Onion Site: What You Need to Know

What Exactly Are Onion Sites?

An onion site is a website whose address ends in '.onion' and is reachable only through the Tor network². Unlike standard websites that use .com, .org, or country-code domains, onion addresses consist of 56 letters and numbers followed by '.onion'¹—for example, facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion. The .onion domain is a special-use top-level domain that exists solely within Tor's internal routing and cannot be accessed through regular browsers or standard DNS lookups³.

The architecture of onion services hides both the visitor's identity and the server's location. When you connect to an onion site, your traffic passes through multiple Tor relay nodes, and the site itself operates behind introduction points and rendezvous points within the Tor network [6, 7, 8, 9, 10]. Neither party sees the other's IP address; the connection is end-to-end encrypted¹, so you don't need HTTPS to secure your session. Tor Browser indicates a secure connection to an onion service with an onion icon in the URL bar¹.

Not All Onion Sites Are Illicit

Onion sites are frequently conflated with illegal marketplaces, but many serve lawful purposes. Facebook launched its onion service to let users in censored countries access the platform without revealing their location¹. Amnesty International launched its website on Tor in December 2023 to help universal access in regions where the clearnet site is blocked⁴. ProtonMail, The New York Times, and the BBC all maintain verified .onion addresses to offer privacy-conscious alternatives to their standard sites. These examples demonstrate that onion services function as tools for privacy and censorship resistance, not solely as infrastructure for the dark web's illicit segment.

If you're looking for specific onion addresses or directories, we maintain a curated resource at Onion Links Reddit: A Curated List. The cryptographic assurance built into .onion addresses means you connect to the right location without tampering¹, but you still need to verify addresses through multiple trusted sources before visiting.

How Onion Sites Function on the Tor Network

Onion routing encrypts your data in multiple layers—like an onion—and sends it through a chain of three randomly selected Tor relay nodes before it reaches the destination⁵. Each relay decrypts one layer to learn only the next hop, never the full path. The entry node sees your real IP address but not where you're going; the middle relay sees neither; the exit node (or in the case of onion services, the rendezvous point) sees the destination but not your IP¹. This architecture prevents any single point in the network from linking your identity to your activity.

When you visit an onion site, the process differs from clearnet browsing. The onion service host prepares by choosing several Tor nodes as introduction points, building circuits to them, and instructing them to forward connection requests⁶. The host then creates hidden service descriptors listing these introduction points and uploads them to HSDir nodes within Tor⁶. When you request the .onion address, your Tor Browser retrieves the descriptor, chooses a rendezvous point, and builds a circuit to one of the introduction points [8, 9]. The introduction point forwards your rendezvous details to the host, which builds its own circuit to the rendezvous point and completes a cryptographic handshake⁶. The rendezvous point then connects the two circuits, allowing you to communicate without either party knowing the other's IP address.

Why Tor Browser Is Required

You cannot access .onion sites without Tor Browser because .onion addresses exist only within Tor's internal routing and are not part of the public DNS system³. Standard browsers like Chrome or Firefox have no mechanism to resolve .onion domains or connect to Tor's relay network. Tor Browser handles the entire onion routing process, manages circuits, and enforces security settings that prevent leaks. When you connect to an onion service, Tor Browser displays an onion icon in the URL bar to confirm the secure connection¹; clicking the icon and the adjacent Circuit Display shows you the relay path your traffic is taking.

All traffic between Tor users and onion services is end-to-end encrypted¹, so you don't need HTTPS to protect your session—the .onion protocol itself provides cryptographic assurance that you're connected to the correct service without tampering¹. Some clearnet sites advertise their onion counterpart using the Onion-Location HTTP header, which triggers a purple suggestion pill in Tor Browser prompting you to switch to the .onion version¹.

Accessing Onion Sites Securely: Best Practices for Users

Tor Browser is the only tool that can access .onion addresses [1, 4], but downloading it correctly is the first security decision you make. Visit the official Tor Project website—torproject.org—and download the version for your operating system. Do not use third-party mirrors or app stores; compromised installers can log your activity or inject malware before you even connect to Tor. After downloading, verify the cryptographic signature of the installer using the instructions on the Tor Project's download page. This step confirms the file hasn't been tampered with during transit.

Once installed, launch Tor Browser and wait for it to establish a connection to the Tor network. You'll see a confirmation screen when the circuit is built. At this point, you can paste a .onion address into the URL bar—remember, these addresses consist of 56 letters and numbers followed by '.onion'¹. Tor Browser will handle the routing through introduction points, rendezvous points, and relay nodes automatically [6, 8, 9, 10]. The onion icon in the URL bar confirms your connection is secure¹; click it to view the circuit path your traffic is taking.

Essential Security Precautions

Using Tor Browser alone does not guarantee anonymity if you compromise operational security. We advise the following practices:

• Verify .onion addresses through multiple independent sources. Phishing sites often use addresses that differ by one or two characters. Cross-check the address on trusted directories, official social media accounts, or signed messages from the service operator before visiting.

• Disable JavaScript in Tor Browser's security settings. Set the security level to 'Safest' to block scripts that can fingerprint your browser or exploit vulnerabilities. Many onion sites function without JavaScript; those that require it should be treated with heightened suspicion.

• Never enter personal information or reuse credentials. Even though your connection is encrypted¹, the site operator can log everything you submit. Use unique, randomly generated passwords and avoid linking your onion activity to your clearnet identity.

• Treat all downloads as hostile. Files from onion sites can contain malware or metadata that reveals your real IP address when opened outside Tor Browser. If you must download a file, open it in an isolated virtual machine or air-gapped system, never on your primary device.

The VPN Question

Adding a VPN before connecting to Tor is a contested practice. A VPN hides your Tor usage from your internet service provider, which can be useful in jurisdictions where Tor itself is flagged. However, the VPN provider can see your real IP address and knows you're using Tor, shifting trust from your ISP to the VPN company. If you choose this setup, select a provider with a documented no-logs policy and payment methods that don't link to your identity. Understand that this does not increase anonymity within the Tor network itself—it only changes who can observe your entry point.

For discovering onion content, standard search engines cannot index .onion addresses because they exist only within Tor's internal routing³. Instead, use specialised onion search engines or curated directories; we maintain a resource at Onion Links Reddit: A Curated List. Always verify addresses before visiting, and remember that simply browsing onion sites via Tor Browser is legal⁵—it's your actions on those sites that determine risk.

Common Misconceptions and Realities of Onion Sites

The assumption that all onion sites host illegal content is widespread but inaccurate. Facebook, Amnesty International, ProtonMail, The New York Times, and the BBC all operate verified .onion addresses to serve users in censored regions or those prioritising privacy⁴. Simply browsing onion sites through Tor Browser is perfectly legal⁵—the legality of your activity depends on what you do once you arrive, not the act of accessing the Tor network itself. The conflation of onion services with criminality stems from media coverage of darknet marketplaces, but the same infrastructure protects journalists, activists, and organisations operating under repressive regimes.

Technical Limitations You Will Encounter

Onion sites are slower and less stable than clearnet equivalents because your traffic passes through multiple relay nodes before reaching the destination [6, 8, 9, 10]. Each hop adds latency; connection speeds rarely exceed a few hundred kilobits per second, and circuits can drop unexpectedly if any relay in the chain goes offline. Sites may take 10–30 seconds to load on first visit while Tor retrieves the hidden service descriptor from HSDir nodes [7, 8] and establishes the rendezvous point⁶. If the site's introduction points are overloaded or the host is offline, you'll see a connection timeout with no further explanation.

The lack of traditional indexing is architectural, not a design flaw. Standard search engines like Google cannot index .onion addresses because those addresses exist only within Tor's internal routing and are not part of the public DNS system³. Onion services do not register with centralised authorities, and their descriptors are distributed across HSDir nodes within Tor rather than published to the open web⁶. This means you cannot type 'onion site for X' into Google and expect results; you must rely on specialised onion search engines, curated directories, or direct address sharing through trusted channels. For starting points, see Tor Search Engine: Finding What You Need and Dark Web Search Engine: How to Use Them Safely.

Why Discoverability Remains a Challenge

The 56-character alphanumeric .onion address¹ is cryptographically derived from the service's public key, which guarantees you connect to the correct host without tampering¹ but makes addresses impossible to remember or guess. There is no central registry of active onion sites, no equivalent to ICANN's WHOIS database, and no authoritative list of 'safe' addresses. Phishing operators exploit this by registering addresses that differ by one or two characters from legitimate services, knowing users cannot easily verify authenticity. You must cross-check every address through multiple independent sources—official social media accounts, signed PGP messages, or directories maintained by entities with a reputation at stake—before visiting. The cryptographic assurance that .onion provides protects the connection itself¹, but it does not verify the operator's intent or the site's content.

Identifying and Mitigating Risks Associated with Onion Sites

Onion sites present distinct security risks that differ from clearnet browsing, and understanding them is the first step toward safe use. The Tor network protects your anonymity¹, but it does not verify the intent of the site operator or the safety of the content you access. Malware, phishing, scams, and exposure to illegal material are all present within the .onion ecosystem, and the same architectural features that prevent surveillance—hidden IP addresses, lack of central oversight—also enable bad actors to operate with reduced accountability.

Malware and Phishing

Phishing on onion sites exploits the 56-character alphanumeric address format¹. Attackers register .onion addresses that differ by one or two characters from legitimate services, knowing users cannot easily verify authenticity without cross-checking multiple sources. If you visit a phishing clone and enter credentials, the operator logs them immediately; because your connection is end-to-end encrypted¹, you have no warning that the site is fraudulent until it's too late. We advise verifying every .onion address through at least two independent channels—official social media accounts with verified signatures, signed PGP messages from the service operator, or directories maintained by entities with a documented reputation.

Malware distribution is common because Tor Browser's default security settings allow JavaScript and other active content that can exploit browser vulnerabilities or fingerprint your session. Files downloaded from onion sites can contain embedded scripts or metadata that reveal your real IP address when opened outside Tor Browser. Treat every download as hostile: open files only in an isolated virtual machine or air-gapped system, never on your primary device. Set Tor Browser's security level to 'Safest' to disable JavaScript entirely; many onion sites function without it, and those that require scripts should be approached with heightened suspicion.

Scams and Illegal Content

Darknet marketplaces and forums frequently host scams—vendors who accept payment and never deliver, 'escrow' services that vanish with funds, or listings for non-existent goods. The lack of consumer protection mechanisms or dispute resolution means you have no recourse if defrauded. More critically, onion sites can host illegal content—child exploitation material, stolen data, weapons sales, and drug trafficking—and simply viewing or downloading such material is a criminal offence in most jurisdictions, regardless of your intent. Browsing onion sites via Tor Browser is legal⁵, but your actions once you arrive determine your legal exposure. We cannot overstate this: accessing certain content carries severe criminal penalties, and 'I was just curious' is not a defence recognised by courts in the United Kingdom or elsewhere.

Technical Failures and Operational Security

Onion sites suffer frequent downtime and slow loading because they rely on volunteer-run relay nodes and introduction points [6, 8]. If the host's introduction points are offline or overloaded, your connection will time out with no explanation. Sites may take 10–30 seconds to load on first visit while Tor retrieves the hidden service descriptor [7, 8] and establishes the rendezvous point⁶. Understanding these limitations helps you distinguish between a site that is temporarily unreachable and one that has been seized or abandoned—patience is required, but repeated failures over days suggest the service is no longer operational.

Never enter personal information or reuse credentials on onion sites. Even though your connection is encrypted¹, the site operator can log everything you submit, and data breaches on darknet services are common. Use unique, randomly generated passwords for every onion service, and avoid linking your onion activity to your clearnet identity through email addresses, usernames, or payment methods.

Legal Implications and Jurisdiction

The legality of accessing onion sites depends on what you do, not the act of using Tor itself⁵. In the United Kingdom, the Computer Misuse Act 1990 and the Investigatory Powers Act 2016 govern unauthorised access and interception; accessing illegal content, purchasing prohibited goods, or participating in criminal conspiracy are prosecutable offences regardless of the technology used. Law enforcement agencies monitor darknet activity through a combination of undercover operations, server seizures, and traffic analysis; the anonymity Tor provides is not absolute, and operational security failures—reusing identities, leaking metadata, or trusting compromised services—have led to arrests.

We advise checking primary legal sources in your jurisdiction before accessing onion sites for any purpose beyond research. The Crown Prosecution Service publishes guidance on computer misuse offences; consult those documents rather than relying on summaries or forum advice. If you encounter illegal content inadvertently, do not interact with it, do not download it, and close Tor Browser immediately. Reporting such content to the Internet Watch Foundation or the National Crime Agency is the lawful course of action, though doing so may require disclosing that you were using Tor.

Legitimate Uses of Onion Sites for Privacy and Security

Onion services serve journalists, activists, and organisations operating under censorship or surveillance, not just illicit marketplaces. Facebook maintains a verified .onion address to allow users in countries where the platform is blocked to access the service without revealing their location¹. Amnesty International launched its website on the Tor network in December 2023 to help universal access in regions where human rights organisations face state-level blocking⁴. ProtonMail, The New York Times, and the BBC all operate .onion mirrors to protect sources and readers who cannot safely visit clearnet equivalents. These services demonstrate that onion sites exist to solve real operational problems—bypassing censorship, protecting whistleblowers, and enabling secure communication—rather than to facilitate crime.

Secure Communication for High-Risk Users

SecureDrop, an open-source whistleblower submission system, relies exclusively on onion services to protect sources submitting documents to newsrooms. The system uses Tor's hidden service protocol [6, 7, 8, 9, 10] to prevent journalists and sources from learning each other's IP addresses, and end-to-end encryption¹ ensures that even if the submission server is compromised, the content remains protected in transit. Organisations including The Guardian, The Washington Post, and The Intercept operate SecureDrop instances accessible only via .onion addresses; this architecture removes the risk that a government or ISP can identify who is contacting the newsroom by monitoring network traffic.

Activists in authoritarian states use onion services to coordinate without exposing their identities to state surveillance. The hidden location and IP address protection¹ means that hosting an onion site does not reveal the server's physical location, making it harder for adversaries to seize infrastructure or identify operators. This protection is not theoretical—onion services have enabled protest coordination, documentation of human rights abuses, and distribution of censored information in countries where such activities carry severe legal penalties.

Bypassing Censorship Without Detection

Onion services bypass state-level censorship because they do not rely on DNS or publicly routable IP addresses [1, 4]. A government that blocks access to a clearnet website by filtering DNS queries or blacklisting IP ranges cannot block an .onion address using the same methods, because the address exists only within Tor's internal routing and resolves through hidden service descriptors distributed across HSDir nodes⁶. Users in China, Iran, and other heavily censored regions access blocked news sites, social media platforms, and communication tools via .onion mirrors without triggering the same detection mechanisms that flag VPN or proxy use.

The Onion-Location HTTP header¹ allows clearnet sites to advertise their .onion counterpart; when you visit the clearnet version in Tor Browser, a purple suggestion pill prompts you to switch to the .onion address. This feature reduces the risk that users will visit phishing clones, because the clearnet site—which can be verified through traditional means—vouches for the authenticity of the .onion address. Major platforms including DuckDuckGo and the Internet Archive implement Onion-Location to guide users toward the more secure option.

Anonymous Services Without Centralised Control

Onion services enable decentralised infrastructure that no single entity controls. Because the .onion address is cryptographically derived from the service's public key [2, 3], users can verify they are connecting to the correct host without relying on certificate authorities or DNS registrars that governments can compel to revoke or redirect records. This cryptographic assurance¹ matters most when the service operator faces legal or political pressure—an onion site cannot be taken offline by seizing a domain name or pressuring a hosting provider, because the address itself is not registered with any central authority.

Privacy-focused services use onion addresses to reduce metadata exposure. When you connect to a clearnet website, your ISP, the site's hosting provider, and any intermediary network can log your IP address and the time of access; onion services eliminate this metadata by design¹. Even if the service operator wanted to log visitor IP addresses, the rendezvous point architecture [8, 9, 10] ensures they never learn them. This protection is valuable for users accessing legal but sensitive services—mental health resources, legal advice, or financial counselling—where the act of visiting the site could carry social or professional consequences if disclosed.

Common Mistakes and Misconceptions

Confusing 'Onion Site' with the Entire 'Dark Web'

Many users mistakenly equate 'onion sites' with the entire 'dark web.' The dark web is a broader term for content not indexed by standard search engines and requiring specific software to access⁵. Onion sites, identified by their .onion addresses, are a specific type of dark web content accessible exclusively through the Tor network [1, 4]. While all onion sites are part of the dark web, not all dark web content uses the .onion domain or the Tor network.

Assuming Tor Browser Guarantees Full Anonymity

Users often assume that simply using Tor Browser makes them completely anonymous and untraceable. Tor Browser encrypts your traffic and routes it through multiple relays to hide your IP address and location [2, 14]. However, operational security failures—like reusing usernames, disclosing personal information, or opening downloaded files on your main operating system—can compromise your anonymity.

Neglecting Basic Security Practices Due to Encryption

Some users believe that the end-to-end encryption provided by Tor¹ means they don't need to worry about other security measures. While encryption protects data in transit, it does not protect against malicious site operators who can still log your submissions, serve malware, or host phishing sites. You must still practice vigilance, verify addresses, and use isolated environments for downloads.

Expecting Clearnet Speeds and Stability

Users often become frustrated with slow loading times and frequent connection errors on onion sites, expecting the same performance as the clearnet. The multi-hop architecture that protects anonymity inherently adds latency, making browsing slower [2, 14]. Onion services can also be unstable due to the distributed nature of the network, leading to more '503 Service Unavailable' errors than typical websites.

Key Takeaways

Onion sites are a specific segment of the dark web, offering enhanced privacy and censorship resistance through the Tor network. We advise remembering these points:

• Onion sites are not inherently illegal: Major organizations like Facebook and the BBC host .onion services for secure access [2, 5].

• Tor Browser is essential: You cannot access .onion addresses without it [1, 4].

• Anonymity is not guaranteed: Tor hides your IP, but poor operational security can expose your identity¹.

• Clearnet search engines won't work: Use specialized directories or curated lists to find onion sites.

• Vigilance is crucial: Despite encryption, be wary of scams, malware, and phishing.

To begin exploring, we recommend you learn how to Install Tor Browser: A Step-by-Step Guide.

Explore More About Onion Sites

Discover additional resources and guides to enhance your knowledge.