How Onion Services Work

Why a v3 Address Is So Long

Current onion addresses use version 3. After the literal .onion suffix, you see 56 characters from the Base32 alphabet — letters A–Z and digits 2–7. That string encodes a public key, a checksum, and a version byte. There is no registrar and no DNS lookup; the address is the service's cryptographic identity, as defined in the Tor Project's onion address encoding specification (checked October 7, 2026).

The special-use domain name .onion is reserved in RFC 7686 — it is not a normal public top-level domain you can buy. When you type an address into Tor Browser, the browser checks that the name matches the key material in the service descriptor. That protects against casual impersonation at the network layer. It says nothing about whether the operator is trustworthy.

How a Connection Gets Built

The full protocol has more moving parts than this summary, but the sequence below matches the Tor Project's overview of onion services (checked October 7, 2026). Think of it as a handoff through neutral meeting points rather than a direct phone call that exposes both phone numbers.

1. The service picks introduction points. These are Tor relays that agree to hold a small signed note saying "this onion identity wants introductions." The real server stays off the public internet; only those relays get a temporary role.
2. The service publishes a descriptor. It signs a descriptor listing its introduction points and encryption material, then uploads it to distributed hash directory (HSDir) relays. Clients learn where to fetch it from the onion address itself.
3. The client fetches and checks the descriptor. Tor Browser (or another Tor client) downloads the descriptor, verifies the signature against the public key embedded in the v3 address, and learns which introduction points are currently valid.
4. The client chooses a rendezvous point and sends a one-time secret. Through an introduction point, the client asks to meet at a specific rendezvous relay and passes a single-use cookie. The introduction point forwards the request without learning the client's IP or the server's location.
5. The service builds its own circuit to that rendezvous point. The server connects to the same rendezvous relay through its own Tor path and presents the cookie. Matching cookies prove both sides agreed on this meeting spot.
6. Traffic flows through Tor end to end. Application data moves over the rendezvous circuit. Because neither side used an exit relay toward the other, neither learns the other's network location from Tor routing alone.

Client
  │  (Tor circuit)
  ▼
Introduction point ── forwards one-time secret ──► Rendezvous point
                                                        ▲
                                                        │  (Tor circuit)
                                                   Onion service

What Onion Services Protect

• Server network location. Observers on the public internet cannot resolve a .onion name through ordinary DNS or trace it to a hosting provider IP the way they might with a clearnet site.
• Client location from the server's perspective. The service sees Tor traffic arriving at the rendezvous point, not the visitor's home IP.
• No exit node in the path. Traffic between client and onion service remains inside Tor, which removes a class of exit-node eavesdropping that affects normal Tor browsing.
• Address authentication. If you have the correct v3 address and the descriptor verifies, you know you reached the key holder for that name — not a random machine on the same hostname.

What They Do Not Protect

Onion routing solves a networking problem. It does not turn a careless application into a trustworthy one.

Application and browser bugs

JavaScript exploits, file uploads, and malformed content can still compromise the client. Tor Browser's security levels reduce attack surface but do not eliminate it.

Operator mistakes

Real names in support tickets, reused passwords, clearnet mirrors, or logs on the server can deanonymize operators regardless of onion routing.

Compromised keys

Anyone with the onion service private key can publish descriptors for that address. Key theft looks like the legitimate service until users notice inconsistent behavior or conflicting signed announcements.

Traffic correlation

A global observer who watches both edges of the Tor network might attempt timing or volume correlation. That is difficult but not mathematically impossible.

Off-network investigation

Payment records, shipping addresses, undercover buys, and informants operate outside Tor. Markets that run as onion services remain exposed to those vectors — a topic covered in our darknet market overview.

Onion Encryption and HTTPS

Tor already encrypts traffic in layers between relays, and onion-service connections add end-to-end encryption between client and service inside that framework. HTTPS on top adds a certificate layer that some operators use to align with browser expectations or to support tools that inspect TLS.

HTTP-only onion sites are not automatically equivalent to HTTP clearnet sites that traverse an exit node — the path and threat model differ. Still, skipping HTTPS removes certificate pinning habits some users rely on, and it does nothing to fix malicious content on the server. Treat transport encryption and site trust as separate questions.

Where Onion Services Show Up

Examples worth knowing about — none of which require darknet markets:

• SecureDrop and similar whistleblowing platforms use onion addresses so sources can reach newsrooms without exposing their IP to the recipient's web logs.
• News and civil-society sites publish onion mirrors so readers behind censorship can fetch the same articles when the clearnet domain is blocked.
• Remote administration teams hide backend location by exposing SSH or web admin panels only as onion services, reducing drive-by scanning of a public IP.

Darknet markets borrowed the same plumbing. Understanding the mechanics helps you evaluate mirror announcements and phishing clones — especially when a long address looks "official" at first glance.

Sources and Further Reading

• Tor Project — How do onion services work?
• Tor rendezvous specification — overview
• Tor rendezvous specification — onion address encoding
• RFC 7686 — The .onion special-use domain name
• Tor Project support — onion services in Tor Browser

Frequently Asked Questions