Onion Sites on the Dark Web: Complete Directory and Technical Guide

Onion sites are web services hosted on the Tor network and identified by .onion domain names. Unlike standard websites, onion sites do not rely on traditional DNS or centralized infrastructure. Instead, they use Tor's decentralized routing protocol to establish hidden services that can only be accessed through the Tor browser.

When you connect to an onion site, your traffic is encrypted and routed through a series of Tor relays. The site itself remains hidden behind multiple layers of encryption, meaning neither the user nor the site operator can easily identify each other's real IP address. This mutual anonymity is the core technical feature that distinguishes onion services from conventional websites.

Onion addresses are long alphanumeric strings, typically 56 characters in v3 format (the current standard), followed by .onion. These addresses are generated cryptographically by the site operator and cannot be easily guessed or spoofed. The address itself serves as both the location and a form of authentication for the service.

Tor uses a three-layer relay system to route traffic. When you access an onion site, your connection passes through an entry relay, a middle relay, and an exit relay. For onion services specifically, the connection terminates at the hidden service itself, meaning no exit relay is needed—the entire path remains within the Tor network.

Onion addresses are derived from the site operator's public key. This cryptographic binding ensures that only the holder of the corresponding private key can operate that .onion address. If an address is compromised or the private key is lost, the service cannot be migrated to a new address without losing the original identity.

The Tor network maintains a distributed directory of onion services. When you request an onion address, your Tor client queries this directory to locate the service's introduction points and establish a connection. This process happens transparently within the Tor browser and does not expose your query to external observers.

The Tor browser is the primary tool for accessing onion sites safely. It bundles Tor, Firefox, and security-focused extensions into a single package designed to prevent fingerprinting and traffic leaks.

Steps to install and configure Tor browser:

1. Download the Tor browser only from the official Tor project website (verify the domain carefully to avoid phishing).
2. Verify the GPG signature of the installer using the official public key provided by the Tor project.
3. Install the browser in a dedicated directory and do not modify its settings unless you understand the security implications.
4. Launch the browser and allow it to connect to the Tor network before attempting to access any onion site.
5. Keep the browser updated to the latest version, as security patches are released regularly.
6. Do not install additional browser extensions beyond those included by default.
7. Disable JavaScript in the security settings if you are accessing sensitive onion services (this reduces attack surface but may break some sites).

Common mistakes include using Tor browser on the same system as other browsers without isolation, connecting to VPN before Tor (which can leak metadata), and accessing onion sites while logged into personal accounts that identify you offline.

Phishing clones are fraudulent copies of legitimate onion sites designed to steal credentials, private keys, or cryptocurrency. Because onion addresses are long and difficult to remember, users often rely on bookmarks or search results, making them vulnerable to misdirection.

Methods to verify an authentic onion address:

1. Check the official website or social media account of the service for the correct .onion address.
2. Verify PGP signatures on announcements using the service operator's public key (obtain the key from multiple independent sources).
3. Compare the onion address character-by-character with verified sources; even a single character difference indicates a different service.
4. Look for HTTPS certificates on onion sites (self-signed certificates are normal and acceptable).
5. Check if the site uses v3 addresses (56 characters); older v2 addresses (16 characters) are deprecated and should be avoided.
6. Review the site's security practices: legitimate services often publish their PGP keys, security policies, and contact information.

Phishing clones often appear identical to the original but may have subtle differences in layout, missing security features, or requests for information the legitimate service would never ask for. If you are unsure, do not enter sensitive information and verify the address through an independent channel.

Tor has evolved through multiple onion address formats. Version 2 addresses (v2) were 16 characters long and used RSA-1024 encryption. These addresses are now deprecated due to cryptographic weaknesses and are no longer supported by current Tor versions.

Version 3 addresses (v3) are the current standard and use 56 characters with Ed25519 elliptic-curve cryptography. V3 addresses provide stronger security, better resistance to brute-force attacks, and improved privacy properties. All new onion services should use v3 addresses.

When searching for onion sites or consulting onion catalogs and indexes, prioritize v3 addresses. If you encounter a v2 address, verify whether the service has migrated to v3 and use the new address instead. Some legacy services may still operate v2 addresses, but these should be considered higher-risk from a cryptographic standpoint.

The address format itself does not indicate the content or legality of a service. Both legitimate privacy-focused services and illegal marketplaces use the same .onion infrastructure. The address format is purely technical and does not convey information about the site's purpose or trustworthiness.

Even with Tor, user behavior can leak identifying information. Understanding these mistakes helps you maintain anonymity when accessing onion sites.

Common anonymity compromises:

1. Resizing the browser window—sites can detect your screen resolution and use it to fingerprint you across sessions.
2. Enabling plugins or extensions not included with Tor browser—these may bypass Tor routing or execute code that reveals your IP.
3. Accessing onion sites while logged into personal accounts (email, social media, etc.)—this directly links your anonymous activity to your real identity.
4. Using the same username across multiple onion sites—this creates a trackable identity across services.
5. Maximizing the browser window—this increases fingerprinting risk by revealing your display resolution.
6. Connecting to VPN before Tor—this can leak metadata and defeats the purpose of Tor's routing.
7. Disabling Tor browser's security features to access sites that require JavaScript—this increases attack surface.
8. Torrenting over Tor—BitTorrent clients typically leak your real IP address even when Tor is enabled.

Maintain operational security by treating your Tor browser session as separate from your regular online identity. Do not mix activities that could link your anonymous and identified personas.

Tor, VPN, and I2P are three different approaches to network privacy, each with distinct technical properties and use cases.

Tor routes traffic through multiple relays operated by volunteers worldwide. It is designed for anonymity and can be used to access both standard websites and onion services. Tor's strength is its large network and resistance to traffic analysis, but it is slower than VPN due to multiple relay hops.

VPN encrypts traffic and routes it through a single provider's server. It hides your IP from websites but requires trust in the VPN operator. VPN is faster than Tor but does not provide the same level of anonymity if the VPN provider logs traffic or is compromised.

I2P (Invisible Internet Project) is a decentralized network designed for internal communication and file-sharing. It uses unidirectional tunnels and is optimized for latency-sensitive applications. I2P is less widely used than Tor and has a smaller user base, which can affect both anonymity and availability.

For accessing onion sites, Tor browser is the standard and recommended tool. VPN can be used in conjunction with Tor for additional privacy, but connecting VPN before Tor can leak metadata. I2P is not designed for accessing .onion addresses and should not be used as a replacement for Tor in this context.