Tor Sites and Onion Addresses: A Practical Guide to Safe Access

A tor site is a web service that runs on the Tor network and is reachable only through the Tor Browser. Instead of a domain like example.com, tor sites use .onion addresses: long, seemingly random strings of characters followed by .onion. These addresses are generated from the site's cryptographic keys, not registered with a central authority.

Tor sites offer two things the regular web does not: the server's location is hidden, and the visitor's identity is obscured by default. This makes them useful for journalists, activists, whistleblowers, and ordinary people in countries where internet access is censored or monitored. It also makes them attractive to criminals, which is why the term dark web is often conflated with tor sites, though the two are not identical.

The key difference is encryption and routing. When you visit a tor site, your traffic is encrypted and bounced through multiple relays before reaching the server. The server operator does not see your real IP address. Conversely, the tor site operator's server location is hidden behind multiple layers of Tor infrastructure. This mutual anonymity is the defining feature.

An onion address is a cryptographic identifier, not a name you can remember or type easily. A typical v3 onion address is 56 characters long, like thehiddenwiki2345678901234567890123456789012345678901234.onion. This length is intentional: it encodes the public key of the site's server, making it mathematically impossible to forge or hijack without the private key.

When you enter an onion address into Tor Browser, the browser uses the address to locate the site through the Tor directory and establish an encrypted connection. Because the address is derived from cryptography, not DNS, there is no central registry that can be hacked or censored to redirect you to a fake site. However, this also means there is no autocorrect, no WHOIS lookup, and no obvious way to verify that the address you found is the real one.

This is where phishing becomes dangerous. An attacker can create a new onion site and share a similar-looking address, hoping you will mistype or forget the correct one. Many users have lost funds or data by visiting a clone instead of the real site. The only reliable way to verify an onion address is to find it from an official, PGP-signed source: the site's own announcement, a trusted directory, or a verified social media account.

Tor search engines index onion sites much like Google indexes the regular web. Torch, Ahmia, and Haystak are the most widely used tor search engines. They crawl .onion sites and return results based on keywords. Each has different coverage and indexing speed, so a site that does not appear in one search engine may appear in another.

DuckDuckGo also operates an onion mirror (duckduckgo.onion) that you can access through Tor Browser. It searches both the regular web and indexed onion content, making it a useful starting point if you are unsure whether a site is on tor or the clearnet.

Beyond search engines, onion directories like the Hidden Wiki aggregate links to tor sites by category. These directories are maintained by volunteers and vary in accuracy and currency. Some links are outdated, and some point to phishing clones. Always cross-reference a directory link with an official source before trusting it.

When searching for a specific site, do not rely on a single source. Use multiple search engines and directories, and look for consistency in the onion address. If you find conflicting addresses for the same site, assume all of them are suspicious until you verify the real one through an official channel.

Phishing is the most common attack against tor users. An attacker creates a fake site with a similar onion address and waits for users to mistype or forget the real one. Once you are on the clone, you may be prompted to log in, deposit funds, or upload files. Your credentials and data go straight to the attacker.

To verify an onion address, follow these steps:

1. Find the official announcement or press release from the site operator.
2. Check whether the announcement is PGP-signed by the operator's known key.
3. Verify the PGP signature using the operator's public key (available on their official site or social media).
4. Compare the onion address in the signed announcement with the one you are about to visit.
5. If the address matches and the signature is valid, it is safe to proceed.

If you cannot find a PGP-signed announcement, look for the address on multiple independent sources. If all sources agree, the risk is lower, though not zero. Never assume a site is real just because it appears in a search engine result or directory. Search engines and directories are not curated by the Tor Project and can include outdated or malicious links.

According to Tor Project documentation, the most common failure mode for tor users is operator error: visiting a phishing clone, reusing passwords across sites, or running outdated software. The second most common is law enforcement seizure. When a tor site is seized, the server is taken offline, but users who have bookmarked the address may not realize it is gone and may visit a clone that has taken its place.

A third risk comes from metadata leaks. Even though Tor hides your IP address, a poorly configured tor site can leak information about visitors through logs, cookies, or browser fingerprinting. This is why the Tor Project recommends using Tor Browser as-is, without customizing it: any modification can make you more identifiable.

Law enforcement has successfully infiltrated and shut down tor sites by compromising the server itself, not by breaking Tor encryption. This means that even a real tor site can be seized and replaced with a law-enforcement honeypot. Users who continue to use the site after seizure may be monitored or arrested. This is not a reason to avoid tor sites, but it is a reason to stay informed about which sites are still operational and to verify addresses regularly.

Finally, many tor sites are exit scams or honeypots from the start. Operators collect funds or data and disappear, or they are run by law enforcement to identify users. There is no way to guarantee that a site is legitimate just by visiting it. Trust is built over time, through consistent behavior and community verification.

To access tor sites, you need Tor Browser, the official tool maintained by the Tor Project. Tor Browser is a modified version of Firefox that routes all traffic through the Tor network by default. It also disables plugins, JavaScript, and other features that could leak your identity.

Download Tor Browser only from the official Tor Project website. Do not use a mirror or a third-party distributor unless you can verify the PGP signature of the download. Once installed, open Tor Browser and wait for it to connect to the Tor network. This may take a few seconds to a minute.

Enter the onion address into the address bar and press Enter. Tor Browser will route your request through multiple relays and connect to the site. The connection is encrypted end-to-end, meaning no relay operator can see the content of your traffic.

For added security, consider running Tor Browser inside a virtual machine or a dedicated operating system like Tails or Whonix. These systems are designed to prevent accidental deanonymization and to leave no trace of your activity on your main computer. If you are accessing tor sites from a country where Tor use is monitored or illegal, using a VPN before connecting to Tor can add a layer of protection, though this is a complex topic with trade-offs that depend on your threat model.

The most dangerous mistake is maximizing your Tor Browser window. Browser fingerprinting is a technique that identifies users based on their screen resolution, installed fonts, and other settings. If your window is maximized, your fingerprint is more unique and easier to track. Keep your Tor Browser window at a standard size, like 1000x700 pixels.

Another mistake is visiting tor sites over an insecure connection. Always check that the address bar shows a lock icon and that the URL begins with https://, not http://. An unencrypted tor site is still routed through Tor, but the content is not encrypted between your browser and the site, making it vulnerable to eavesdropping by the site operator.

Do not disable Tor Browser's security settings or install extensions. Extensions can leak your identity or compromise your anonymity. If a tor site does not work in Tor Browser's default configuration, it is either misconfigured or intentionally hostile.

Do not reuse usernames, passwords, or email addresses across tor sites. If one site is compromised, attackers can use your credentials to access other sites. Use a password manager to generate unique, strong passwords for each site.

Finally, do not assume that Tor makes you completely anonymous. Tor protects your IP address and location, but it does not protect you from your own behavior. If you post personal information, use a recognizable username, or engage in activities that reveal your identity, you can be deanonymized. Treat tor sites like you would treat any public forum: assume nothing you post is truly private.

The best way to stay safe is to verify tor sites regularly and keep up with news about seizures, exit scams, and phishing campaigns. Check the Tor Project's official channels, security blogs, and community forums for updates on which sites are still operational and which have been compromised.

When you find a tor site you want to use, bookmark the onion address in Tor Browser. Do not copy it to a text file or email it to yourself, as this creates a record that could be recovered later. If you need to share an onion address with someone else, use a secure messaging app and verify it verbally if possible.

If a tor site you use suddenly goes offline or changes its appearance, assume it has been seized or replaced. Do not log in or enter any information. Instead, search for official announcements from the site operator to confirm its status.

Your next step is to download Tor Browser from the official Tor Project website, verify the PGP signature of the download, and install it on a computer or virtual machine. Once you have Tor Browser running, practice visiting a few well-known tor sites like the official Tor Project onion mirror or ProPublica's onion site. These sites are legitimate and will help you get comfortable with the process before you venture into less familiar territory.