If you’ve spent any time reading about privacy or the “dark web,” you’ve probably seen addresses that end in .onion instead of the usual .com or .org. These aren’t normal domain names — they’re a special address format that only works inside the Tor network, and understanding how they’re built explains a lot about why Tor is considered safer for certain kinds of communication.
Where a .onion address comes from
A modern .onion address is a long string of 56 random-looking letters and numbers, generated directly from a cryptographic key pair. When someone sets up an onion service, their software creates this key pair automatically, and the address is derived mathematically from the public key. There’s no central registrar, no company you pay, and no way to reserve a short, memorable name — the address is simply too long and too random for that.
Why that matters for security
Because the address is generated from a cryptographic key, connecting to it does two things a normal web address can’t guarantee: it proves you’re talking to the server that actually holds the matching private key, and it means the connection is encrypted end-to-end through the Tor network, on top of any HTTPS the site itself uses.
The tradeoff is usability. Since addresses are random strings, nobody can type one from memory, and a single mistyped or mistakenly copied character sends you to a completely different — and possibly malicious — address. That’s exactly why we don’t publish raw .onion addresses on this site: the safest way to reach one is to copy it directly from the organization’s own official, verified source.
The old vs. new address format
Older Tor services used shorter, 16-character addresses (Tor’s “v2” format), which have since been phased out and retired for security reasons. Every legitimate onion service today should be using the newer, longer “v3” format described above. If you ever see a 16-character .onion address being promoted as current, treat that as a red flag.
