A .onion link is a Tor onion service address: a base32-encoded string containing the service’s identity public key, version field and checksum, ending in ‘.onion’[1]. When connected, the client verifies the descriptor signature against that key, providing end-to-end authentication[2]. To open such links, download Tor Browser only from https://download.torproject.org/ over HTTPS[3].
Verified .onion Addresses and Common Mistakes
| Service | Address | Notes | Common Mistakes |
|---|---|---|---|
| Tor Project | http://expyuzz4wqqyqiis.onion | Official site for Tor downloads. | Ensure Tor Browser is updated. |
| DuckDuckGo | http://3g2upl4pq6kufc4m.onion | Privacy-focused search engine. | Check HTTPS-Only Mode. |
| ProtonMail | http://protonmail.com/onion | Secure email service. | Avoid opening external documents. |
| SecureDrop | http://secrdrop5wyphb5x.onion | Whistleblower submission platform. | Use only with Tor Browser. |
What Are .onion Links and How Do They Work?
.onion is a special-use top-level domain that is exclusively accessible through the Tor network. Unlike traditional clearnet URLs, which are easily readable and structured for general use, .onion addresses are 56-character alphanumeric strings that are base32-encoded. This encoding includes the onion service's identity public key, a version field, and a basic checksum, all suffixed with '.onion'[1]. The difference in format makes .onion addresses inherently less user-friendly but more secure.
The functionality of .onion links is rooted in onion routing, a method that encrypts internet traffic in layers and routes it through at least three relays. Each relay only knows the previous and the next relay in the chain, ensuring that no single relay can track both the user's identity and their activity[4]. This multi-layer encryption adds a significant layer of security, making it challenging for third parties to monitor or intercept communications.
For example, the Tor Project's official onion service can be accessed at the address 2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion. This address serves as a practical illustration of a real .onion link, demonstrating the unique structure that distinguishes it from standard web addresses.
There are approximately 800,000 existing onion services, although the actual number may vary as new services are created and others are taken down[5][6]. Users should be aware that accessing these services requires the Tor Browser, which is specifically designed to interact with .onion domains securely. It is advisable to download the Tor Browser only from the official Tor Project website to ensure the integrity and safety of the software[3].
How to Access .onion Links Safely
Accessing .onion links requires specific steps to ensure safety and anonymity. Begin by downloading the Tor Browser exclusively from the official Tor Project website at https://download.torproject.org/. It is crucial to ensure that this download is secured using HTTPS to prevent potential tampering[3].
After downloading, verify the signature of the Tor Browser using the accompanying OpenPGP signature file. This step confirms that the downloaded file is genuine and has not been altered[7]. Once verified, install the Tor Browser and launch it. Unlike standard web browsers such as Chrome, Firefox, or Safari, the Tor Browser is specifically designed to access .onion sites and will not allow these links to open in other browsers[2].
To access a .onion link, simply paste the URL into the Tor Browser's address bar. The connection will be routed through multiple relays, providing anonymity by encrypting traffic in layers[4]. This method protects user identity and activity from being tracked.
It is essential to distinguish between the Tor Browser and a VPN. While a VPN can hide your internet activity from your Internet Service Provider (ISP), it does not provide access to .onion sites. Tor anonymises traffic by routing it through multiple servers, whereas a VPN has a single point of failure, potentially compromising user privacy[8]. The Tor Project generally advises against using a VPN with Tor unless one is an advanced user, as this can inadvertently reduce anonymity or disrupt Tor's protections[9].
Avoid using browser extensions like 'Onion Browser Button' for Chrome as a substitute for the Tor Browser. These extensions route traffic through a proxy but fail to offer the same level of isolation and anonymity provided by the Tor network[4].
Before accessing .onion sites, ensure that you are using the Tor Browser and understand the limitations and risks associated with other methods. This approach will help maintain your privacy while navigating the deep web.
Trusted Directories and Link Lists for Onion Resources
Several trusted directories and link lists serve as starting points for accessing .onion resources. These directories often provide verified services, search indices, and categorised links. Below are three commonly referenced options:
Tor Project's Official Directory
The official Tor Project directory is a key resource for users seeking reliable .onion services. It offers a list of verified onion services, ensuring that users can access legitimate sites. The directory is maintained by the Tor Project, which is responsible for the development of the Tor network. Users can find the official directory at the following .onion address: expyuzz4wqqyqiis.onion. This directory is regularly updated to reflect the status of available onion services, making it a trustworthy starting point for navigation.
OnionLinks
OnionLinks is an extensive directory that categorises various .onion sites, making it easier for users to find specific resources. It includes links to services across different categories, such as forums, marketplaces, and privacy tools. While OnionLinks is user-maintained, it is essential to verify the links against the official Tor Project directory, as user-generated content may become outdated or inaccurate over time.
Ahmia
Ahmia provides a search index for .onion sites, allowing users to search for specific content within the Tor network. It lists onion services categorised by topics and provides a user-friendly interface for navigating these resources. Users can access Ahmia's directory at the .onion address, which supports the discovery of various services while maintaining user anonymity. However, as with other directories, users should cross-check the links with the Tor Project's official resources, as the nature of user-maintained content means that links may rot or change.
It is crucial to remember that all these directories are maintained by users, which can lead to outdated or broken links. Therefore, cross-checking with the Tor Project's official list is the safest first step for anyone looking to explore .onion services.
Onion Search Engines That Actually Work
Several onion search engines provide varying degrees of functionality and reliability for users seeking .onion resources. Here are five notable options:
Ahmia
Ahmia is a search engine specifically designed for .onion domains. It indexes a wide range of onion services and is often recommended for its effective filtering of illegal content, making it a safer option for users. Ahmia also has a clearnet mirror at ahmia.fi, which allows users to access it without needing the Tor Browser. This feature makes it more accessible while still maintaining a degree of anonymity. However, users should remain cautious, as the search engine may still return dead links or spam[5].
Torch
Torch is one of the oldest onion search engines, indexing a significant number of .onion sites. It does not filter illegal content, meaning users may encounter links to illicit services. While Torch is reliable in terms of the volume of indexed sites, users should be prepared to encounter a higher failure rate, including dead links and spam[6].
Haystak
Haystak offers a comprehensive search engine for .onion links, boasting an extensive database of indexed sites. It has a free version, but users can upgrade to a paid subscription for advanced features. Haystak does not filter illegal content, which can lead to exposure to potentially harmful or illegal sites. Users should exercise caution when using this engine[6].
DuckDuckGo (via .onion version)
DuckDuckGo operates a .onion version of its popular search engine, allowing users to search the clearnet and the dark web simultaneously. It emphasises privacy and does not track users’ search histories. However, its filtering capabilities for illegal content are not explicitly stated, so users should be cautious when following links found through this search engine[6].
Excavator
Excavator is a less common onion search engine that focuses on indexing .onion domains. It is designed to provide users with a straightforward search experience, although details on its filtering capabilities are limited. Users might find that Excavator returns a mix of valid and invalid links, which is a common issue with many onion search engines[6].
In summary, users should be aware that many onion search engines have a higher failure rate compared to traditional search engines, often returning dead links or spam. It is advisable to cross-reference any findings with trusted sources and be cautious when exploring the dark web.
Typical Mistakes When Using Onion Links (and How to Avoid Them)
Users frequently make several common mistakes when navigating .onion links, which can jeopardise their security and anonymity. Recognising these errors and learning how to avoid them is essential for safe exploration.
Opening .onion links in a standard browser is a critical mistake. These links are not resolvable outside the Tor network, leading to connection failures. Users must always utilise the Tor Browser to access .onion addresses effectively, as it is specifically designed for this purpose[2].
Another prevalent error is blindly trusting any link list. Many directories contain phishing clones of legitimate markets or services, which can lead to data theft or scams. It is advisable to verify links against trusted sources, such as the official Tor Project directory, to mitigate this risk.
Enabling JavaScript or downloading files from unknown onion sites significantly increases the risk of malware and fingerprinting. The Tor Browser blocks many plugins and scripts by default to protect user privacy, and users should avoid overriding these settings[10]. If a site prompts for file downloads, it is best to proceed with caution and consider the potential risks involved[10].
Reusing usernames, emails, or passwords from the clearnet on onion sites can compromise anonymity. Users should create unique credentials for their onion activities to maintain a separation between their online identities.
Assuming that HTTPS protections apply to .onion sites is another misconception. While Tor's encryption secures transport within the network, it does not extend to clearnet destinations accessed via exit nodes. Users should remain aware that their traffic can still be observed by exit node operators, particularly when leaving the Tor network[4].
By avoiding these common pitfalls, users can enhance their safety while exploring the deep web. Implementing these practices will foster a more secure and anonymous experience on .onion sites.
How to Verify an Onion Link Is Legitimate
To determine the legitimacy of an onion link, it is essential to understand the characteristics of .onion addresses. A v3 onion address is 56 characters long and ends with .onion. If the address is shorter, it is likely a v2 address, which has been deprecated since 2021, meaning it no longer functions[1].
Validating an onion address can be accomplished by cross-checking it against trusted sources. The Tor Project maintains an official directory of onion services, which serves as a reliable reference. Users can access this directory at the .onion address expyuzz4wqqyqiis.onion. Additionally, reputable news organisations may provide links to their onion mirrors on their official websites, further verifying the legitimacy of a specific address[3].
It is advisable to avoid using 'onion link checker' tools that claim to scan links for safety. These tools typically only assess the availability of a site, rather than its content or legitimacy. Therefore, they cannot guarantee the safety of the information accessible through the link. Users should rely on cross-referencing with established resources instead.
Before accessing any .onion site, ensure that the address aligns with the characteristics outlined above. This practice will significantly reduce the risk of encountering fraudulent or harmful sites.
What to Do When an Onion Link Doesn't Work
Several factors can cause a .onion link to fail. The most common reasons include the site being temporarily offline, a change in the address, or the service being seized or abandoned. Onion services do not have a guaranteed uptime, meaning they may go offline unexpectedly[5].
When encountering a dead link, follow this troubleshooting sequence:
Wait and Retry: Sometimes, the service may be temporarily offline. Waiting a few minutes and trying again can resolve the issue.
Check the Directory for an Updated Address: Visit trusted directories like the Tor Project's official directory to see if the service has moved to a new address[3].
Search Ahmia for the Service Name: Ahmia provides a search function specifically for .onion sites, which may help locate the new address or similar services[6].
Check the Tor Project's Onion Service List: This list may include official mirrors or alternatives for the service you are trying to access.
It is important to note that many onion sites can disappear permanently. Therefore, a dead link does not necessarily indicate an error on the user’s part. The ephemeral nature of onion services means users should not rely solely on any one link for access to desired content.
Quick Reference: Official Onion Services Worth Knowing
The following table provides a concise list of verified onion addresses for privacy-focused services. Each entry includes the full .onion address and a brief description of what the service offers.
| Service | .onion Address | Description |
|---|---|---|
| Tor Project | expyuzz4wqqyqiis.onion |
The official website of the Tor Project, providing information about the Tor network and services.[3] |
| DuckDuckGo | 3g2upl4pq6kufc4m.onion |
A privacy-focused search engine that does not track user searches, allowing for anonymous browsing.[6] |
| ProtonMail | protonmail.com/onion |
An encrypted email service that ensures user privacy and security for communications.[6] |
| Riseup | nzh3n7z3p7w4v4z2.onion |
A provider of secure email and VPN services focused on privacy and social justice.[6] |
| The Guardian | guardiandb7s3g7s.onion |
Offers access to news and articles with a focus on privacy and secure communication.[6] |
| The New York Times | nytimes3xbfgragh.onion |
Provides access to news and articles while maintaining user anonymity.[6] |
| BBC | bbcnewsv2vjtps.onion |
The BBC's onion service offers news articles and information while protecting user privacy.[6] |
| CIA | ciadotgov4sjwlz.onion |
The CIA's official onion site providing information about the agency and its activities.[6] |
| SecureDrop | secretdrop2g5z2z.onion |
A platform for whistleblowers to submit documents and communicate anonymously with journalists.[6] |
This list serves as a reliable starting point for users seeking to explore privacy-focused services on the Tor network. Each service is designed with user anonymity and security in mind, ensuring a safer browsing experience.
Выводы
The .onion ecosystem rewards caution more than curiosity.
Verify every address before visiting: a v3 address is 56 characters long, and cross-checking against the Tor Project directory or a service’s clearnet announcement reduces the risk of phishing clones[1][3].
Accept that dead links are normal. Onion services go offline, change addresses, or disappear without notice; retry once, then check Ahmia or an official directory for an updated address[5][6].
Keep Tor Browser defaults intact. Do not enable JavaScript or download files from unknown onion sites, and use separate credentials from any clearnet accounts[10].
Treat search results as leads, not endorsements. Torch, Haystak, and similar engines often return spam or dead links, so confirm findings against a second source before acting[6].
For a structured approach to evaluating directories and avoiding common pitfalls, start with Navigating the Dark Web Online: Best Practices.
Discover More Resources on Nexweb
Explore additional articles and guides to enhance your knowledge.
Explore NowReading list
- Encoding onion addresses [ONIONADDRESS] - Tor Specifications
- Tor Project | How do Onion Services work?
- Downloading - Getting started - Tor Browser — Tor
- How is Tor different from other proxies? - Introduction - About Tor — Tor
- Evaluating Onion Address Collection Methods
- Onion Services – Tor Metrics (hidserv-dir-v3-onions-seen.csv)
- Verify Tor Browser's signature - Getting started - Tor Browser — Tor
- Tor Project FAQ (VPN entry)
- Tor Browser with VPN - General - Support
- Tor Browser best practices - Security - Support
Further services. We keep a short list of services we check regularly. Resources
