Onion Tor Sites

Onion Tor Sites: Key Terms Explained

Tor is a privacy-focused network that enables users to browse the internet anonymously. It achieves this through a process called onion routing, which encrypts data in layers, resembling the layers of an onion. Users access this network via the Tor Browser, designed to protect anonymity while browsing.

Onion services are unique to the Tor network and operate under ".onion" addresses. A current v3 onion address consists of 56 characters followed by ".onion" and cannot be registered through traditional DNS registrars^[1][2]. This means that these addresses serve as cryptographic identities rather than conventional web domains. Unlike the clearnet, which refers to the regular, publicly accessible internet, the dark web is a small segment of the deep web that specifically requires specialized software like Tor to access^[5]. It is crucial to understand that the dark web is not inherently illegal; it hosts various legitimate services alongside illicit ones^[6].

When using the Tor network, data is relayed through multiple servers called relays, which help anonymise the user's location and online activities. However, this anonymity can be compromised if users reveal personal information, such as their real name or email address^[7]. It's also important to note that while Tor protects user identities, it does not guarantee complete security against all forms of surveillance, especially if an observer monitors both the user and the destination simultaneously^[8].

In summary, understanding these key terms — Tor, onion services, .onion addresses, dark web, deep web, and onion routing — equips users with the foundational knowledge necessary to navigate onion Tor sites effectively.

Useful Onion Sites at a Glance

We compiled a reference table of legitimate onion services, categorised by their purpose. Each entry includes the service name, category, official clearnet verification source, onion address version, access requirements, and the verification date.

This table includes services that are officially verified and accessible only through the Tor network. To access these onion sites, users must have Tor Browser installed, as regular browsers cannot connect to .onion addresses. Always verify the onion address through the service’s official clearnet page or a trusted directory before visiting to ensure security and legitimacy^[4].

Onion Sites by Category

News and Publishing

ProPublica provides investigative journalism and news coverage on various topics, including government accountability and corruption. It is useful for individuals seeking reliable news sources that uphold journalistic integrity. Accessing this site requires Tor Browser, and no registration is necessary.

The BBC offers a range of news services, including international news and analysis. Users can access the BBC's onion site for an uncensored version of its offerings, ideal for users in regions where media is restricted. Registration is not required, and it operates solely through Tor Browser.

Search and Discovery

DuckDuckGo is a privacy-focused search engine that does not track users or store personal information. It is particularly useful for those looking for search options that respect privacy. Users need to access it via Tor Browser, and no registration is necessary.

Ahmia helps users discover hidden onion sites and provides a search interface specifically for .onion addresses. It is beneficial for users wanting to explore various onion services without needing to memorise addresses. Tor Browser is required, and registration is not needed.

Privacy Tools

The Tor Project offers essential tools and information for users aiming to enhance their online privacy. It is particularly useful for anyone interested in understanding how to use Tor effectively and safely. Users can access resources without registration, but they must use Tor Browser.

OnionShare allows users to share files securely and anonymously. It is ideal for those needing to send sensitive files without exposing their identity. This service requires Tor Browser and does not involve registration.

Whistleblowing

SecureDrop is a platform designed for secure communication between journalists and whistleblowers. It is essential for anyone needing to submit sensitive information safely. Users must access it via Tor Browser, and while registration is not required, users should verify the onion address through trusted directories.

Email and Communication

Riseup provides secure email and communication tools for activists and privacy-conscious individuals. This service is useful for those who require confidential communication channels. Users need Tor Browser to access it, and registration is necessary to create an account.

Technical Resources

Various technical resources are available through onion services, including forums and documentation on Tor's functionality. These resources are beneficial for users wanting to understand the technical aspects of the Tor network. Accessing these sites requires Tor Browser, and registration requirements vary depending on the specific service.

Each of these onion sites offers unique services that contribute to privacy and information access. Users should ensure they have Tor Browser installed and verify any onion addresses through official sources to maintain security.

How to Verify an Onion Link Before Opening It

Verifying an onion link is crucial to ensure your safety and privacy when navigating the dark web. We recommend following this checklist to confirm the legitimacy of an onion address before accessing it:

1. Obtain the Address from the Official Clearnet Website: Always source the onion address from the official website of the organisation. This reduces the risk of encountering malicious links that could compromise your security.

2. Compare All 56 Characters: A current v3 onion address consists of 56 alphanumeric characters followed by ".onion"^[2]. Ensure that every character matches exactly with what is listed on the official website to avoid phishing attempts.

3. Check Signed Announcements: If available, look for signed announcements from the organisation regarding their onion address. This is a reliable way to confirm that the address is authentic.

4. Avoid Links from Forums or URL Shorteners: Links copied from forums or shortened URLs can often lead to malicious sites. Always type the onion address directly or use trusted sources for verification.

Phishing through look-alike onion addresses is a common tactic used by malicious actors. For example, if a user encounters an address like "secure-drop.onion" instead of the legitimate "securedrop.org", they might inadvertently provide sensitive information to a fraudulent site. This highlights the importance of careful verification.

It's also essential to distinguish between official mirrors and third-party proxies or directory listings. An official mirror is a legitimate duplicate of a service's onion site, while a third-party proxy may not have the same level of security or authenticity. Always verify the source to ensure you are accessing an official service rather than a potentially harmful proxy.

How to Access Onion Sites Safely

Accessing onion sites requires the use of the Tor Browser, as standard browsers cannot resolve .onion addresses. This specialised browser is designed to protect user anonymity while navigating the dark web. It's essential to follow best practices to ensure a safe experience when exploring these unique online spaces.

We recommend adhering to the following safety checklist:

1. Keep Your Tor Browser Updated: Always use the latest version of Tor Browser to benefit from the latest security enhancements and bug fixes. The Tor Project frequently releases updates to address vulnerabilities.

2. Avoid Downloading Files: Downloading files from onion sites can expose your real IP address if the files are opened outside the Tor environment. Be cautious with any downloads, as they may contain malware or other security threats.

3. Do Not Share Personal Information: Entering personal details such as your real name, email address, or phone number can compromise your anonymity and expose your identity, even if you are using Tor^[7].

4. Disable Scripts and Plugins: Ensure that scripts and browser plugins are disabled in the Tor Browser. These can create vulnerabilities that may lead to information leakage or deanonymization^[3].

5. Avoid Account Reuse: If you create accounts on onion sites, do not reuse credentials from your clearnet accounts. This practice can lead to cross-site tracking and potential exposure of your identity.

6. Be Wary of External Applications: Tor protects only the applications configured to use it. Opening documents or files that connect to the clearnet may reveal your non-Tor IP address^[7].

7. Steer Clear of Tor-to-Web Proxies: Using proxies that claim to connect Tor users to the clearnet can compromise your privacy and alter the trust model inherent in the Tor network. Always access onion sites directly through Tor Browser^[3].

8. Verify Onion Addresses: Always check the onion address against the official clearnet page of the service you wish to visit. This step helps to ensure that you are accessing the legitimate site and not a phishing attempt^[4].

By following these guidelines, we can significantly enhance our safety while accessing the myriad of services available on the dark web.

Privacy Limits, Tracking, and Common Threats

Tor provides a layer of anonymity by masking users' IP addresses, but it is crucial to understand its limitations. While Tor successfully hides your IP address from the websites you visit, it does not prevent browser fingerprinting, which can identify users based on their unique browser configurations and settings. This means that even while using Tor, your browser might still be tracked if you do not take precautions to mitigate fingerprinting risks^[7].

Another significant threat comes from malware and login-based identification. If a user logs into an onion service with identifiable information—like an email or real name—they compromise their anonymity, as the site can link that information back to the user, regardless of Tor's protections^[7]. Additionally, users must be cautious of traffic correlation attacks, where an observer can potentially match traffic entering and exiting the Tor network to identify users. This is especially pertinent in scenarios where an adversary can observe both ends of the connection, such as a malicious Tor exit node^[8].

Onion services differ from regular websites because they do not rely on traditional exit nodes; their traffic remains within the Tor network, enhancing privacy^[1]. However, this does not equate to perfect anonymity. For instance, the FBI's investigation into the Playpen case highlighted that operational mistakes can lead to deanonymization. The administrator of the site accidentally revealed their real IP address, illustrating that user error can significantly undermine privacy efforts^[9].

To enhance your privacy while using Tor, avoid common pitfalls such as downloading files from untrusted onion sites or using external applications that may leak your real IP address^[7]. Always remember that anonymity is not guaranteed; it is contingent on user behaviour and the precautions taken while navigating the dark web.

Are Onion Sites Legal?

The legality of using onion sites is not straightforward, as it varies significantly depending on jurisdiction. While the Tor network itself is legal in many countries, the legality of specific content and actions accessed through onion services can differ. For instance, the U.S. Department of Justice has stated that while Tor is not illegal, activities conducted through it are subject to the same laws as those performed elsewhere^[6]. This means that engaging in unlawful conduct while using Tor does not provide legal immunity.

Onion sites can serve various legitimate purposes. For example, censorship-resistant journalism is essential in regions where press freedom is restricted. Journalists can use onion services to publish articles and share information without fear of government censorship. Whistleblowing is another critical use case, as individuals can report misconduct or corruption anonymously, protecting their identity while exposing wrongdoing. Privacy research also benefits from onion sites, as researchers can study online behaviour without revealing their identities. Additionally, accessing blocked information is a significant reason users turn to onion services, enabling them to bypass government-imposed restrictions on internet content.

It is crucial to remember that while onion sites can facilitate legal activities, they are also associated with illegal content and behaviours. Therefore, users should always be cautious and ensure that their actions comply with local laws. Anonymity technologies like Tor do not make unlawful conduct legal; they merely provide a layer of privacy that can be exploited for both legitimate and illegitimate purposes.

Why Onion Links Stop Working

There are several common reasons why onion links may stop functioning, and understanding these can help users navigate the dark web more effectively. One primary cause is address rotation, where onion services periodically change their addresses for security purposes. This means the old address will no longer work, and users must find the new one.

Another issue is service downtime. An onion service may be temporarily offline due to maintenance, server issues, or network overload. The Tor network itself can also experience congestion, leading to circuit-creation timeouts that prevent users from connecting to the desired service^[2]. Additionally, if a service operator decides to shut down their operation, the associated onion link will become invalid.

Denial-of-service attacks can also affect onion services. These attacks aim to overwhelm a server with traffic, rendering it inaccessible to legitimate users. Similarly, phishing takedowns may occur when malicious actors impersonate legitimate onion services, prompting the original operators to shut down their links to protect users^[2].

A notable technical change occurred with the transition from v2 to v3 onion addresses. Legacy v2 addresses consist of only 16 characters, while current v3 addresses have 56 characters^[2]. This makes it easier to identify outdated links, as they can no longer be accessed after the Tor Browser version 0.4.6.8 was introduced in 2021^[10].

To recover from a broken onion link, we recommend returning to the service's official clearnet page. This approach is safer than trying random mirrors, which may lead to malicious sites. Users can cross-check the onion address against the official site or reputable directories to ensure they are accessing the correct service^[4]. By following these steps, we can reduce the risk of encountering non-functional or fraudulent onion links.

Common Mistakes and Misconceptions

Treating Every Directory Entry as Current

Directories often retain addresses after services move, close, or replace a mirror, while many listings omit both the original confirmation source and review date. We advise treating an entry as a lead, then checking where the address was published and when the listing was last reviewed; an undated entry should not be considered current.

Confusing the Deep Web with the Dark Web

Beginners often use these terms interchangeably because both describe content that ordinary search engines may not index. The deep web includes routine private content, while the dark web is a smaller portion requiring specialised software such as Tor^[5]. We use "onion service" for a service reached through Tor and reserve "dark web" for the broader network category.

Treating a .onion Name Like a Normal Domain

A .onion address cannot be registered through an ordinary domain registrar or resolved through standard DNS. Its name is derived from cryptographic keys and acts as the service’s identity, so familiar-looking words do not establish ownership or legitimacy^[1]. We advise judging provenance rather than how professional or memorable the address appears.

Assuming Any Connection Error Means the Site Has Closed

Users may immediately search for replacement mirrors when a page fails once, which can expose them to unverified copies. Tor Browser distinguishes several possible causes, including an offline service, network overload, missing credentials, an invalid address, and circuit-creation timeouts^[2]. We recommend reading the specific error first and retrying later when it indicates a temporary network or service problem.

Using a Regular Browser Configured to Use Tor

Routing an ordinary browser through a Tor proxy may appear equivalent because pages can load, but the browser lacks Tor Browser’s privacy-focused modifications. The Tor Project strongly discourages this arrangement because it can create information leakage and deanonymisation risks^[3]. We advise using Tor Browser for onion services rather than modifying Chrome, Firefox, or another everyday browser.

Ignoring Tor Browser’s Official Onion Prompt

Some users copy an address from a directory even when the organisation’s regular website offers a direct confirmation route. Tor Browser recognises the Onion-Location header and displays a ".onion available" prompt when a website officially advertises its onion counterpart^[2]. We recommend preferring that advertised destination when available, while still checking that the clearnet page belongs to the intended organisation.

Conclusions

• We recommend starting with a defined purpose, such as reaching an official newsroom, privacy resource, or censorship-resistant publication.
• Confirm every destination through the organisation’s public website; Tor Browser can identify officially advertised alternatives through the Onion-Location header^[2].
• Use Tor Browser rather than sending an everyday browser through a Tor proxy, which can introduce information leakage and deanonymisation risks^[3].
• Treat directories as discovery tools, not proof of authenticity, and avoid replacement mirrors unless their provenance can be confirmed.
• When a page fails, check the displayed error and retry later before assuming the service has permanently disappeared^[2].

Next, review our Tor Link Onion guide to organise your link-checking process.