Onion Web Addresses: Understanding Their Structure

Key points

.onion addresses are special 56-character strings that identify services reachable only through the Tor network. They hide the server's location and IP address while providing built-in end-to-end encryption and cryptographic self-authentication, so connecting to the exact address guarantees you reach the intended service without certificate authorities.

Version 3 addresses always end with the letter "d" because the version byte 0x03 produces this fixed character in base32 encoding. Older 16-character version 2 addresses stopped working in October 2021 and should be avoided as they are now either dead or phishing attempts.

Before you visit any .onion link, obtain it directly from the organisation’s clearnet HTTPS site or use the Onion-Location header in Tor Browser.

What Are Onion Web Addresses?

.onion web addresses are unique domains that can only be accessed through the Tor network, which is designed to provide anonymity and privacy for its users. Unlike traditional clearnet domains, which can be reached using standard web browsers, .onion addresses are part of the "dark web" and are not indexed by conventional search engines. This means that they are specifically created for users who seek to maintain their privacy while browsing or engaging with online services.

These addresses function as hidden services, which means they hide the location and IP address of the server hosting the content. This anonymity is achieved through a method known as onion routing, where data is encrypted multiple times and routed through various nodes in the Tor network before reaching its destination. Consequently, the server's identity remains concealed from both users and network observers, providing a level of security and privacy that is not available on the clearnet¹.

A version 3 .onion address is composed of 56 characters, generated using base32 encoding of a 32-byte ed25519 public key along with a checksum and version identifier. This versioning system ensures a higher level of security, estimated at approximately 128 bits, compared to the older version 2 addresses, which were only 16 characters long and based on a truncated SHA-1 hash²³. It's important to note that version 2 addresses were deprecated in October 2021, meaning they are no longer supported and should be avoided as they may lead to phishing attempts or dead links⁴.

To summarise, .onion web addresses are a crucial aspect of the Tor network, providing users with a secure and anonymous way to access services that prioritise privacy.

---

How Onion Addresses Are Structured

A version 3 .onion address consists of three main components: a 56-character string generated from a public key, a checksum, and a version byte, followed by the ".onion" suffix. The structure can be summarised as follows:

• PUBKEY: The primary component is the 32-byte ed25519 master public key of the hidden service.

• CHECKSUM: This is derived from the first two bytes of a SHA3-256 hash that includes the string ".onion checksum", the PUBKEY, and the version byte.

• VERSION: For version 3 addresses, this is always the byte value 0x03, which guarantees that all valid addresses end with the letter "d" due to the base32 encoding process².

Base32 encoding is crucial because it converts binary data into a text format that can be easily used in URLs. This encoding ensures that the resulting 56-character string is composed of a limited set of characters, making it user-friendly and less prone to errors when entered manually. The checksum further enhances security by verifying the integrity of the address, ensuring that it has not been altered during transmission³.

To illustrate, consider a hypothetical version 3 .onion address: abcde12345fghijklmnopqrstuvwxyz1234567d.onion. Here, "abcde12345fghijklmnopqrstuvwxyz1234567" represents the base32-encoded PUBKEY and CHECKSUM, while the "d" signifies the version byte².

Understanding this structure is essential for anyone looking to navigate the dark web safely. Recognising the components of a .onion address can help you identify legitimate services and avoid potential phishing attempts associated with outdated or invalid addresses⁴.

---

Version 2 vs Version 3 Onion Addresses

The transition from version 2 to version 3 .onion addresses marks a significant evolution in the security and structure of hidden services on the Tor network. Version 2 addresses were 16 characters long and based on an 80-bit truncated SHA-1 hash of an RSA-1024 key, providing a lower security level. In contrast, version 3 addresses are 56 characters long, constructed using base32 encoding of a full 32-byte ed25519 public key, along with a checksum and version identifier, offering approximately 128 bits of security³.

Due to their stronger security features, version 3 addresses are now the standard for onion services. Every valid version 3 address ends with the letter "d," which is a result of the version byte 0x03 in base32 encoding². This change enhances the authenticity and integrity of connections to hidden services, as the .onion address itself functions as the service's public key, ensuring cryptographic self-authentication¹.

It's crucial to note that version 2 addresses are deprecated. The Tor Project officially stopped supporting them starting in October 2021. This followed a series of warnings beginning in September 2020 and the removal of version 2 addresses from the codebase in Tor 0.4.6⁴. Consequently, any attempt to use a 16-character version 2 address today may lead to dead links or potential phishing attempts, as they are no longer operational on the Tor network⁴.

In summary, if you are accessing .onion services, ensure you are using version 3 addresses to benefit from enhanced security and reliability. Avoid any 16-character addresses to protect yourself from the risks associated with deprecated services.

---

Why Onion Addresses Look Random

Onion addresses might seem random, but their structure is the result of cryptographic processes. These addresses are derived mathematically from public keys rather than being chosen by their owners. Each version 3 .onion address is constructed using a specific format: it consists of a 32-byte ed25519 master public key, a checksum, and a version byte, all encoded in base32 format. This results in a 56-character string that ends with the letter "d" due to the encoding process².

The public key serves as the core component of the address, while the checksum is calculated using the SHA3-256 hashing algorithm. This checksum helps verify the integrity of the address, ensuring it has not been tampered with during transmission³. Therefore, when you see a .onion address, it's not just a random string but a well-defined output of cryptographic functions that ensure security and authenticity.

A common misconception is that owners can select memorable names for their .onion addresses. In reality, they do not have that option without special tools. The addresses are automatically generated based on the public key and cannot be personalised like traditional domain names. This design prevents users from creating easily guessable or memorable addresses, which could potentially compromise security.

For example, if you encounter a .onion address like abcde12345fghijklmnopqrstuvwxyz1234567d.onion, it is essential to understand that this string is not a creative choice but a product of cryptographic generation. The randomness of the address helps maintain the anonymity and security that the Tor network aims to provide¹.

In summary, the seemingly random nature of .onion addresses stems from complex cryptographic processes that ensure they are secure and uniquely tied to their respective services, rather than being arbitrary selections by their owners.

---

How to Access and Verify an Onion Address

Accessing a .onion address requires using the Tor Browser, which is specifically designed to connect to the Tor network. Follow these steps to access an onion site:

1. Download and Install Tor Browser: Obtain the latest version of the Tor Browser from the official Tor Project website. Ensure you install it on your device following the provided instructions.

2. Launch the Tor Browser: Open the Tor Browser. It may take a moment to connect to the Tor network.

3. Enter the .onion Address: In the address bar, type the .onion address you wish to visit. Make sure to enter it exactly as it appears, including the ".onion" suffix.

4. Navigate to the Site: Press "Enter" to load the page. If the address is valid, the site should display within a few moments.

To verify that a .onion address is genuine, consider these methods:

• Obtain from Official Sources: Always get the .onion address directly from the organisation's clearnet HTTPS website. This reduces the risk of encountering fraudulent links⁵.

• Use Onion-Location Header: When visiting a clearnet site, look for an "Onion-Location" HTTP header that provides a button to access the .onion version of the site directly through the Tor Browser.

• Check via TLS Certificate: If available, confirm that the site has a TLS certificate specifically issued for the .onion domain. This adds an extra layer of assurance regarding the site's authenticity⁵.

Be aware of common mistakes when copying or entering .onion addresses. One frequent error is relying on outdated lists that include deprecated version 2 addresses, which have been unsupported since October 2021. Links to these addresses may lead to dead ends or phishing attempts⁴. Always ensure you're using a version 3 address, which is 56 characters long and ends with the letter "d"²³.

By following these steps and tips, you can safely access and verify .onion addresses while minimising risks associated with the dark web.

---

Common Myths About .onion Sites

Many misconceptions surround .onion sites, especially regarding their legality, safety, and the distinction between the dark web and deep web.

Are onion links legal?

Accessing .onion sites via the Tor network is legal in several countries, including the United States, United Kingdom, Canada, and Australia. There are no federal laws prohibiting the download of the Tor Browser or visiting .onion addresses. However, it is crucial to understand that while the act of visiting these sites is legal, engaging in illegal activities through them is not⁶.

Is it safe to visit onion sites?

Safety when visiting .onion sites largely depends on the source of the address and the nature of the content. Onion services provide end-to-end encryption and hide the server's IP address, which enhances privacy and security. However, caution is necessary. To verify a legitimate .onion address, obtain it from the organisation's official clearnet website or use the Onion-Location HTTP header that suggests an .onion version of the site⁵. Be wary of outdated version 2 addresses, which have been unsupported since October 2021 and may lead to phishing attempts⁴.

What is the difference between the dark web and deep web?

The terms "dark web" and "deep web" are often confused. The deep web refers to a vast portion of the internet that is not indexed by standard search engines. This includes databases, private websites, and other content not accessible through traditional search methods. Estimates suggest that the deep web constitutes the majority of online data. In contrast, the dark web specifically refers to overlay networks, like Tor onion services, that require special software to access³. While both terms describe parts of the internet that are not readily available, the dark web is a subset of the deep web, focusing on anonymity and privacy.

Understanding these myths can help you navigate the .onion world more safely and responsibly.

---

Technical Significance of Onion Services

Onion services play a crucial role in ensuring privacy and anonymity on the internet. They utilise end-to-end encryption, which means that the data transmitted between the client and the service remains secure from external observers. This is achieved without the need for traditional HTTPS protocols, as the encryption is built into the Onion Service Protocol itself¹.

The process of onion routing is fundamental to how these services function. When you access a .onion address, your request is routed through multiple randomly selected nodes on the Tor network, each of which only knows the previous and next node in the chain. This layered approach obscures your IP address and the location of the server hosting the onion service, significantly enhancing user anonymity¹.

Moreover, the hidden service protocol allows for the automatic generation of .onion addresses that do not require domain registration. This means that the server's physical location and IP address are concealed, making it difficult for anyone to trace the service back to its origin¹. Each valid version 3 .onion address is constructed using base32 encoding of a public key, ensuring cryptographic self-authentication. This guarantees that connecting to a specific .onion address will always lead you to the intended service, without the need for third-party certificate authorities²¹.

Onion services are particularly significant for individuals seeking to maintain their privacy in oppressive regimes or for those engaging in sensitive communications. The enhanced security features provided by the current version 3 .onion addresses, which offer approximately 128 bits of security, make them a preferred choice for users concerned about surveillance and censorship³.

In the context of topic links 3.0 onion, these advancements in onion service protocols contribute to a more reliable and secure experience for users exploring the dark web. Understanding the technical significance of onion services can help you navigate this complex digital landscape safely.

---

Recognizing Legitimate vs Suspicious Onion Addresses

Navigating the world of .onion addresses can be tricky, especially when distinguishing between legitimate and suspicious ones. To help you stay safe, consider the following checklist of red flags:

• Shortened Links: Be cautious of links that appear shortened or altered. Legitimate .onion addresses are typically long, with version 3 addresses being 56 characters in length and always ending with a 'd'²³.

• Missing Checksum: Each version 3 .onion address includes a checksum, which is crucial for verifying its integrity. If the checksum is absent, the address may be fake or tampered with².

• Unexpected Length: Version 2 addresses, which are now deprecated, were only 16 characters long. Any encounter with such addresses should raise suspicion, as they have not been operational since October 2021⁴.

To ensure you are visiting a verified site, refer to known organizations' .onion addresses. For example, the BBC and Deutsche Welle operate official mirrors with verified addresses. These sites often publish their .onion addresses directly on their clearnet pages, providing a reliable source for users⁷.

Validating a .onion address using the checksum is straightforward. The checksum is derived from the SHA3-256 hashing algorithm, which combines the ".onion checksum" with the public key and version byte². For example, if you have an address like abcde12345fghijklmnopqrstuvwxyz1234567d.onion, you can check its validity by calculating the checksum and matching it against the expected value.

By following these guidelines and remaining vigilant, you can better navigate the .onion landscape while minimising the risks associated with suspicious addresses. Always ensure you are using secure, verified links to maintain your safety online.

Common Errors and Misconceptions

Have you ever copied a .onion address only to find it fails to load? Many beginners assume any string ending in ".onion" will work, yet this often stems from outdated sources that still list version 2 addresses. Such addresses stopped resolving on the Tor network in October 2021 after Tor 0.4.6 removed support⁴. The result is wasted time and increased exposure to phishing sites that mimic legitimate services. Always confirm you hold a 56-character version 3 address before use.

Assuming .onion addresses can be chosen like normal domains

You might search for short, memorable .onion names because that is how clearnet domains work. In practice the address is produced automatically from a 32-byte ed25519 public key, a two-byte checksum and the version byte, leaving no room for custom selection without specialised tools². This cryptographic tie prevents guessable addresses that attackers could exploit. Check the address directly against the service owner's published source instead of expecting human-readable names.

Believing every long .onion link is automatically safe

A 56-character address looks official, so you paste it without further checks. Yet length alone does not guarantee legitimacy if the source is unverified. The address itself acts as the service's public key and provides self-authentication only when obtained from a trusted channel¹. Obtain the address from the organisation's clearnet HTTPS site or via the Onion-Location header to avoid counterfeit links that lead to scam pages.

Thinking version 2 addresses remain usable today

You come across 16-character links on old bookmark lists and assume they still connect. These relied on an 80-bit truncated SHA-1 hash of an RSA-1024 key and offered weaker security than current addresses³. Stable Tor releases ceased supporting them from October 2021, following warnings issued in September 2020⁴. Any such address you meet now is either dead or a deliberate phishing attempt; discard it immediately and seek the version 3 replacement.

Confusing checksum presence with manual verification

Some users ignore the fixed final letter and treat every part of the address as random. Every valid version 3 address ends with "d" because the version byte 0x03, when base32-encoded, always produces this character after the checksum bytes². You can verify the checksum yourself by computing the first two bytes of SHA3-256(".onion checksum" | PUBKEY | VERSION) and confirming they match². Perform this step when the address arrives from an unfamiliar mirror.

Mixing up deep web and dark web terminology

You read that .onion sites form part of the deep web and therefore treat all non-indexed content as hidden and risky. The deep web covers any page not listed by standard search engines, such as private databases, while the dark web specifically means overlay networks like Tor onion services that need special software³. Recognising this difference stops you from overestimating danger on every non-Google link and helps you focus checks on actual onion addresses.

Conclusions

You now understand the core structure of .onion addresses and why their length, checksum, and final letter matter. Here are the key points to remember and the first actions to take:

• Always confirm a version 3 address contains exactly 56 characters and ends with “d”.

• Copy every .onion address directly from the organisation’s clearnet HTTPS page rather than from third-party lists.

• Discard any 16-character addresses immediately, as they have not worked since October 2021.

• Verify the checksum when you receive an address from an unfamiliar source.

• Use Tor Browser and watch for the Onion-Location header to reach official mirrors safely.

Your next step is to explore verified onion services with confidence. Start by reading Onion Tor Websites: Navigating Safely.