2FA
Two-factor authentication: a second check after a password, often a one-time code or a PGP challenge.
79 terms, letter by letter
Tor and darknet terms A–Z
This A–Z glossary defines 79 terms used across the Tor encyclopedia and directory, including onion routing, guard and exit relays, bridges, OPSEC, escrow, 2FA, and Dread. Each definition has a stable URL and links to related concepts. For longer explanations, browse Tor encyclopedia articles and practical Tor guides.
2
A
AlphaBay
The largest darknet market of 2014–2017, seized in Operation Bayonet. Its founder was arrested in Thailand and died in custody days later; users who fled to Hansa landed on a police-run server.
Anonymity
Anonymity means actions cannot be linked to a persistent identity. Tor reduces network-level linkage; behavior, metadata, and logins can still deanonymize users.
B
Bad Exit
An exit relay that mishandles traffic it should only forward, rewriting pages or logging what HTTPS would have kept from it. Onion services have no exit, so this relay is not on that path.
Bitcoin
Bitcoin is a public blockchain cryptocurrency. Transactions are pseudonymous but traceable via blockchain analysis — unlike Monero for payment privacy.
Bridge
A bridge is a Tor relay whose address does not appear in the public relay list. It helps where known Tor entry points are blocked. Bridges can be used together with pluggable transports. They are a censorship-circumvention tool, not an extra anonymity guarantee.
C
Canary Statement
A signed message from a service operator stating no secret compulsion (warrant, gag order) has been received. Absence of an expected update may signal compromise.
Chain Analysis
Reading a public blockchain to cluster addresses and follow coins. Bitcoin leaves a permanent graph of inputs, outputs, amount, and time; Monero is built so that simple graph is not public.
Circuit
A circuit is the temporary path through several Tor relays that a client builds for connections. Typically three hops: Guard, Middle, Exit. Multiple streams can share the same circuit.
Clearnet
The conventional internet reachable without Tor — standard domains on the public DNS. Contrasts with onion services and private networks.
Compartmentalization
Keeping accounts, roles, and devices apart so a leak in one does not name the others. Tor does not do that separation for you.
Consensus
The consensus is the shared view of the network that all Tor clients hold: which relays exist, what flags they have, and how the network is structured. Directory authorities produce it every few hours.
Correlation Attack
A correlation attack tries to link the inbound and outbound traffic of an anonymity network — by timing, volume, or other patterns. It requires a global or very powerful observer.
D
Dark Web
Sites intentionally not indexed by conventional search engines, often including onion services. Not synonymous with illegal activity — many are legal privacy or news services.
Darknet Market
An online marketplace reachable through an anonymity network such as Tor, settling trades in cryptocurrency and holding payment in escrow instead of using conventional payment rails.
Deanonymization
Deanonymization is the process of linking an anonymous or pseudonymous identity back to a real person or IP. In the Tor context: correlation, timing attacks, login mistakes, or a compromised device.
Deep Web
Web content not indexed by public search engines — paywalled articles, private dashboards, unlinked pages. Much larger than the dark web and mostly mundane.
Direct Deal
A trade arranged off the market, often after an earlier order. Escrow and dispute tools on the platform do not cover it.
Directory Authority
Directory Authorities are a small, well-known group of servers that sign the consensus on valid relays. Clients use this consensus to know the network.
Dispute
A market argument over an order while escrow is still held. After the buyer finalizes, there is usually no balance left to decide.
Domain Fronting
Routing traffic through a permitted CDN hostname while reaching a different backend — sometimes used for censorship circumvention; availability varies by provider policy.
Dread
A Tor-hosted discussion forum used as a public square for market canaries, clone warnings, and takedown talk. Not a marketplace.
E
Encryption
Encoding data so only intended recipients can read it. Tor encrypts traffic between relays; HTTPS encrypts to websites; PGP encrypts message content.
End-to-End Encryption
Only sender and recipient can read content; intermediaries cannot. PGP and Signal-style messengers provide E2EE; HTTPS protects only to the server unless additional E2EE is used.
Escrow
A hold on payment until a condition is met. On a market it usually means the platform — not a court — can release or seize the coins.
Exit Node
For ordinary internet destinations, the exit node is the last Tor relay. It sees the destination address and unencrypted traffic, but does not directly know the user's IP. HTTPS therefore remains essential. Onion services have no exit node.
Exit Policy
The exit policy defines which destinations an exit relay allows. Operators can restrict ports and IP ranges — for example web only (80/443), or everything. Clients pick exits according to the destination they need.
Exit Scam
An operator shuts down a service and disappears with user funds or data after building trust. Common in unregulated markets — unrelated to Tor exit nodes.
F
Finalize Early
FE: the buyer releases escrow before delivery is confirmed. After FE, a missing parcel is a reputation fight, not a held balance.
Fingerprinting
Browser fingerprinting identifies devices through a combination of screen, fonts, APIs, and behavior. Tor Browser unifies many of these traits so users are less distinguishable.
G
GetTor
Tor Project service that delivers Tor Browser download links via email or messenger when torproject.org is blocked.
Guard Node
The guard node is the first relay of a Tor circuit. It sees the user's IP address, but on encrypted connections not the actual destination. Tor keeps guards for a longer period so a user does not constantly meet new, potentially malicious entry nodes. Selection is automatic by the client.
H
Honeypot
A service run to watch users rather than to serve them — for intelligence, research, or a sting. Hard to prove from a directory row.
Hydra
A Russian-language darknet market (2015–2022) that at its peak handled the majority of darknet cryptocurrency revenue. German police seized its servers and 543 bitcoins in April 2022.
I
Introduction Point
A Tor relay chosen by a hidden service where clients begin the onion connection handshake before moving to a rendezvous point.
K
KYC
Know Your Customer: identity checks an exchange requires before it moves money. A KYC account ties coins to a legal name even when the chain itself is only pseudonymous.
M
Meek
A pluggable transport that tunnels Tor traffic through allowed CDN or cloud front domains, useful when direct Tor connections are blocked.
Metadata
Data about data — who communicated, when, file author fields, message size. Often more revealing than message content and not always protected by encryption alone.
Middle Node
The middle node (middle relay) is the second hop in a Tor circuit. It knows only the guard and the exit — not the client IP and not the final destination.
Mixer
A service that pools coins from many users and pays out from the pool, aiming to break a simple Bitcoin graph. Also called a tumbler.
Monero
Privacy-oriented cryptocurrency using ring signatures and stealth addresses to obscure transaction graphs — preferred over Bitcoin where payment privacy matters.
Multisig
Cryptocurrency wallets requiring multiple keys to authorize a spend — reducing single-point theft in escrow arrangements.
N
New Identity
A Tor Browser control that closes every tab, clears cookies and history, and builds new circuits. It cannot unsay what was already sent.
Nyx
Nyx is a terminal monitor for Tor relays. Relay operators use it to watch bandwidth, connections, and the state of their node live. It replaces the older arm Tor tool.
O
obfs4
obfs4 is a pluggable transport that makes Tor traffic look like random bytes. The default choice when address blocks plus simple protocol detection are in play.
Onion Address
The human-readable hostname of an onion service (v3: 56 characters ending in .onion). It encodes the service public key.
Onion Routing
A method in which data is encrypted multiple times and passed through several relays. Each relay removes only its own encryption layer and therefore knows only the previous and the next hop. Tor implements this with typically three relays. It protects the transport path, but does not replace end-to-end encryption to the destination.
Onion Service v2
The retired onion-address format: 16 characters ending in .onion. Tor removed v2 from the network in 2021. A short onion string now is a dead protocol, not a current service.
Onion Service v3
An onion service is reachable directly inside the Tor network and has a cryptographically derived address ending in .onion. Version 3 uses modern keys and longer addresses. Client and service each build separate paths to a rendezvous point, so neither side needs to know the other's network address. Addresses should come only from verified primary sources.
OnionShare
Open-source tool to host temporary onion services for file sharing directly from the user's computer without a central upload server.
OPSEC
Operational security is the systematic check of which actions could leak sensitive information. That includes metadata, timing patterns, account separation, and the device in use. Good OPSEC starts with a realistic threat model. A single tool such as Tor cannot make up for organizational mistakes.
Orbot
A proxy for other Android apps. Tor Browser for Android is the official browser; Orbot is not that browser.
P
PGP
Pretty Good Privacy — asymmetric encryption for email and files. Public keys encrypt; private keys decrypt and sign.
Phishing
Fraud that mimics trusted sites or messages to steal credentials, seeds, or deliver malware — equally common on clearnet and Tor.
Pluggable Transport
Pluggable transports change the outward appearance of Tor connections to make blocking harder. obfs4 makes traffic look random, Snowflake uses volunteer WebRTC proxies, and meek disguises connections through allowed web infrastructure. The right method depends on local censorship. It does not change the underlying Tor circuit.
R
Relay
A relay is a Tor node that forwards traffic for others. Relays can be guard, middle, or exit — depending on configuration and flags. Each operator runs their relay independently; the Tor network has no central operator structure.
Rendezvous Point
A Tor relay where client and hidden service circuits meet for onion service connections without revealing either party's network location to the other.
S
SecureDrop
SecureDrop is an open-source platform that lets whistleblowers communicate confidentially with news organizations. It uses onion services, separated workflows, and hardened systems. Security comes from technology and careful editorial process together. Users should only use the address officially published by the newsroom in question.
Security Level
A Tor Browser preset — Standard, Safer, or Safest — that disables classes of page features. It is not a second network.
Snowflake
Snowflake is a pluggable transport: volunteers provide short-lived WebRTC proxies through which Tor clients reach a bridge. There is almost no stable address to block.
Social Engineering
Manipulating people into revealing secrets or taking unsafe actions — fake support, urgency, impersonation. Works regardless of encryption.
SOCKS5
SOCKS5 is the proxy protocol Tor Browser uses to send application traffic through Tor. Tor Browser binds SOCKS5 on localhost:9150 (default).
Stem
Stem is the official Python library for talking to the Tor Control Port. Developers and relay operators use it for automation, monitoring, and research.
T
Tails
The Amnesic Incognito Live System — a live OS booted from USB that routes all connections through Tor and minimizes persistent local traces.
Takedown
A coordinated law-enforcement action that seizes a service's servers, domain, or infrastructure — usually ending with a seizure banner and a press release. The opposite ending is an exit scam, where operators vanish on their own.
Threat Model
A structured answer to who your adversary is, what assets you protect, and what failure looks like — the foundation of OPSEC and tool choice.
Timing Attack
Linking events by correlating when packets enter and leave a network — a class of traffic analysis against anonymity systems.
Tor Browser
The official browser from the Tor Project. It routes page traffic through Tor and unifies many browser traits so users are less distinguishable. Extra add-ons break that shared fingerprint.
Tor2web
Tor2web is a service that makes .onion addresses reachable via ordinary HTTP URLs on the clearnet. It forwards requests through an exit into the Tor network. The Tor Project warns: Tor2web breaks the visitor's anonymity.
Traffic Analysis
Inferring relationships from packet timing, volume, and direction even when content is encrypted.
V
Vendor
A seller account on a market. Reputation is a local score, not a government license, and it can be impersonated after a migration.
Vendor Bond
A sum a market locks from a seller before that account can list. It is a deposit the platform holds, not proof the seller will deliver.
VPN
Virtual Private Network — tunnels traffic to a provider who sees your connection and often destinations. Trust shifts from ISP to VPN operator.
W
Warrant Canary
A periodic signed statement that no secret government order has been received. Missing updates may indicate a gag order — interpret with caution.
WebRTC
A browser protocol for direct peer connections. Snowflake uses short-lived WebRTC proxies so a Tor client can reach a bridge when direct entry points are blocked.
Whonix
Whonix splits Tor use across a gateway VM and a workstation VM so applications cannot bypass Tor as easily.