Menu
Independent Tor encyclopedia Learn
Learn

Onion Services: Hidden Services and v3 Addresses

What onion services (hidden services) are: v3 addresses, legitimate uses such as SecureDrop, and how to tell a real .onion from a phishing clone.

Author
Published
Last reviewed
Level
Beginner
Reading time
10 min
Clearnet site versus onion service Left: traffic exits Tor to a public site. Right: both client and service stay inside Tor and meet at a rendezvous. CLEARNET SITE Leaves at the exit Guard → middle → exit → site Exit sees the destination HTTPS still required on that hop ONION SERVICE Stays inside Tor Rendezvous, no public IP Address is a v3 key, not DNS Service never sees visitor IP CLEARNET SITE Leaves at the exit Guard → middle → exit → site Exit sees the destination HTTPS still required on that hop ONION SERVICE Stays inside Tor Rendezvous, no public IP Address is a v3 key, not DNS Service never sees visitor IP
Ordinary sites leave Tor at an exit. Onion services stay inside Tor: the address is a key, not a DNS name, and neither side learns a public IP.

Short answer: Onion services are servers reachable only through the Tor network. They use cryptographic addresses (56 characters, v3) instead of DNS. The server does not learn the visitor’s IP, and the visitor does not see a server IP. Legitimate examples: SecureDrop, OnionShare, Tor Project mirrors.

Onion services — formerly “hidden services” — are services reachable only over Tor. Unlike ordinary websites, there is no public IP that a DNS record resolves. A cryptographic address identifies the service instead. The visitor builds a Tor circuit; the server replies on the same path without learning the client IP.

How v3 addresses work

Since 2020, Tor uses onion service v3 exclusively. A v3 address is 56 characters from the Base32 alphabet and ends in .onion. It is based on strong keys (Ed25519) and is far more resistant to brute force than the old v2 format, which was shut down in 2021. Details in the glossary: Onion Service v3.

Tor Browser internally sends a v3 address to the correct hidden service directory and builds a rendezvous path. For the user it looks like a normal URL visit — only slower than the clearnet.

Legitimate use

Onion services are not a tool for illegal markets. They primarily serve:

  • Press freedom: SecureDrop instances for whistleblowers
  • File transfer: OnionShare without a central server
  • Censorship circumvention: news sites with onion mirrors (BBC, ProPublica)
  • Project infrastructure: Tor Project onion sites for downloads in blocked regions

Phishing and verification

Because .onion addresses are hard for people to memorize, phishing clones are a real problem. An attacker copies a known page under a similar-looking address. Defense:

  1. Take addresses only from primary sources (torproject.org, securedrop.org)
  2. Check the operator’s PGP-signed canary statements
  3. Never navigate to sensitive services via search engines or wiki links

More: Detecting phishing and finding verified onion links.

Distinguishing onion services from Tor Browser

Tor Browser is the client. An onion service is the server on the other side. Both use the Tor network, but in different roles. The transport principle is explained in Onion Routing.

Topics

  • Onion Service
  • Hidden Service
  • v3
  • Tor