Hidden Onion Links: What They Are and How to Verify Them

An onion link is a .onion address that exists only within the Tor network. When you visit a .onion site using Tor Browser, your connection is routed through multiple relays, encrypting your traffic at each hop. The address itself is derived from the site's public key, which means the domain name is cryptographically tied to the server.

Unlike regular domain names registered through ICANN, .onion addresses are generated by the site operator and cannot be bought or transferred. This makes them harder to spoof, but phishing clones still exist because users often misremember or mistype addresses. The Tor Project introduced v3 onion addresses in 2019, which are longer and more secure than the older v2 format. A v3 address is 56 characters long and includes a checksum that helps detect typos.

Verifying an onion link before you visit it is critical because phishing clones are common. A scammer can create a fake marketplace or forum that looks identical to the real one, hoping users will log in or deposit funds without checking the address carefully.

The most reliable way to verify an address is to find it from an official, PGP-signed announcement. Many legitimate onion sites publish their addresses on their own platforms or through trusted intermediaries. If you find a link on Reddit, a forum post, or a random blog, cross-check it against the official source. Look for PGP signatures from the site operator; if the signature verifies, the address has not been tampered with. Never assume a link is real just because it appears in search results or on a directory.

Finding active onion links requires using tools designed for the Tor network. Tor search engines like Ahmia and Torch index .onion sites, but not all results are legitimate or safe. When searching, be specific about what you're looking for and avoid clicking on links from unfamiliar sources.

One approach is to use the Tor Project's official resources and documentation, which list verified projects and services. Security-focused communities sometimes maintain curated lists of onion addresses for news sites, privacy tools, and educational resources. If you're looking for a specific service, start with its official website or social media account outside Tor, where they may publish their .onion mirror. Avoid directories that claim to list "all" onion links; such comprehensive lists are often outdated or include inactive sites and honeypots.

According to Tor Project documentation and security-vendor incident reports, phishing clones of popular onion marketplaces and forums are a persistent threat. Scammers register similar-looking addresses or create mirrors that capture login credentials and cryptocurrency deposits. Users who do not verify addresses carefully are the primary targets.

One common tactic is to register a v2 address that resembles a well-known v3 address, exploiting the fact that many users still use older Tor Browser versions or are not familiar with the address format. Another is to create a fake mirror on the clearnet (regular internet) and advertise it as a "backup" or "mirror" of a popular onion site. Law-enforcement agencies have also deployed honeypot sites designed to look like illegal marketplaces in order to identify and track users. The lesson for ordinary users is simple: if you cannot verify an address from an official source, do not use it. This matters because losing access to your account or funds on a phishing clone is irreversible.

A real onion link has several characteristics that help you spot it. First, the address should be consistent across multiple official channels. If the site publishes its address on its own clearnet website, in PGP-signed announcements, and in community forums, and all three match, that is a strong signal.

Second, check the address format. V3 addresses are 56 characters long and use only lowercase letters and numbers. If an address is shorter or uses uppercase letters, it is either a v2 address (older, less secure) or a typo. Third, look for HTTPS-style security indicators within Tor Browser. When you visit a .onion site, Tor Browser shows a green onion icon if the connection is secure. Fourth, examine the site's behavior. Legitimate onion sites are often slow because they prioritize anonymity over speed. If a site loads instantly and asks for personal information or payment immediately, be skeptical.

Once you have verified an onion link, using it safely requires the same precautions as any online activity. Keep Tor Browser and your operating system updated, as security patches fix vulnerabilities that could compromise your anonymity. Use a dedicated device or virtual machine if you are accessing sensitive services.

Never maximize your browser window, as this can reveal your screen resolution and help de-anonymize you. Disable JavaScript in Tor Browser settings if you do not need it, as malicious scripts can leak your IP address. Do not open files downloaded from onion sites in your main operating system without scanning them first. If you are using an onion link to access a marketplace or forum, assume that law enforcement may be monitoring it. Use a strong, unique password and enable two-factor authentication if available. Consider using a separate cryptocurrency wallet for any transactions, and never reuse addresses across multiple sites.

SectorWiki maintains a curated list of verified onion links for news sites, privacy tools, and educational resources. Each link is checked for current status and PGP signatures are verified where available. The list is updated regularly, but onion sites can go offline or change addresses without notice.

Before visiting any link from our directory, read the description and check the date it was last verified. If a site has been offline for several months, it may no longer be active. If you find a broken link or suspect a clone, report it through the feedback section on this site. Your next step is to visit the Useful Resources page, where you will find links to the Tor Project's official directory, PGP key verification guides, and security advisories. Start there, bookmark the official sources, and use them as your primary reference for finding active onion links.