. A weekly check can still lag a seized key, a silent re-key, or a lookalike the editors have not seen yet.
Public examples of the editorial/uptime style (clearnet catalogs, not endorsements):
- onion.live describes itself as a non-profit FOSS directory with uptime probes, optional PGP proof on listings, and a no-JavaScript layout. Listing is an application plus a back-link check, not a cryptographic root of trust. Their FORT proposal is a non-executable HTML convention: a signed list of hostnames in the page so a checker can compare the current host to a fingerprint learned earlier. Useful as a standard to look for; not a reason to skip an independent fingerprint.
- torwiki.org describes weekly PGP-canary comparison, community cross-checks, and editorial (non-wiki) control. Treat those claims as process descriptions. A second independent source is still required before a sensitive login.
TorBible’s rule is stricter on publication: we keep onions already in our files; we do not paste a competing wiki’s shop table; market Official slots stay empty until a string is in-house. Catalog language is not a live mirror feed. Read the editorial policy.
A verification sequence that does not depend on one site
- Start from a source you already had — a bookmark, an official HTTPS page, a signature you checked last month. If the only copy of an address appeared in this session’s search result, stop.
- Compare the full 56 characters, not the prefix. Break the string into groups. Substitutions hide in the middle and the end (
l/1,m/rnon lookalike fonts). - Require a signature whose key you learned elsewhere. A PGP-signed mirror list is only as strong as the fingerprint’s provenance. If the key, the fingerprint, and the address all arrived on the same clone, the attacker signed their own phishing page.
- Check the date and the exact bytes. A “Good signature” over last year’s URL list does not bless this week’s paste. The signed text must name the address you are about to open.
- Bookmark once. Re-discovery through directories is how clones win. Use Tor Browser bookmarks for anything you would type a password into.
- Abort on urgency. “New mirror, old one seized, log in now” is the clone’s voice. Real operators publish signed lists on a schedule; they do not need you to panic.
Uptime is not authenticity. A clone can stay up. An official onion can be down. Directories that probe reachability are answering a different question than PGP is.
What we do not do here
We do not publish new .onion strings in this article. We do not rank shops. We do not tell you which directory “is safe to click.” Official project and press onions belong in our services records when we already hold them; market names live in the catalog without invented Official addresses.
If a page — including ours — disagrees with a signed primary source, the signed primary source wins.
Related reading
Onion services, onion address, onion service v3, PGP for Tor users, onion directory tags, official onion mirrors.
Sources
- Tor Project: How do Onion Services work?
- Tor Project: Onion Service version 2 deprecation timeline
- Tor Project: Tor Browser 11.0 — final deprecation of v2
- onion.live: About
- OnionDotLive: FORT (signed hostname-list convention)
- TorWiki: About (editorial-directory process claims)