An onion service is a website that lives inside the Tor network instead of on the ordinary internet. You reach it through Tor Browser, at an address ending .onion, and the connection never leaves the network at any point. The site doesn’t learn where you are. You don’t learn where the site is. Neither of you gets told.
This is where the site gets its name, and it works quite differently from what the introduction describes. There, your traffic crosses three relays and an exit. Here there’s no exit at all.
Not like an ordinary website
An ordinary site has an address in the world. It sits on a server, the server has an IP, and anyone can look up roughly where that is and who pays for it. Using Tor hides you from that server. The server itself is standing in the open. It can be visited, subpoenaed, blocked at a national firewall, or switched off by whoever hosts it.
An onion service has no address in that sense. Nothing to look up, nothing to block. It exists as a name inside the network and the only way to reach it is to be inside the network yourself.
So the protection runs both directions. Ordinary Tor browsing hides the visitor. An onion service hides the visitor and the site.
How the connection actually happens
Stay with the letters from the introduction. Same postal system, harder problem.
This time you want to meet someone who won’t give you their address, and you’re not giving them yours. Neither of you trusts the other that far, and you’re both right.
Here’s what they do. They pick a few noticeboards around town and pin a small notice on each: if you want me, leave word here. The noticeboards don’t know who put them up. Somebody just turned up with a drawing pin.
You want to get in touch. So you choose a café at random — somewhere they’ve never been — and agree a password with the owner. Then you leave word on one of the noticeboards saying which café, and what the password is.
They see it. They travel to the café by their own roundabout route, three intermediaries of their choosing. You travel by yours. You meet in the middle.
The noticeboard never learns where either of you lives. The café owner watches two people arrive and has no idea where either came from. And neither of you learns anything about the other’s route.
That’s an onion service. The noticeboards are introduction points, the café is a rendezvous point, and the notices live in a distributed directory any Tor client can consult. Since both sides build their own three-relay path to the meeting place, the full connection runs to six relays instead of three.
Why the addresses are like that
They’re ugly. Fifty-six characters of apparent noise, then .onion. Impossible to remember, tedious to type, and nobody has ever read one aloud without losing their place.
The ugliness is doing work. An onion address isn’t a name pointing at a key held somewhere else, the way a domain name is. The address is the key — derived straight from the service’s public key, which is why it has to be that long.
What follows from that is the interesting part. With an ordinary website you’re trusting a chain of certificate authorities to confirm the site is who it says. With an onion service there’s no authority anywhere. If you connect to an address and it works, you have mathematical certainty you reached the holder of that key. Nobody can impersonate it without the private half, and since nobody issues these addresses there’s nobody to deceive or compel into issuing a fake.
Onion addresses authenticate themselves. Domain names don’t.
If you’ve got an old bookmark that’s only sixteen characters, it’s the previous format and it stopped working in 2021. That change broke every published address at once, and the fallout is still going.
What they’re good for
- No exit relay. Traffic never rejoins the ordinary internet, so there’s no exit that could read an unencrypted connection — one of the real limits from what Tor hides and what it doesn’t, gone. Encrypted end to end by design, no certificate required.
- The site gets protection too. A publisher whose server can’t be found can’t easily be raided, sued into silence, or unplugged.
- Nothing to censor. No address for a firewall to block.
- Certainty about what you reached. The self-authenticating address removes an entire category of impersonation.
The Tor Project maintains a hub of documentation on all of this, including how to run one yourself.
Who runs them
News organisations run onion versions of their sites and of their confidential tip lines, so sources in hostile countries can make contact without the attempt showing up on their connection. Whistleblowing platforms are built on them almost exclusively.
Several large ordinary services keep onion versions going too — search engines, social platforms — mostly so people in censored regions can reach them at all. Some software projects distribute packages this way. Tor’s own sites have onion addresses.
And yes, illegal marketplaces use them. Real, well documented, genuinely part of the picture. Not the whole picture, and treating it as such tells you roughly as much about onion services as judging the postal system by what fits in a padded envelope.
What they don’t protect you from
Everything from the rest of the network still applies, plus one new thing.
The cryptography guarantees you reached the holder of a particular key. It says absolutely nothing about whether that person is honest. Anyone can run an onion service, including someone who wants your money or your details, and the maths works exactly as well for them as for anyone.
The new problem is that you can’t check these addresses by eye. Fifty-six random characters means you cannot tell a real one from a fake differing somewhere in the middle, and that gap gets exploited constantly. Generate an address matching at the front and back, stand up a copy of the target site, get it listed somewhere, wait. People who check by glancing at the first and last few characters are the ones it catches. It is the oldest fraud on the network and still the most productive.
The defence is to take addresses from a source you already trust, on the ordinary web, over https. A newspaper publishes its onion address on its own site. A software project publishes its own. Get it from there, not from a list somebody compiled. What happened to the Hidden Wiki is the long version of why those lists don’t work.
And if money’s involved, the same logic applies to paying: Bitcoin isn’t anonymous, and a permanent public ledger outlives whatever site persuaded you to use it.
Next
The introduction covers the three-relay routing this builds on. What Tor hides and what it doesn’t sets out the limits that still apply here. Installing Tor Browser if you haven’t got it.