Onion Link: What It Is and How to Use It

What is an Onion Link and How Does it Work?

An onion link is the address for an onion service—a service accessible exclusively via the Tor network¹. These links use the special '.onion' domain, which is not resolvable by standard DNS infrastructure². To access an onion service, you need the Tor Browser and the 56-character address³.

The Cryptographic Foundation

Current onion addresses consist of 56 base32-encoded characters followed by '.onion', a format introduced with Tor v3². The cryptography involved allows Tor to verify that it is connecting to the correct location and that the connection is not being tampered with³. This address is derived from the service's public key, meaning the operator cannot fake or spoof it. Older v2 addresses, which used 16 characters, were deprecated in October 2021 and are no longer accessible².

How Onion Routing Provides Anonymity

When you connect to an onion service, the complete circuit consists of six relays: three chosen by your client (with the third acting as a rendezvous point) and three chosen by the service itself⁴. This architecture hides both your location and the service's location from each other and from anyone monitoring the network. The service operator does not learn your IP address, and you do not learn theirs—both parties remain anonymous by design.

Onion Services Are Not Inherently Malicious

The '.onion' domain itself is neutral technology. Onion services let people browse and publish content anonymously through Tor, providing more private ways to host websites, share files, and communicate⁵. Legitimate organisations use onion services: Facebook operates one to offer secure access in regions with restricted internet. When you visit a site that has an onion version available, Tor Browser displays a purple pill at the URL bar with '.onion available'³. Some onion services require authentication tokens before granting access, indicated by a grey key icon in the URL bar³.

For context on the broader ecosystem, see What is the Dark Web? A Comprehensive Overview.

Accessing Onion Links: A Step-by-Step Guide

You cannot access .onion links through Chrome, Firefox, or any standard browser—they require the Tor Browser². Attempting to visit an onion service without Tor can link the service to your personal internet connection, potentially compromising your anonymity and the security of the service⁶. We walk through the prerequisites and the exact process below.

Download and Install the Official Tor Browser

Visit the Tor Project's official website to download Tor Browser for your operating system. Do not download Tor Browser from third-party mirrors or app stores, as modified versions may contain malware or backdoors. The official installer is available for Windows, macOS, Linux, and Android. After downloading, verify the signature if you have the technical capability—this step confirms the file has not been tampered with.

Install the browser by following the on-screen prompts. On first launch, Tor Browser will ask whether you want to connect directly to Tor or configure proxy settings. Most users in the UK can select 'Connect' immediately. If you are in a region that blocks Tor, choose 'Configure' to enable a bridge relay.

For a broader comparison of tools, see Best Dark Web Browser: A Comparison.

Entering an Onion Link

Once Tor Browser is running and connected, paste or type the full 56-character .onion address into the URL bar, followed by '.onion'³. Press Enter. The browser will route your request through the Tor network, establishing a six-relay circuit to reach the service⁴. Expect a delay of several seconds—onion services load more slowly than clearnet sites due to the multi-hop routing.

If the address is correct and the service is online, the page will load. If you see a connection error, the service may be offline, the address may be incorrect, or the service may require authentication³. Tor Browser will display a grey key icon in the URL bar if the service expects an authentication token.

What to Expect During the Connection

The URL bar will show a purple onion icon when you are connected to an onion service. Some sites that operate both clearnet and onion versions will trigger a purple pill notification reading '.onion available'³. Clicking this pill switches you to the onion version, which provides end-to-end encryption and hides your IP address from the site operator³.

Do not expect HTTPS indicators in the traditional sense—onion services use cryptographic addressing to guarantee authenticity³. However, Tor Browser can leak 'secure' cookies issued over HTTPS into cleartext HTTP channels in certain backend deployments, a risk not visible to you as the end-user⁷. This underscores the importance of treating all onion browsing as potentially observable at the service's backend.

Understanding the Risks Associated with Onion Links

The unregulated nature of the dark web means that clicking on arbitrary onion links exposes you to dangers that are less common on the clearnet. Malicious cyber actors use Tor to mask their identity when engaging in activities such as reconnaissance, penetrating systems, exfiltrating and manipulating data, and taking services offline through denial-of-service attacks and ransomware payloads⁸. Organisations that do not block or monitor Tor traffic are at heightened risk of being targeted and exploited by threat actors hiding their identity and intentions using Tor⁸. The same anonymity that protects legitimate users also shields criminals, scammers, and hostile operators.

Malware and Phishing Attempts

Onion sites can host malware disguised as legitimate downloads, tools, or updates. Because there is no central authority vetting .onion addresses, a site that appears to offer a privacy tool or leaked dataset may instead deliver ransomware or keyloggers. Phishing attempts are common: fake marketplaces, cloned login pages, and fraudulent escrow services mimic trusted onion services to steal credentials or cryptocurrency. You have no visual cues—such as a verified domain name or a certificate authority—to confirm authenticity. The cryptographic addressing guarantees you are reaching the service at that specific address³, but it does not guarantee the service itself is honest or safe.

Scams and Financial Fraud

Many onion services operate without accountability. Marketplaces may take payment and never deliver goods; escrow services may disappear with funds; and investment schemes often turn out to be exit scams. The lack of legal recourse means that once you transfer cryptocurrency to a fraudulent onion service, recovery is effectively impossible. Even if a service has operated reliably in the past, there is no mechanism to prevent the operator from shutting down and vanishing overnight.

Exposure to Illegal and Disturbing Content

Onion links can lead to sites hosting illegal material, including child exploitation imagery, graphic violence, and other content that may be unlawful to view or possess in the UK. Stumbling upon such material—even unintentionally—can have legal consequences and psychological impact. Directories and search engines for onion services do not filter content comprehensively, and many links circulate without context or warnings.

The Absence of HTTPS and Its Implications

Many onion services do not implement HTTPS, relying instead on the cryptographic guarantees of the .onion address itself³. While this prevents tampering with the connection between you and the service, it does not protect data in transit within the service's backend. Tor Browser can leak 'secure' cookies issued over HTTPS into cleartext HTTP channels in certain backend deployments, a risk not visible to you⁷. This means that even when you believe your session is encrypted, backend infrastructure may observe or log your activity. Treat all onion browsing as potentially observable by the service operator and any intermediaries they use.

For broader context on the legal landscape, see Is the Dark Web Illegal? Myths and Facts Explained.

Best Practices for Safe Onion Link Exploration

Minimising risk when browsing onion services requires deliberate choices about your setup, behaviour, and expectations. The anonymity Tor provides does not protect you from malware, scams, or your own mistakes—it only hides your location and identity from the service operator and network observers. We outline actionable steps to reduce exposure below.

Use a VPN in Conjunction with Tor—But Understand the Trade-offs

Running a VPN before connecting to Tor hides the fact that you are using Tor from your internet service provider and any local network observer. Your ISP will see encrypted VPN traffic instead of Tor entry node connections. This setup does not make you 'more anonymous' to the onion service itself—the service still cannot see your real IP address, because Tor's six-relay circuit already provides that protection⁴. A VPN adds a layer between you and the Tor network, which can be useful if you are concerned about being flagged for using Tor in the first place. However, you are now trusting the VPN provider not to log your activity or cooperate with authorities. Choose a provider with a documented no-logs policy and jurisdiction outside the UK if this is a concern for you.

Avoid Downloads from Untrusted Sources

Do not download files from onion services unless you have a specific, verified reason to trust the source. Malware disguised as documents, software, or media is common⁸. If you must download a file, open it only in an isolated environment—such as a virtual machine with no network access and no shared folders with your host system. A virtual machine lets you inspect the file's behaviour without risking your main operating system. After inspection, discard the virtual machine snapshot if anything appears suspicious. Do not run executables directly on your host machine, and do not open archives or documents in applications that execute macros or scripts by default.

Never Share Personal Information

Onion services are designed to keep both parties anonymous⁴. Sharing your real name, email address, phone number, payment card details, or any other identifying information defeats this purpose and exposes you to doxing, blackmail, or fraud. Use pseudonyms, disposable email addresses, and cryptocurrency for any transactions. Even metadata—such as timestamps in documents you upload or geolocation data in photos—can reveal your identity. Strip metadata from files before sharing them, and assume that any information you provide can be linked back to you if the service operator is compromised or malicious.

Be Wary of Suspicious Links and Phishing

Onion addresses are long, random-looking strings of 56 characters². Scammers create fake versions of legitimate onion services by changing one or two characters in the address, hoping you will not notice. Always verify the full address against a trusted source—such as the official clearnet site of the service or a verified directory. Do not click on onion links shared in forums, chat rooms, or unsolicited messages without independent confirmation. Phishing pages mimic login screens and payment forms to steal credentials and cryptocurrency. If a site asks for sensitive information, double-check the address and consider whether the request is consistent with the service's documented behaviour.

Keep Tor Browser Updated

The Tor Project releases updates to address security vulnerabilities, improve performance, and adapt to changes in the Tor network. An outdated Tor Browser may be vulnerable to exploits that allow an attacker to de-anonymise you or compromise your system. Tor Browser checks for updates automatically when you launch it, but you should manually verify that you are running the latest version by visiting the Tor Project's official site. Do not ignore update prompts, and do not download updates from third-party sources.

Use a Dedicated, Isolated Environment for Dark Web Activities

Consider running Tor Browser inside a virtual machine or on a separate device that you use exclusively for onion browsing. This isolation limits the damage if you encounter malware or if your session is compromised. A virtual machine can be reset to a clean snapshot after each session, removing any traces of your activity and any malicious software that may have been installed. If you use a dedicated device, do not log into personal accounts or access clearnet services that can be linked to your real identity. The goal is to compartmentalise your dark web activity so that it cannot be correlated with your everyday online behaviour.

Expect Slow Connections and Plan Accordingly

Tor's routing can be slow—your connection passes through six relays when accessing an onion service⁴, and each hop introduces latency. Pages may take several seconds to load, and timeouts are common. This slowness is not a bug; it is the cost of anonymity. Do not interpret a slow connection as a sign that the service is malicious or that your anonymity is compromised. However, if a page fails to load repeatedly, the service may be offline or overloaded. Patience is required, and you should avoid refreshing pages aggressively, as this can make the connection less stable.

Understand That Many Onion Sites Lack Traditional HTTPS

Many onion services do not implement HTTPS, relying instead on the cryptographic guarantees of the .onion address itself³. The address is derived from the service's public key, so Tor can verify that the connection is authentic and has not been tampered with. However, this does not protect data in transit within the service's backend. Tor Browser can leak 'secure' cookies issued over HTTPS into cleartext HTTP channels in certain backend deployments, a risk not visible to you⁷. This means that even when you believe your session is encrypted, backend infrastructure may observe or log your activity. Treat all onion browsing as potentially observable by the service operator and any intermediaries they use. Do not assume that the absence of a padlock icon means the connection is insecure in the traditional sense—but do assume that the service itself may log or mishandle your data.

Finding Reliable Onion Links and Directories

Discovering legitimate onion services is harder than browsing the clearnet. Traditional search engines—Google, Bing, DuckDuckGo's standard interface—do not index .onion addresses, because the domain name system does not resolve them². You cannot stumble upon an onion service through a web search in the way you would find a normal website. Instead, you need to know the 56-character address in advance³, or rely on curated directories and specialised search engines that catalogue onion links. This introduces a trust problem: how do you know a directory or search engine is honest, current, and free of malicious links?

The Role of Curated Directories

Directories such as OnionLinks, The Hidden Wiki, and similar resources compile lists of onion services organised by category—markets, forums, news sites, privacy tools. These directories are themselves onion services or clearnet sites that link to .onion addresses. The quality and trustworthiness of these directories vary widely. Some are maintained by volunteers who vet links and remove scams; others are abandoned, outdated, or seeded with phishing sites. A directory that was reliable six months ago may now be compromised or neglected. When you use a directory, check the date of the last update, look for community feedback on forums or Reddit, and verify any address you intend to visit against multiple independent sources. Do not assume that a link's presence in a directory means the service is safe—only that someone added it at some point.

Dark Web Search Engines

Specialised search engines attempt to index onion services and make them discoverable. Ahmia, Torch, and DuckDuckGo's onion service (accessible via Tor) are the most commonly cited examples. Ahmia filters out illegal content from its index and operates both a clearnet interface and an onion service. Torch claims to index a larger number of onion sites but does not filter content, so search results may include illegal or dangerous material. DuckDuckGo's onion service provides privacy-focused search within the Tor network but does not index onion sites comprehensively—it primarily searches clearnet content over Tor. None of these search engines offer the breadth or accuracy of Google on the clearnet. Expect incomplete results, dead links, and a significant proportion of scam or phishing sites in the results.

How to Evaluate Trustworthiness

Before visiting an onion link from a directory or search result, cross-reference the address. If the service has an official clearnet presence—such as a news organisation or privacy tool—check their website for the canonical .onion address. Tor Browser will display a purple 'onion available' pill in the URL bar if a clearnet site advertises an onion service via the Onion-Location HTTP header³. This is the most reliable way to confirm an address. For services without a clearnet presence, look for mentions on trusted forums, verify the address in multiple directories, and search for reports of scams or compromises. Treat any onion link shared in an unsolicited message, forum post, or unverified directory with suspicion. If the address differs by even one character from a known legitimate service, assume it is a phishing attempt.

Authenticated onion services—those that require a client-side authentication token—display a small grey key icon in Tor Browser's URL bar³. This indicates the service has implemented access control, which can be a sign of a more serious operation, but it does not guarantee legitimacy. Scammers can also use authentication to create an illusion of exclusivity or security.

For a broader understanding of how Tor and onion services fit into the wider ecosystem, see What is the Dark Web? A Comprehensive Overview.

Distinguishing Legitimate Onion Services from Malicious Ones

Even when you have an onion address from a directory or search engine, you cannot assume the service is legitimate or safe. Scammers clone popular markets, forums, and tools, changing one or two characters in the address to trick you into entering credentials or sending cryptocurrency to the wrong recipient. Malicious operators set up honeypots—fake services designed to harvest data or infect visitors with malware⁸. Legitimate onion services can also host risky or illegal content, and visiting them does not guarantee your safety. We recommend a systematic approach to assess each site before you interact with it.

Verify the Full Address Against Multiple Sources

Onion addresses consist of 56 random-looking characters², and a single-character difference can lead you to a phishing clone. Before you visit a service, cross-reference the address in at least two independent sources—such as the official clearnet site of the organisation, a verified directory entry, and community discussions on trusted forums. If the service advertises an onion address via the Onion-Location header, Tor Browser will display a purple '.onion available' pill in the URL bar when you visit the clearnet version³. This is the most reliable confirmation. Do not rely on a single directory or search result, and do not click links shared in unsolicited messages or unverified forum posts.

Check for a Clear, Consistent Purpose

Legitimate onion services typically present a clear purpose and consistent content. A news site will display articles with recognisable branding and layout; a privacy tool will document its features and usage. If a site's purpose is vague, if the content is disorganised or filled with broken links, or if the design mimics a well-known service but with subtle differences, treat it as suspicious. Scam sites often copy the appearance of legitimate services but fail to replicate the depth and consistency of real content. Look for an 'about' page, contact information, and documentation. If these are missing or generic, the site may be a hastily constructed phishing page.

Assess the Site's Behaviour on First Visit

When you first load an onion service, note whether it immediately prompts you for login credentials, payment information, or downloads. Legitimate services usually present informational content or a landing page before asking for sensitive actions. Aggressive pop-ups, unsolicited download prompts, or requests for personal information without context are red flags. Do not enter credentials or payment details until you have independently verified the address and assessed the site's content. If the site asks you to disable Tor Browser's security settings or to install additional software, leave immediately—this is almost always a sign of a malicious operator.

Look for Community Reputation and Recent Activity

If the service is a market, forum, or tool with a user base, search for community feedback. Check forums such as Dread (an onion-based Reddit alternative) or clearnet discussions on Reddit and security blogs for mentions of the service. Look for recent posts—community opinion from two years ago may no longer be relevant if the service has changed hands or been compromised. Absence of any community discussion can indicate a new or obscure service, which carries higher risk. Conversely, widespread reports of scams, exit scams, or law enforcement seizures are clear warnings to avoid the site.

Understand That Legitimacy Does Not Equal Safety

A service may be 'legitimate' in the sense that it is operated by the entity it claims to represent, yet still host illegal, harmful, or privacy-invasive content. News sites and whistleblowing platforms are generally safe to browse, but markets, forums, and file-sharing services may expose you to illegal material, malware, or law enforcement monitoring⁸. Even if a service is widely used and recommended, your visit can still carry legal and security risks. Treat every onion service as potentially hostile, verify addresses rigorously, and limit your interactions to what is necessary for your purpose.

Common Mistakes and Misconceptions

Believing All .onion Links are Anonymous

Many users assume that simply using a .onion link guarantees complete anonymity. While Tor provides strong anonymity for the client by routing traffic through multiple relays and encrypting it at each step⁴, the onion service itself can be compromised or operated by malicious actors⁸. The service operator can still log your activity, and if you perform actions that reveal your identity (e.g., entering personal information), your anonymity is compromised. We advise against assuming full anonymity solely based on using an onion link.

Confusing .onion with Standard Websites

A common mistake is treating .onion links like regular clearnet websites. Unlike standard websites that use the Domain Name System (DNS), .onion addresses are not resolvable by DNS infrastructure². This means you cannot access them directly through a regular browser or by simply typing the address into a standard search engine. You must use Tor Browser to access any .onion service⁵.

Assuming All Onion Services are Illegal

A frequent misconception is that all onion services host illegal content. While the dark web does contain illegal activities⁸, many legitimate organizations, news outlets, and privacy-focused services also operate .onion sites⁵. These services offer enhanced privacy and security for users who wish to browse or publish content without being easily tracked. For example, some popular sites offer secure Tor connections to their services⁵.

Relying on Outdated or V2 Onion Addresses

Users sometimes attempt to access old or incorrectly formatted onion addresses. Tor v2 onion addresses, which were 16 characters long, were deprecated in October 2021 and are no longer accessible². Current Tor v3 onion addresses consist of 56 base32-encoded characters². Attempting to use a v2 address or a malformed v3 address will result in a connection error. Always verify that the address is a 56-character v3 address³.

Using a VPN Incorrectly with Tor

Some users attempt to enhance security by using a VPN with Tor, but often do so incorrectly. Connecting to a VPN after Tor (Tor over VPN) can potentially expose your IP address to the VPN provider, negating some of Tor's benefits if the VPN is compromised. The recommended setup for enhanced security is VPN before Tor (VPN over Tor), where your traffic first goes to the VPN, then enters the Tor network. This hides your real IP address from the Tor entry node, but it does not protect against malicious onion service operators.

Expecting HTTPS-Level Security on All Onion Sites

Many users mistakenly believe that the cryptographic nature of .onion links provides the same security guarantees as HTTPS on the clearnet. While the .onion address itself ensures the connection to the correct service and prevents tampering³, this does not mean the service itself uses HTTPS for internal operations or that it protects data in transit within its backend. Tor Browser can leak 'secure' cookies issued over HTTPS into cleartext HTTP channels in certain backend deployments, a risk not visible to you⁷. Always assume that the service operator may log or mishandle your data, even if the .onion connection is cryptographically secure.

Key Takeaways

Navigating onion links requires a cautious and informed approach. We've covered the essentials, and here are the main points to remember:

• Verify onion addresses rigorously. Always cross-reference 56-character v3 onion addresses from multiple trusted sources, such as official clearnet sites or verified directories, to avoid phishing attempts.

• Use Tor Browser exclusively. Onion links are not accessible via standard browsers; you must use Tor Browser to connect to .onion services.

• Do not assume anonymity or legality. While Tor enhances privacy, it does not guarantee anonymity if you reveal personal information. Many legitimate services exist, but the dark web also hosts illegal content.

• Assess site legitimacy and behavior. Look for clear purpose, consistent content, and avoid sites that immediately demand credentials or downloads.

• Understand security limitations. The cryptographic nature of .onion links secures the connection to the service but does not guarantee the service itself is secure or trustworthy.

To begin exploring, we recommend installing Tor Browser and understanding its basic functions, which you can learn more about in our guide: Tor Web: Understanding the Basics.

Explore More About the Dark Web

Discover additional resources to deepen your understanding.