What Does 'Onion Sites' Mean?
It sounds like a joke about secrecy and layers. It's actually a literal, accurate description of how the encryption and the address itself are constructed.
'Onion sites' refers to websites hosted as Tor hidden services, reachable only through the Tor network at a special .onion address. The name comes from 'onion routing,' the underlying technique where your connection data is wrapped in multiple layers of encryption — like the layers of an onion — with each layer only removable by one relay in the chain, so no single relay ever sees the complete picture of who you are and where you're going.
Most tech naming is arbitrary — nobody asks why a search engine is called 'Google.' The word 'onion' in 'onion site' is a rare exception: it's actually describing the mechanism.
Peel back the metaphor and you find the real architecture sitting right underneath it, exactly where the name promised it would be.
TL;DR
Quick answer
'Onion sites' refers to Tor hidden services reachable via a .onion address. The term comes from 'onion routing,' the technique that wraps data in successive layers of encryption, one per network relay, so no single relay sees the complete picture of sender and destination.
The term explained
A metaphor that's also a literal engineering description
The word 'onion' in 'onion site' traces directly back to 'onion routing,' the core technique behind Tor. When your device sends a request through the Tor network, that data gets wrapped in multiple, successive layers of encryption — one layer for each relay the data will pass through on its way to its destination.
Each relay in the chain can only peel away exactly one layer, revealing just enough information to know where to forward the data next, without ever seeing the full original request or the final destination. It's a genuinely apt metaphor: like peeling an onion, each layer removed reveals another layer underneath, not the core all at once.
'Onion sites' specifically refers to websites (technically called Tor hidden services) built to be reached this way, using a special .onion address rather than a normal web domain — addresses that are only resolvable through Tor itself, not through regular browsers or the standard domain name system.
What the term is actually describing
- The layered encryption technique ('onion routing') that protects data as it travels through Tor's network
- The specific address format (.onion) used to reach hidden services on that network
- The dual anonymity these sites can provide — hiding both visitor and, for the site's operators, host location
- A literal, technically accurate metaphor, unusual among tech terminology for actually describing its own mechanism
The strange part: the metaphor is unusually precise for tech terminology
The original onion routing research papers from the mid-1990s used the layered-encryption metaphor explicitly and deliberately in their technical descriptions, not just as later marketing.
Most technology names are arbitrary branding — nothing about the word 'Bluetooth' describes wireless signal protocols. 'Onion routing,' by contrast, is describing its actual layered-encryption architecture directly, making it a rare case where the metaphor and the mechanism are genuinely the same thing.
It's worth appreciating when a technical name actually teaches you something true about how the underlying system works, rather than just being a memorable brand.
The 'onion' in practice, step by step
What actually happens to your data as it travels through the network.
Your Tor client selects a path of three relays
Typically an entry relay, a middle relay, and an exit relay, chosen somewhat randomly for each new connection.
Your data is encrypted in layers, one per relay
The outermost layer is meant for the entry relay, the next layer for the middle relay, and the innermost for the exit relay.
Like nesting a letter inside envelope after envelope, each addressed to a different intermediary who only opens their own envelope.
Each relay peels off one layer
The entry relay removes the outer layer, revealing only where to send the data next (the middle relay), without seeing the final destination.
The exit relay reveals the final destination
Only the last relay in the chain knows where the data is actually headed, without knowing who originally sent it.
Misconception
'Onion site' just means any suspicious or illegal-feeling website.
Reality
It's a specific technical term for a Tor hidden service reachable at a .onion address — a category that includes legitimate news organizations, whistleblower platforms, and privacy forums, alongside illegal marketplaces. The term describes the hosting technology, not the legality or nature of the content.
.onion is an officially recognized special-use domain, even though it's not part of regular DNS
In 2015, the Internet Engineering Task Force formally recognized .onion as a 'special-use domain' in an official internet standards document (RFC 7686), acknowledging its unique role without adding it to the standard domain name system.
It shows that .onion occupies a genuinely unusual, hybrid status — recognized and respected by internet standards bodies, while remaining deliberately outside the regular DNS infrastructure that governs most of the web.
So why do modern .onion addresses look like such long, random strings?
Older .onion addresses were shorter — why did they get so much longer over time?Newer onion services use a more advanced cryptographic system (based on Ed25519 keys) that produces longer, 56-character addresses, offering significantly stronger security than the older, shorter address format, which had known cryptographic weaknesses that made it more vulnerable over time.
A vegetable became one of the most precise terms in cryptography
Most cryptographic and networking terminology reaches for abstract, technical-sounding words. 'Onion routing' reached for a kitchen vegetable instead — and ended up with one of the more genuinely instructive metaphors in the entire field, precisely because it wasn't trying to sound impressive.
What this says about how technical language shapes public understanding
A good metaphor can either clarify or obscure the thing it names. 'Onion site' happens to do both at once for different audiences: for people who understand the layered-encryption technique, it's a precise, useful description; for the general public, the word's association with secrecy and 'dark web' menace has arguably done more to shape (and distort) public perception than the actual technical mechanism ever has.
Questions people ask
If this got you curious
How do dark web crawlers find onion sites if there's no DNS?
The direct follow-up: how these addresses actually get discovered
Is Tor the dark web?
Clears up a commonly confused related distinction
What happens if you accidentally click a dark web link?
What actually occurs when one of these addresses gets clicked
What Browser Does the CIA Use?
A real-world example of a mainstream institution running an onion site
Is Tor Browser safe on mobile?
How this same technology works on a phone
The vegetable metaphor held up because it was never just a metaphor
Most brand names are chosen to sound clever. 'Onion routing' was chosen because it was accurate — layer after layer, each one only revealing the next, exactly the way a real onion peels. Rare is the piece of tech terminology that survives this much scrutiny and turns out to still be telling the truth.
You now know
- 'Onion sites' refers to Tor hidden services, reachable at a special .onion address
- The name comes from 'onion routing,' the layered-encryption technique underlying Tor's network
- Each relay in the Tor network only removes one encryption layer, never seeing the full picture
- The term describes hosting technology, not content — legitimate and illegal sites both use .onion addresses
Safety note
Educational, not operational
This guide is educational. It does not provide instructions for illegal activity, evading law enforcement, buying prohibited goods, or attacking systems. Laws and risks vary by country, so stay within your local rules and avoid interacting with unknown services.
Common myth
Myth vs reality
'Onion site' just means a suspicious or illegal website.
It's a technical term for hosting technology, used by both legitimate and illegal sites.
FAQs
Questions people ask
Sources
Further reading
- RFC 7686: The '.onion' Special-Use Domain NameInternet Engineering Task Force
- Tor Project: Onion ServicesThe Tor Project
Glossary
Terms in this guide
Continue learning