What Are .Onion Sites, Or Tor Onion Sites?
'.onion' isn't a normal domain suffix — it's the tell that an address was generated mathematically, not registered.
'.onion' is a special-use domain suffix reserved exclusively for Tor hidden services — websites that exist only within the Tor network. Unlike a normal domain, a .onion address isn't registered with any company; it's mathematically generated from the site's own cryptographic key, which is what lets Tor verify you've reached the genuine site without needing a central authority to vouch for it.
Every normal website address ends in something familiar — .com, .org, .net — registered through a company, renewed every year, tied to a name someone picked.
A .onion address breaks that pattern completely: no registrar, no renewal, and a string of characters nobody actually chose.
TL;DR
Quick answer
A .onion address is a special-use domain suffix for Tor hidden services, mathematically generated from a site's Ed25519 cryptographic key rather than registered through a company. The current standard is the 56-character v3 format, replacing the deprecated, less secure v2 format.
The setup
An address that proves itself, instead of being vouched for
Normal domain names rely on a trust chain: a registrar sells you the name, a certificate authority can vouch for your site's identity, and DNS servers point browsers toward your actual server. A .onion address skips nearly all of that. It's derived directly from the site's own public cryptographic key, using the Ed25519 signature scheme.
That means the address itself functions as a built-in verification mechanism — when your Tor Browser connects to a .onion address, it can mathematically confirm you've reached the site whose key generated that exact address, without needing any registrar or certificate authority to confirm it along the way.
What makes the format different
- No registration process — the address is generated, not purchased or claimed.
- No central authority — verification happens through cryptography, not a trusted third party.
- No renewal — as long as the underlying key exists, the address remains valid.
The address is, in a very real sense, the site's password
This is what prevents casual impersonation: an attacker can't simply pick a similar-looking .onion address the way they might register a lookalike .com domain.
Because a .onion address is mathematically tied to a specific cryptographic key, generating a new one is trivial — but generating one that matches an existing, trusted address without possessing its private key is computationally infeasible.
It flips the usual domain-security model on its head — instead of trusting a company to police fake registrations, the address format itself makes convincing impersonation mathematically difficult.
From key to address
The steps behind how a .onion address comes into existence.
A hidden service generates a cryptographic key pair
Using the Ed25519 signature algorithm, producing a public and private key.
The public key is encoded into the address
The 56-character v3 .onion address is derived directly from that public key through a defined encoding process.
Tor verifies the connection cryptographically
When a visitor connects, Tor can confirm the site controls the private key matching the address, without any external registrar or certificate authority involved.
Why did Tor move away from the older, shorter addresses?
If the newer v3 addresses are so much longer and harder to remember, why did Tor bother replacing the shorter v2 format at all?Because the older v2 addresses relied on a weaker cryptographic scheme that researchers eventually showed could, with enough computing effort, be more easily targeted than initially assumed. The longer v3 format uses stronger, more modern cryptography specifically to close that gap — a case of security requirements outpacing the convenience of a shorter, more memorable address.
Some site operators spend real computing power trying to get a 'nicer' address
Because .onion addresses are derived from keys rather than chosen, operators wanting an address that starts with a specific recognizable pattern have to generate large numbers of key pairs and check each resulting address, a costly process sometimes called 'vanity address' generation.
It's a small but telling detail about how differently this system works from buying a normal domain — you can't just ask for the name you want, you have to computationally search for it.
The least memorable address format is also one of the most self-verifying
Normal domain names are easy to remember precisely because they're arbitrary labels layered on top of a separate trust system. .onion addresses are unmemorable because they skip that separate system entirely — the unreadability is a direct trade for not needing anyone else to vouch for you.
The 2021 deprecation of v2 addresses
The Tor Project formally phased out support for the older, shorter v2 .onion address format, requiring all hidden services to migrate to the longer, more secure v3 format.
It's a concrete illustration of the format evolving in response to real security research, not just a cosmetic update.
So, what is a .onion address, precisely?
A special-use address, mathematically generated from a site's cryptographic key, that lets Tor verify a connection without any registrar or central authority involved.
Not a domain name in the traditional sense — a self-verifying cryptographic identifier wearing a domain-shaped costume.
Trust, redesigned from the address up
The .onion format is a small but genuinely elegant example of a broader idea in cryptography: instead of relying on a trusted third party to vouch for identity, you can sometimes build the verification directly into the identifier itself. It's a pattern showing up increasingly across decentralized systems well beyond just Tor.
The short version
- .onion addresses are generated from a cryptographic key, not registered through a company.
- The format allows Tor to verify a connection without a central authority or certificate.
- The current standard is the 56-character v3 format; the older, weaker v2 format has been phased out.
- The unreadability of the address is a direct trade-off for skipping traditional domain trust infrastructure.
Questions people ask
Where to go next
What are onion sites or on the dark web?
The broader hidden-service concept this address format belongs to.
What are onion sites used for?
What people actually build using these addresses.
What is a bridge relay in Tor?
Another piece of Tor's infrastructure worth understanding alongside address formats.
Tor vs I2P vs Freenet, which is more anonymous?
How other anonymity networks handle addressing differently.
How to see the dark web
The practical side of actually using addresses like these.
Unmemorable on purpose
A .onion address isn't hard to remember by accident. It's hard to remember because remembering it was never the point — proving it was genuine, without anyone else's help, was.
You now know
- .onion addresses are generated from a cryptographic key, not registered through a company.
- The format lets Tor verify a connection without a central authority or certificate.
- The current standard is the 56-character v3 format, replacing the deprecated, weaker v2 format.
Safety note
Educational, not operational
This guide is educational. It does not provide instructions for illegal activity, evading law enforcement, buying prohibited goods, or attacking systems. Laws and risks vary by country, so stay within your local rules and avoid interacting with unknown services.
FAQs
Questions people ask
Sources
Further reading
- Tor Project: Onion Service Address v3 migration documentationTor Project
Glossary
Terms in this guide
Continue learning