Tor sites

Tor Sites: A Plain-English Glossary

A Tor site, also known as an onion site or hidden service, is a website that is accessible exclusively through the Tor network, using the unique .onion domain. These sites provide various services, including anonymous publishing, file sharing, chat, and SecureDrop submissions^[1]. The term "onion service" is now the preferred terminology, although "Tor site" and "hidden service" are often used interchangeably.

The dark web, a segment of the deep web, consists of content that is intentionally hidden and typically requires special software like Tor to access^[3]. Within the Tor network, traffic is routed through a series of relays, creating a circuit that obscures the user's real IP address. This process involves three relays, ensuring that the destination site only sees the exit relay's IP address^[4].

An important aspect of Tor sites is the .onion address format. Modern v3 onion addresses contain 56 characters followed by the .onion suffix, which is a significant upgrade from the older 16-character v2 addresses that are no longer supported since 2021^[5]. Accessing these sites requires the Tor Browser, which is designed to maintain user anonymity while navigating through this hidden web space.

It is essential to understand that while Tor facilitates anonymity, it does not protect against the disclosure of personal information. Users should avoid logging into identifiable accounts or entering personal details, as this can compromise their anonymity^[6]. To ensure a secure experience, we recommend verifying the authenticity of onion addresses through the corresponding clearnet site before sharing any sensitive information, particularly when using services like SecureDrop^[2].

Surface Web, Deep Web, Dark Web, and Tor: What Is the Difference?

Understanding the distinctions between the surface web, deep web, dark web, and Tor is crucial for navigating the internet safely and effectively. We can summarise these differences in the following table:

The deep web encompasses a vast array of private resources like email inboxes and banking portals, which are not indexed by standard search engines. This segment of the internet is not inherently dangerous, as it primarily consists of ordinary private data. In contrast, the dark web is a smaller, intentionally concealed segment of the deep web, requiring special networks or software for access, such as Tor.

Tor itself is a network and browser ecosystem designed for anonymity and privacy, not a synonym for illegal activity. While it is often associated with the dark web, many legitimate services operate over Tor, including anonymous publishing, file sharing, and SecureDrop submissions^[1]. Users can access these services through .onion addresses, which are specific to the Tor network^[3].

It is essential to remember that while Tor enhances privacy, it does not prevent users from inadvertently disclosing personal information. Engaging with identifiable accounts or sharing personal details can still expose your identity^[6]. Therefore, using Tor responsibly involves understanding its capabilities and limitations, ensuring a secure and private browsing experience.

Legitimate Tor Sites by Category

We have compiled a reference table of legitimate Tor sites, organised by category. Each entry includes the owner, purpose, official verification source, exact onion address, and the last-checked date to ensure authenticity. All listed services have their .onion addresses confirmed on their respective official clearnet websites.

This table provides a quick reference to some of the most reputable services available on the Tor network. We recommend verifying the onion addresses through the respective clearnet sites before using these services, especially when submitting sensitive information via SecureDrop^[2].

How to Find and Verify Real .onion Addresses

Finding and verifying real .onion addresses requires caution, as many sources like search engines, link dumps, social posts, and "Hidden Wiki" clones can be unreliable. These platforms often lack the rigorous checks necessary to confirm the legitimacy of the addresses they provide. For example, some sites may present outdated v2 addresses, which have not been supported since 2021^[5]. Others may host phishing pages designed to mimic legitimate services, leading users to disclose sensitive information unknowingly.

To ensure you are accessing a genuine onion service, follow this verification workflow. Start by locating the organisation's official HTTPS domain on the clearnet. Compare the full 56-character v3 .onion address with the one published on their official site. If there is a discrepancy, do not proceed with any interactions. It is advisable to check multiple official references to confirm the address. For example, if a news organisation has a SecureDrop service, always compare the .onion address listed there with that on the news outlet's main website^[2]. Once confirmed, bookmark the verified address for future use to avoid falling victim to look-alike characters or typosquatting.

Typosquatting involves creating a domain name that closely resembles a legitimate one, often with minor alterations, which can mislead users. For instance, a malicious site might use "secure-drop.onion" instead of "securedrop.org.onion". Additionally, some phishing pages might employ look-alike characters, such as using "1" instead of "l", further complicating verification. By being vigilant and following these steps, we can significantly reduce the risk of accessing fraudulent onion services and protect our privacy online.

A Safety-First Checklist for Visiting Tor Sites

Engaging with Tor sites necessitates a proactive approach to safeguarding your identity and data. We recommend following this checklist to enhance your security before, during, and after visiting these unique online environments.

Before Visiting Tor Sites

1. Separate Your Identity: Use a dedicated identity for Tor browsing. Avoid logging into any accounts tied to your real name or personal details, as this can compromise your anonymity^[6].
2. Update Your Software: Ensure that your Tor Browser is up to date. Regular updates help protect against vulnerabilities, with the latest version released on September 29, 2026^[7].
3. Familiarise Yourself with HTTPS: While traffic between you and an onion service is encrypted, a valid HTTPS certificate can offer additional assurance about the site's authenticity^[8].

During Your Visit

1. Limit Scripts: Adjust your security settings in Tor Browser. For maximum protection, consider using the "Safest" security level, which disables JavaScript by default^[9]. This reduces the risk of exposure to malicious scripts.
2. Avoid Unknown Downloads: Do not download files from untrusted sources. Opening downloaded documents in external applications can inadvertently expose your real IP address^[10].
3. Check Login Domains: When required to log in, ensure the domain matches the verified onion address. If the address differs from the official source, refrain from entering any credentials.

After Visiting Tor Sites

1. Protect Personal Information: Never share personal details or cryptocurrency information after following an unverified link. This can lead to identity theft or financial loss^[6].
2. Clear Your Browser Data: Regularly clear your Tor Browser data to remove any potentially sensitive information or traces of your browsing session.
3. Review Security Practices: Continually educate yourself about best practices for using Tor. This includes understanding the risks of extensions and plugins, which can undermine your anonymity^[11].

Tor Browser is the standard client for accessing .onion services, designed specifically to maintain user privacy while navigating the dark web. By adhering to these safety measures, we can significantly enhance our security while exploring the vast resources available on Tor.

What Tor Can and Cannot Hide

Understanding what Tor can and cannot conceal is essential for maintaining privacy while browsing. When using Tor, Internet Service Providers (ISPs), local network administrators, and observers can see that a user is connected to the Tor network, but they cannot see the specific sites being visited. The destination onion service will only see the IP address of the last Tor relay, not the user's real IP address, thanks to the three-relay system that Tor employs^[4]. However, this does not guarantee complete anonymity.

IP address privacy is different from the anonymity of identity. While Tor masks your IP address, it does not protect against identity disclosure if you log into personal accounts or share identifiable information^[6]. For example, logging into an email account while using Tor can reveal your identity, as the service can track your login details. Furthermore, browser fingerprinting techniques can identify users based on their browser settings and installed plugins, potentially compromising anonymity^[11].

Common failures in operational security can also lead to identity exposure. Users should be cautious of malware, which can capture sensitive information, and document metadata, which may reveal personal details if files are shared^[10]. It is critical to avoid using BitTorrent software over Tor, as this can expose your real IP address through tracker requests^[10]. Moreover, opening downloaded files in external applications can fetch resources outside of Tor, revealing non-Tor IP addresses.

Law enforcement agencies, including the FBI, have demonstrated the ability to track activities on Tor. Notably, the FBI-led Operation RapTor resulted in numerous arrests and seizures related to dark web activities, indicating that Tor-related criminal activity can be investigated^[12]. While Tor offers a high level of privacy, it is not 100% untraceable, and users must remain vigilant about their actions online.

Do Onion Sites Need HTTPS, and Do You Need a VPN?

Onion service traffic is inherently encrypted through the Tor protocol, making HTTPS unnecessary for transport encryption. However, HTTPS can still provide familiar security features, such as certificate validation, which can help users confirm the authenticity of a site. A valid HTTPS certificate can offer additional assurance about the organization controlling the onion service, especially when dealing with sensitive interactions like those on SecureDrop platforms^[8].

When considering whether to use a VPN in conjunction with Tor, it’s important to understand the implications of each setup. Using Tor alone means that your traffic is routed through three Tor relays, effectively concealing your IP address from the destination site. However, your Internet Service Provider (ISP) can see that you are using Tor^[4]. On the other hand, using a VPN alone does not provide the same level of anonymity; while it can mask your IP address from websites, your traffic is still exposed to the VPN service provider.

Combining Tor with a VPN can add an extra layer of privacy, but it introduces additional trust in the VPN provider. If you choose this route, ensure that the VPN does not log your activities and has a proven track record of protecting user privacy. It’s essential to note that misconfigured VPNs can potentially compromise your anonymity or interfere with Tor’s functionality^[13]. Therefore, we advise against using a VPN with Tor unless you fully understand how to configure both correctly.

Using Tor over VPN is particularly useful in regions where Tor usage is monitored or restricted, providing an additional layer of obfuscation. Conversely, using a VPN over Tor can expose you to risks, as the VPN will see your traffic before it enters the Tor network, which could allow for malicious activity if the VPN provider is untrustworthy. Each setup has its pros and cons, and it is crucial to evaluate your privacy needs and the potential risks involved.

Are Tor Sites Legal? Risks, Red Flags, and Boundaries

Using Tor is legal in many jurisdictions, including the United States, where it remains a tool for privacy and anonymity. However, it is crucial to understand that while accessing the Tor network itself is legal, engaging in illegal activities, such as trafficking controlled substances or distributing abusive material, is still illegal, regardless of the platform^[14]. Laws, workplace policies, and network restrictions can vary, so we advise checking your local regulations before using Tor.

When navigating Tor sites, we recommend being vigilant about potential red flags that could indicate unsafe practices. For example, be cautious if a site requests that you disable your privacy protections or download executable files, as this could lead to malware infections. Additionally, if a site demands immediate cryptocurrency payments or provides unverifiable mirror links, these are significant warning signs. Always ensure that you are using verified onion addresses and be wary of sites that push for urgent actions without proper verification.

Examples of lawful uses of Tor include accessing SecureDrop for whistleblowing or browsing forums that discuss privacy and technology. However, we steer clear of directories that list illicit marketplaces or provide instructions for illegal activities. It is essential to focus on legitimate services and verify their authenticity before engaging with them. For instance, when using SecureDrop, always compare the .onion address with the official website to confirm its legitimacy^[2].

In summary, while accessing Tor sites is legal in many areas, it is vital to remain aware of the legal boundaries and the risks associated with using the network. By recognising red flags and adhering to best practices, we can help ensure a safer browsing experience on the Tor network.

Common Mistakes and Misconceptions

Treating the Deep Web, Dark Web, and Tor Sites as Synonyms

The deep web includes ordinary unindexed resources, while the dark web is its intentionally hidden segment requiring specialised access software^[3]. We use "Tor site" specifically for websites available through Tor under the ".onion" domain, rather than for every private or unindexed page^[1].

Assuming Every Onion Service Is a Website

An onion service may host a website, but it can also support chat, file sharing, anonymous publishing, SecureDrop submissions, or access to mainstream services^[1]. We recommend using "Tor site" for web pages and the broader term "onion service" when discussing other Tor-based functions.

Trusting an Onion-Link List Without Checking Its Source

Directory entries can become outdated, so a list without an official verification source or last-checked date should only be treated as a starting point. We advise finding the address through the organisation’s conventional website; Tor Browser may also show a purple ".onion available" prompt when that site publishes an Onion-Location header^[8].

Assuming a Correct-Looking Address Must Be Current

Current v3 onion addresses contain 56 letters and numbers before ".onion", whereas shorter v2 addresses have been unsupported since 2021 and no longer work^[5]. Matching the v3 format only shows that an address has the expected structure; it does not confirm who controls the service, so publisher verification remains necessary.

Treating Every Offline Service as Evidence of Fraud

An onion service may disappear because it is temporarily unavailable, discontinued, or replaced, and an outage alone does not establish the reason. We suggest checking the operator’s official conventional website for a status notice or replacement address rather than trying unverified mirrors from another directory.

Conclusions

• Start with Tor Browser and obtain each onion address from the service operator’s conventional website, not an anonymous directory.
• Verify the full address before entering information; SecureDrop listings and Tor Browser’s ".onion available" prompt can provide supporting evidence^[2][8].
• Keep lawful browsing separate from personal accounts, downloads, and file sharing that could disclose identity or device information^[6][10].
• Treat urgent payment demands, executable downloads, disabled security settings, and unofficial mirrors as reasons to leave immediately.
• Check local law and network policies before connecting, because Tor access does not make prohibited conduct legal^[14].

For practical guidance on checking address formats and sources, read Tor Link Onion next.