If you’ve spent any time reading about privacy or the “dark web,” you’ve probably seen addresses that end in .onion instead of the usual .com or .org. These aren’t normal domain names — they’re a special address format that only works inside the Tor network, and understanding how they’re built explains a lot about why Tor is considered safer for certain kinds of communication.
Where a .onion address comes from
A modern .onion address is a long string of 56 random-looking letters and numbers, generated directly from a cryptographic key pair. When someone sets up an onion service, their software creates this key pair automatically, and the address is derived mathematically from the public key. There’s no central registrar, no company you pay, and no way to reserve a short, memorable name — the address is simply too long and too random for that.
Why that matters for security
Because the address is generated from a cryptographic key, connecting to it does two things a normal web address can’t guarantee: it proves you’re talking to the server that actually holds the matching private key, and it means the connection is encrypted end-to-end through the Tor network, on top of any HTTPS the site itself uses.
The tradeoff is usability. Since addresses are random strings, nobody can type one from memory, and a single mistyped or mistakenly copied character sends you to a completely different — and possibly malicious — address. That’s exactly why we don’t publish raw .onion addresses on this site: the safest way to reach one is to copy it directly from the organization’s own official, verified source.
The old vs. new address format
Older Tor services used shorter, 16-character addresses (Tor’s “v2” format), which have since been phased out and retired for security reasons. Every legitimate onion service today should be using the newer, longer “v3” format described above. If you ever see a 16-character .onion address being promoted as current, treat that as a red flag.
Vanity Onion Addresses
Some organizations run software that generates thousands or millions of key pairs looking for one whose onion address happens to start with a recognizable word or phrase, a practice called vanity address generation. This doesn’t compromise security since the underlying key is still random, it just takes longer to find a match with a specific prefix. A vanity onion address can make a service easier to recognize, but it’s still worth verifying against the organization’s official announcement rather than assuming a memorable-looking prefix means it’s genuine.
How Onion Addresses Changed Over Time
Older onion addresses were 16 characters long and used a weaker cryptographic scheme; those have been phased out of the Tor network in favor of the current 56-character format, which is based on stronger elliptic-curve cryptography. If you ever see a 16-character .onion address referenced somewhere, treat it as outdated at best, since it likely no longer resolves and may have been deprecated for security reasons.
What This Means When You’re Verifying an Address
Because a valid onion address is mathematically tied to its key rather than assigned by any registrar, there’s no authority to check a name against the way you might look up a domain’s registration. That’s exactly why verification always comes back to the same principle on this site: confirm an onion address through the organization’s own official, already-trusted channel, since the address format itself offers no built-in way to prove who controls it.
