What Are the Uses of Hidden Services on the Tor Network?
The New York Times runs one. So does a whistleblower drop box used by dozens of newsrooms. And, yes, so do some marketplaces you've heard of. Here's the full range.
A Tor hidden service (an .onion site) lets a website operate without revealing its server's physical location or IP address, while also letting visitors reach it without revealing theirs. Uses include whistleblower submission systems, censorship-resistant news mirrors, privacy-focused forums and email providers, secure internal tools for organizations, and — alongside those legitimate uses — some illicit marketplaces and forums.
Type an .onion address into the right browser, and one of the sites you might land on belongs to one of the world's most-read newspapers.
That's not a hypothetical — several major outlets deliberately maintain hidden-service mirrors of their entire websites, for reasons that have nothing to do with anything illicit.
TL;DR
Quick answer
Hidden services hide both server and visitor location. Legitimate uses (news mirrors, whistleblower tools) coexist with illicit marketplace use — the technology itself is dual-use.
What a hidden service actually is
A server that doesn't say where it lives
A regular website's server has a findable address — that's how your browser knows where to send a request. A Tor hidden service is different: it's built so that neither the visitor nor an outside observer can determine where the server physically is, using the same layered routing that anonymizes Tor users browsing the ordinary internet.
That single property — location secrecy for the server itself, not just the visitor — turns out to be useful for a much wider range of purposes than 'illegal marketplace.' Anyone who needs to run a service that can't easily be taken offline, blocked by a government firewall, or physically traced to a location has a reason to consider it.
In practice, that range spans from some of the most respected institutions in journalism to some of the least reputable corners of the internet — the same technology, aimed at very different goals.
The core use case categories
- Censorship circumvention — reaching readers in countries that block the ordinary site.
- Source protection — letting whistleblowers submit information with strong anonymity guarantees.
- Operational resilience — services that are hard to seize, block, or physically locate.
- Illicit marketplaces and forums — the use case most associated with the term, though not the only one.
Some of the world's biggest news organizations run .onion mirrors
Outlets including the BBC, The New York Times, and ProPublica have maintained official Tor hidden-service versions of their websites, specifically to reach readers in countries where the standard site is blocked or monitored.
It's the single fastest way to reframe what a hidden service is for — not a synonym for 'illegal marketplace,' but a piece of infrastructure that happens to be useful for anyone who needs to be reachable despite censorship, whoever they are.
There's dedicated open-source software just for anonymous tips
SecureDrop is an open-source whistleblower submission system, run as a Tor hidden service by dozens of news organizations, specifically designed so a source can submit documents without either party learning identifying information about the other.
It shows hidden services being used for a purpose most people would consider unambiguously positive — protecting sources who might otherwise face serious retaliation for coming forward.
The most quoted use case is a minority of actual traffic
Academic measurement studies of Tor hidden-service traffic have found that illicit marketplace and forum activity, while real and significant, represents a smaller share of overall hidden-service usage than casual conversation about 'the dark web' would suggest — with substantial traffic going to ordinary privacy tools, forums, and legitimate mirrors. The use case that dominates the public imagination isn't the one that dominates the actual traffic.
How a hidden service hides its own address
The mechanism is a clever extension of ordinary Tor routing.
The server picks introduction points
A hidden service connects to a handful of relay computers, called introduction points, without revealing its real location to them.
Like renting a set of anonymous mailboxes instead of publishing your home address.
The address is published to a directory
The server generates a unique .onion address and publishes it, along with the introduction points, to a distributed lookup system.
Similar to listing a PO box number in a directory, without listing the actual street address behind it.
A visitor builds a rendezvous circuit
The visitor's Tor client looks up the .onion address, then builds an anonymous path to a randomly chosen meeting point called a rendezvous point.
Both parties agree to meet at a neutral, unlisted location neither one owns.
Traffic flows through layered encryption
Once connected, both the visitor's and the server's identity remain hidden from each other and from the relays carrying the traffic.
Like a conversation relayed through several sealed envelopes, where no single carrier can read the whole message.
Misconception
Hidden services exist almost exclusively to host illegal marketplaces and forums.
Reality
Measurement research and public examples both show substantial legitimate use — news mirrors, whistleblower tools, privacy-focused email and forums, and internal organizational tools.
Misconception
Hidden services are too slow and unreliable for any serious real-world use.
Reality
While hidden services are generally slower than standard websites due to their layered routing, that trade-off hasn't stopped major, high-traffic organizations from running them successfully for years.
Misconception
A hidden service's server location can never be discovered under any circumstances.
Reality
While the design significantly raises the difficulty, security researchers and law enforcement have successfully identified hidden service operators in various documented cases, often through operational mistakes rather than breaking the underlying protocol.
If a website just wants privacy, why not use a VPN instead?
Couldn't a whistleblower drop box or censored newsroom just use a regular website behind a VPN?A VPN can hide a visitor's traffic from their local network, but it doesn't hide the destination server's location from anyone determined enough to look, nor does it help a website resist being blocked by a national firewall that can simply blacklist its IP address. Hidden services solve a different, harder problem: making the server itself resistant to being found or blocked in the first place.
How a nonprofit newsroom used this for censorship resistance
ProPublica became one of the first major U.S. news organizations to launch an official Tor hidden-service mirror of its site, explicitly citing the goal of remaining accessible to readers in countries actively censoring or monitoring standard internet access.
It's a clear, documented case of hidden-service technology being adopted for its stated purpose — resilience against blocking — by an organization with no connection to illicit activity whatsoever.
So — what are hidden services actually for?
A genuinely mixed-use technology. The engineering solves a real, legitimate problem — resisting censorship and protecting the location of both server and visitor — and that problem is shared by journalists, whistleblowers, privacy advocates, and, alongside them, some illicit marketplaces.
Judging the technology by its most notorious users, rather than its full range of use, is the most common distortion in how this topic gets discussed.
Why 'dual-use technology' is the right frame here
Hidden services belong to a long tradition of dual-use technology — tools built to solve a neutral engineering problem (in this case, location privacy) that end up serving very different purposes depending on who's using them. Encryption, anonymous remailers, even the postal system itself have all faced the same tension. The interesting question usually isn't 'is this technology good or bad,' but 'what does it enable for people who genuinely need it, and is that worth the uses we'd rather it didn't have.'
What to remember
- Hidden services hide the server's location, not just the visitor's — a distinct feature from ordinary Tor browsing.
- Legitimate uses include news mirrors, whistleblower drop boxes, and privacy-focused forums and email.
- Illicit marketplaces are a real but not exclusive use case.
- The technology is dual-use, much like encryption or anonymous mail systems.
Questions people ask
Where to go next
Deep web vs dark web: what's the real difference?
Clarify the terminology around hidden services.
What are Tor exit node risks?
A different part of the Tor network with different risks.
Timeline of major dark web marketplace takedowns
See the illicit-use side of hidden services in action.
Dark web movies based on true events
See hidden services dramatized on screen.
Free dark web scanner — is it legit?
A related, practical privacy question.
A tool, not a verdict
An .onion address tells you almost nothing about what's on the other end — it could be a newsroom, a whistleblower's inbox, or something you'd rather avoid. The technology is neutral; it's always worth asking who's actually using it, and why.
You now know
- Hidden services hide the server's physical location as well as the visitor's — a distinct capability from standard Tor browsing.
- Legitimate uses include censorship-resistant news mirrors and whistleblower submission tools like SecureDrop.
- Illicit marketplaces are a real but not exclusive use case of the same technology.
Safety note
Educational, not operational
This guide is educational. It does not provide instructions for illegal activity, evading law enforcement, buying prohibited goods, or attacking systems. Laws and risks vary by country, so stay within your local rules and avoid interacting with unknown services.
Common myth
Myth vs reality
Hidden services exist almost exclusively to host illegal marketplaces and forums.
Measurement research and public examples both show substantial legitimate use — news mirrors, whistleblower tools, privacy-focused email and forums, and internal organizational tools.
FAQs
Questions people ask
Sources
Further reading
- Tor Project documentation
- SecureDrop project documentation
- Academic Tor traffic measurement studies
Glossary
Terms in this guide
Continue learning