Creating a List of Onion Sites: What You Need

A list of onion sites is a curated set of .onion addresses that the reader intends to revisit or share. A version 3 onion address has 56 letters and numbers before .onion, and the address itself encodes the service’s ed25519 public key, so the address authenticates the service^[1]. Before building a list, verify that every entry uses version 3 addressing; version 2 onion services were deprecated and became unreachable after October 2021^[2].

Onion Sites Verification and Maintenance Checklist

What Counts as a Legitimate Onion Site List (and What Doesn’t)

A legitimate list of onion sites is a structured collection that can take various forms, such as a curated directory, a wiki, a search engine index, or a personal bookmark set. Each type serves different purposes, with curated directories like Hidden Wiki, onion.live, and Just Onion offering vetted resources, while raw crawler dumps may present unverified or outdated links.

The absence of a single, complete list of onion sites is due to the nature of onion services. These services are voluntary, ephemeral, and often unindexed, meaning that many are only accessible for a limited time before disappearing. Consequently, a user cannot rely solely on one source for a comprehensive list, as new services frequently emerge and old ones vanish.

Additionally, there is a significant risk of encountering lists that mix legal privacy tools with scam or illegal links. For instance, while Proton Mail onion and SecureDrop are legitimate services, other entries may lead to phishing sites or illicit activities. Therefore, the reader's first task is filtering out the unreliable or harmful links rather than merely collecting them. It is essential to approach any list with a critical eye, verifying each entry before considering it trustworthy.

To create an effective list, users should focus on reputable sources, cross-reference services, and stay informed about the ongoing changes within the Tor ecosystem. Regularly updating the list is crucial to maintaining its relevance and safety, ensuring that it serves as a valuable resource rather than a potential liability.

How Onion URLs Work and Why They Change So Often

Onion addresses, or .onion URLs, have a specific structure that is essential for their functionality within the Tor network. A version 3 onion address consists of 56 alphanumeric characters followed by .onion. This format represents the identity public key of the onion service in Base32 encoding, which ensures that the address itself can authenticate the service^[3][1].

Version 2 onion addresses, which are shorter at 16 characters, were deprecated in 2021 due to significant security vulnerabilities. The Tor Project officially ended support for v2 addresses on October 15, 2021, rendering them unreachable^[2][4]. The move to v3 addresses was not merely a cosmetic change; it was motivated by the need for enhanced security features, including the use of the full ed25519 public key^[5][6].

Onion addresses are derived from public keys, meaning they are not chosen by the site owners. This design provides a layer of authentication; when a client connects to an onion service, the service's descriptor is verified using the public key encoded in the address, ensuring that the descriptor could only have been produced by that specific service^[7].

Sites frequently change their addresses for several reasons. Key rotation is a common practice to enhance security, as it prevents long-term exposure of a single address. Additionally, if a service migrates to a different server, it may also necessitate a change in the onion address. To further protect user privacy, version 3 onion services employ key derivation, resulting in daily-rotated identifiers that clients use to access the service without exposing the full onion address^[5].

For example, the Tor Project's official v3 onion address follows the structure of a 56-character string. A typical format might look like abcdefghijklmnopqrstuvwxyz123456.onion, where the characters represent the service’s public key rather than a human-readable name.

Understanding the mechanics of onion addresses is crucial for users seeking to navigate the Tor network safely. Regularly updating and verifying the addresses on any curated list is essential to avoid dead links and ensure access to legitimate services.

Where to Find Existing Onion Site Lists You Can Trust

Several reliable sources can provide curated lists of onion sites, each with its strengths and weaknesses.

The Hidden Wiki

The Hidden Wiki is a community-edited directory that categorises various onion services. It offers a broad selection of links, making it a good starting point. However, the open-edit nature makes it vulnerable to vandalism and the inclusion of scam links, necessitating caution when using it.

Onion.live

Onion.live presents a curated directory of verified onion services. It focuses on ensuring that listed sites are legitimate and functional, which enhances trust. The main drawback is that it may not cover the full range of available services, limiting options for users seeking niche content.

Just Onion

Just Onion is another vetted directory that organises links into categories. It aims for a balance between comprehensiveness and safety, ensuring that listed sites are regularly checked for reliability. However, as with any curated list, it may not be entirely exhaustive.

Ahmia

Ahmia serves as a surface-accessible index that filters out illegal content. It is beneficial for users who want to avoid harmful links while exploring onion services. Its limitation lies in the potential exclusion of legitimate services that may not fit within its filtering criteria.

Tor Project's Official List

The Tor Project’s official onion services list at onion.torproject.org provides a trustworthy resource directly from the developers of Tor. This list is reliable, as it includes only verified services. However, it is less comprehensive compared to community-driven sources, which may offer a wider array of options.

Reddit r/onions Community

The Reddit r/onions community is an active forum where users share updated lists and warnings about onion sites. Engaging with this community can provide insights into the latest developments and help identify potential scams or dead links. The downside is the variability in the quality of shared information, which requires users to apply their judgement.

Utilising a combination of these sources can help the reader build a robust and reliable list of onion sites. Regular cross-referencing and verification are essential to maintain a safe browsing experience in the Tor network.

How to Verify an Onion Link Before You Visit It

Verifying an onion link is crucial to ensure safety and authenticity. Follow this step-by-step workflow to assess any .onion address before visiting it.

Step 1: Check the Address Against Directories

Verify the onion address by cross-referencing it with at least two independent directories. Reliable sources include the Hidden Wiki and Onion.live. These platforms often have curated lists of active onion services, reducing the risk of encountering scams.

Step 2: Look for Clearnet Mirrors

Search for a clearnet mirror or an official announcement that confirms the onion address. Many legitimate services, such as Proton Mail, provide clear confirmations on their main websites. This step adds a layer of assurance that the address is genuine.

Step 3: Inspect for HTTPS and TLS Certificates

When visiting onion sites that use HTTPS, check for valid TLS certificates. This is important as it confirms that the site has undergone a security validation process. However, remember that traffic between the Tor Browser and onion services is end-to-end encrypted, so HTTPS is not strictly necessary^[1].

Step 4: Use PGP-Signed Announcements

If available, look for PGP-signed announcements from the site. These signatures verify that the message originated from the legitimate service, providing further assurance against impersonation or phishing attempts.

Step 5: Check Uptime History

Investigate the site's uptime history on directory aggregators. Websites like Dread and others often provide information about the accessibility and reliability of onion services. A consistent uptime history suggests that the service is stable and trustworthy.

Common Risks

Be cautious about clicking links from Telegram groups, pastebins, or unsolicited direct messages. These platforms are common vectors for scams, often leading to phishing sites designed to steal personal information.

Phishing is a significant threat in the onion domain. Fake addresses can easily mimic legitimate ones by altering a few characters. Always verify the spelling and format of an onion address, as even minor discrepancies can indicate a fraudulent site.

By diligently following these verification steps, the reader can significantly reduce the risk of encountering scams or malicious content while exploring the Tor network.

Building Your Own List: Categories Worth Including

A well-structured list of onion sites can enhance the browsing experience on the Tor network. To create an effective personal list, consider categorising sites into the following groups: privacy tools, news and whistleblowing, search engines, forums and communities, and file/archive resources.

Privacy Tools

Including privacy tools is essential for users focused on secure communication and data protection. Examples include:

• Proton Mail (ProtonMail.onion): A secure email service that prioritises privacy and encryption.

• DuckDuckGo (DuckDuckGo.onion): A search engine that doesn’t track users, offering anonymity in searches.

• SecureDrop: A platform for whistleblowers to submit documents securely to journalists, ensuring confidentiality.

News and Whistleblowing

This category is vital for accessing uncensored news and whistleblower platforms. Examples include:

• New York Times (The New York Times onion mirror): Provides access to news articles while maintaining user anonymity.

• ProPublica (ProPublica onion): An investigative journalism platform that also allows for secure submissions from whistleblowers.

• WikiLeaks Mirrors: Various mirrors of WikiLeaks offer access to leaked documents and information.

Search Engines

Search engines specifically designed for the Tor network help users navigate .onion sites. Examples include:

• Ahmia: An index that filters out illegal content, allowing users to find legitimate onion sites.

• DuckDuckGo Onion: The onion version of DuckDuckGo provides anonymous search capabilities.

Forums and Communities

Community forums can offer support and information sharing among users. Examples include:

• Dread: A popular forum for discussing onion services, news, and sharing experiences.

• Reddit Onion: A subreddit dedicated to sharing links and discussions about the dark web.

File/Archive Resources

These resources allow users to access books, documents, and archives securely. Examples include:

• Z-Library: A vast collection of eBooks available through its onion address.

• Internet Archive Onion: If available, this resource provides access to archived web pages and documents, promoting free access to knowledge.

Separating legal privacy resources from marketplaces and forums is crucial. This distinction helps users avoid engaging with illegal content while identifying safe and legitimate services. A clear categorisation allows for better understanding and navigation of the Tor network, ensuring a safer browsing experience.

Common Mistakes When Creating or Using an Onion Site List

Several common mistakes can undermine the effectiveness of a curated list of onion sites. Understanding these errors can enhance safety and ensure a more productive browsing experience.

Trusting a Single Source Without Cross-Checking

Relying solely on one source for onion site links can lead to misinformation or dead links. Many directories may include outdated or malicious entries. Cross-referencing at least two independent sources, such as the Hidden Wiki and Onion.live, can provide a more reliable overview of active services.

Assuming All .onion Sites Are Illegal

A widespread misconception is that all .onion sites engage in illegal activities. While some may facilitate illicit content, many serve as privacy tools for journalists and activists. For instance, services like Proton Mail and SecureDrop are designed to protect user privacy and promote free expression, thus debunking the notion that all onion sites are illegal.

Saving Links Without Noting the Date Checked

Onion addresses can become inactive or change frequently. Saving links without noting when they were last checked can result in accessing outdated or non-functional sites. Regularly updating the list is essential, as many links may become stale within weeks.

Using a Normal Browser or VPN Instead of Tor Browser

Accessing onion sites through a regular browser or a VPN compromises anonymity. The Tor Browser is specifically designed to protect user identity and encrypt traffic. Using alternative methods can expose users to risks, such as revealing their IP address to the sites they visit, which defeats the purpose of using the Tor network.

Clicking Links Marked 'Verified' Without Understanding the Source

Many directories label links as 'verified', but this often lacks transparency about who conducted the verification. Clicking on such links without understanding their origin can lead to scams or phishing attempts. Users should research the credibility of the directory and the verification process before trusting these claims.

Confusing Onion Sites with Dark Web Marketplaces

Some users mistakenly associate onion sites with dark web marketplaces, leading to the belief that possessing a list of onion sites is illegal. While certain marketplaces may engage in unlawful activities, many onion services are legitimate and legal to access. Understanding the distinction between legal services and illegal marketplaces is crucial for safe browsing.

By acknowledging and avoiding these common mistakes, users can create a more effective and secure list of onion sites, enhancing their experience on the Tor network.

How to Keep Your Onion List Current Without Getting Overwhelmed

Onion lists decay quickly, necessitating regular maintenance to ensure usability. A list compiled in 2022 may become cluttered with dead links by 2026 due to the transient nature of many onion services. To mitigate this issue, a lightweight maintenance routine is advisable.

Establish a monthly schedule to review your list. During each check, verify that each link loads correctly. If a link is non-functional, remove it and note the last-checked date next to each entry. This not only keeps your list current but also allows you to track the reliability of the services you use.

For storage, consider using a plain text file or a password manager rather than a public document. Storing your list privately helps maintain your anonymity and reduces the risk of exposure to phishing attempts or malicious links.

Additionally, some directories like onion.live and Just Onion offer RSS or update feeds, which can notify you of changes to their lists. The Tor Project's official onion services list is another reliable resource, as it is the most stable reference point for active services. This list is particularly useful, as it is directly managed by the developers of Tor, ensuring a higher level of accuracy.

Follow these practices to keep your onion list relevant and functional. Regular checks and the use of trustworthy resources will enhance your experience on the Tor network while minimising the risks associated with outdated or malicious links.

Checklist: What a Useful Onion Site List Must Include

A comprehensive checklist can enhance the effectiveness of an onion site list. The following entries should be included for each site:

1. Full Onion Address: Ensure it is the correct .onion address, as it is the Base32 encoding of the onion service's identity public key^[3].

2. Site Name and Function: Note the name of the site and a brief description of what it offers. For example, 'Proton Mail' is a secure email service prioritising privacy.

3. Date Last Verified: Record the date the site was last checked for functionality. This helps track the reliability of the service over time.

4. Source of Information: Document where the onion address was found, such as a reputable directory like the Hidden Wiki or Onion.live.

5. Category Tag: Classify the site into categories like privacy tools, news, or forums to streamline navigation.

6. Clearnet Mirror Availability: Indicate whether the site has a clearnet mirror. This can provide an additional layer of verification and accessibility.

Red Flags to Consider

Be vigilant for the following warning signs when assessing onion sites:

• No Clearnet Presence: Legitimate services often have a corresponding clearnet site. Lack of this may indicate a scam.

• No HTTPS: While onion services do not require HTTPS due to end-to-end encryption^[1], the absence of it can still be a red flag for security.

• Found Only in Telegram Groups: Links circulated in Telegram or similar platforms can often be unreliable or malicious.

• Promises of Illegal Goods: Sites offering illegal products or services should be approached with extreme caution, as they may be scams.

• Requires Login Before Displaying Content: Legitimate services typically do not require a login to access basic information. This could indicate a phishing attempt.

By incorporating these elements into a curated list, users can create a useful and reliable resource for navigating onion sites while minimising risks associated with scams and illegal content.

Выводы

Curating an onion site list requires verification, categorisation, and regular maintenance rather than one-time collection.

• Cross-check every address against at least two independent sources before saving it; a single directory entry is not enough to confirm a service is active or legitimate.

• Record the date last checked and the source for each entry, since onion addresses can become dead within weeks.

• Separate privacy tools, news mirrors, and archives from marketplaces and forums to avoid conflating legal services with illegal ones.

• Access onion sites only through Tor Browser; a normal browser or VPN does not provide the same anonymity.

• Treat labels like ‘verified’ as unproven until the verification process and its source are understood.

Next, apply the checklist to an existing list and remove entries that fail the red-flag tests. For a broader overview of locating onion addresses without relying on unverified directories, see Finding Dark Web Site Addresses Safely.

Explore More Onion Site Resources

Discover additional guides and tips to enhance your experience.

Reading list

1. Onion services - Features - Tor Browser - Support
2. Set up Your Onion Service - Join the Tor Community
3. Encoding onion addresses [ONIONADDRESS] - Tor Specifications
4. Onion Service version 2 deprecation timeline | The Tor Project
5. V3 onion services usage | The Tor Project
6. V2 Onion Services Deprecation | Tor Project | Support
7. Tor Project | How do Onion Services work?