Best Onion Sites: Top Picks for 2026

What Counts as a "Best" Onion Site in 2026

A 'best' onion site meets five criteria: verifiable uptime history, clear legal status, transparent privacy policy, community trust, and practical utility. We exclude marketplaces and focus on legal services—search engines, whistleblowing platforms, secure email, and research archives—because they serve readers who want privacy without legal risk.

Uptime matters because if your computer hosting an onion service is not online all the time, the service itself will not be either, which leaks information to an observant adversary[7]. The most reliable sites are hosted by organisations with 24/7 infrastructure, such as DuckDuckGo (default in Tor Browser since version 6.0.6[2]) or ProPublica's SecureDrop (maintained by the Freedom of the Press Foundation[4]). Community-run forums and mirrors often have intermittent availability.

Legal status and privacy policy separate trustworthy services from risky ones. ProPublica's SecureDrop does not record your IP address, browser, or operating system[4]; DuckDuckGo's onion service returns the same clearnet results, changing only the network path[3]. Sites that do not publish a privacy policy or verification method should be treated as temporary.

Community trust comes from cross-reference: check the onion address against the operator's clearnet site, PGP-signed announcements, or the Freedom of the Press Foundation's SecureDrop directory[6]. Onion sites disappear frequently, so 'best' means resilient and mirrored—operators who back up the private key and maintain fallback addresses[8].

Consider your scenario. A journalist needing secure communication will choose ProPublica's SecureDrop and use public wifi, not a home connection[5]. A casual user wanting private search will choose DuckDuckGo's official v3 onion address, verifiable via DuckDuckGo's own site[1]. If you need to discover hidden services, use an onion directory; DuckDuckGo does not index .onion sites[3].

Onion Directories and Link Portals You Can Actually Trust

Onion directories aggregate .onion addresses in one place, but many are clones injecting phishing links or outdated mirrors. The Hidden Wiki is the oldest aggregator, yet it suffers from frequent vandalism—anyone can edit entries, so addresses change without notice. OnionLinks and Tor.Taxi maintain curated lists with less community editing, which reduces the risk of malicious entries but does not eliminate it.

To verify a link, cross-reference it in two separate directories. If both list the same 56-character v3 address for a service, and that address matches the operator's clearnet announcement or PGP-signed message, you have reasonable confidence. If addresses differ, treat both as suspect until you find official confirmation. Check for HTTPS certificates on the directory's clearnet mirror; directories without encryption are easier to tamper with in transit.

Cloned directories copy legitimate layouts but swap real addresses for phishing sites. Look for uptime badges or 'last checked' timestamps—directories that test links weekly are more reliable than static lists. Avoid any directory cluttered with market advertisements; heavy commercial promotion correlates with lower editorial standards and higher phishing risk, as discussed in Dark Web Markets 2026: What to Expect.

Verification Checklist

• Check PGP-signed URLs: Operators of high-trust services publish addresses signed with their public key.

• Look for uptime badges: Directories that ping services daily flag dead links faster.

• Cross-reference two directories: Matching addresses in OnionLinks and Tor.Taxi reduce the chance of a single compromised source.

• Avoid excessive market ads: Heavy promotion of marketplaces signals weak curation.

• Compare with official clearnet announcements: DuckDuckGo publishes its v3 address on its own site[1]; ProPublica lists its SecureDrop in the Freedom of the Press Foundation directory[6].

Directories are discovery tools, not guarantees. If the host computer is offline, the service is offline[7], so even a verified address may be unreachable. Use directories to build a shortlist, then verify each address independently before trusting it with sensitive activity.

Privacy-First Search Engines on the Dark Web

Finding content on Tor requires a search engine that respects your anonymity and filters harmful results. Four engines dominate: Ahmia, DuckDuckGo's .onion mirror, Torch, and Haystak. Each trades off index size, content filtering, and JavaScript requirements differently, so your choice depends on whether you prioritise safety or breadth.

Ahmia actively filters illegal content from its index, making it the safest option for general discovery. It crawls publicly listed onion services and removes results flagged as criminal marketplaces or abuse material. The trade-off: a smaller index than unfiltered competitors. Ahmia requires JavaScript, which increases your browser fingerprint but enables faster search and preview snippets.

DuckDuckGo's official v3 onion address does not index .onion sites at all[3]. It returns the same clearnet results as the regular DuckDuckGo service, changing only the network path your query travels[3]. You gain end-to-end encryption within the Tor network and avoid exit-node surveillance, but you will not discover hidden services. DuckDuckGo has been the Tor Browser default since version 6.0.6[2], so uptime and reliability are high. No JavaScript is required.

Torch claims the largest index of onion sites but does not filter illegal content. You will see marketplace links, fraud services, and other high-risk results mixed with legitimate sites. Torch does not require JavaScript and loads quickly, but the lack of moderation means you must manually verify every result before visiting. Use Torch only if you know exactly what you are searching for and can recognise phishing clones.

Haystak offers a middle ground: a large index with optional filtering. The free tier shows all results; the paid tier (accepted in cryptocurrency) removes illegal categories and adds advanced search operators. Haystak requires JavaScript for search suggestions but works without it for basic queries. Uptime is less consistent than DuckDuckGo or Ahmia, so expect occasional downtime.

Comparison Table

Critical difference: Ahmia removes illegal results automatically; Torch does not. If you are new to Tor and want to avoid accidental exposure to criminal content, start with Ahmia or DuckDuckGo. If you need to discover a specific onion service and accept the risk of unfiltered results, Torch's larger index may help—but cross-reference every address in a trusted directory before visiting.

For most readers, DuckDuckGo's .onion mirror offers the best balance: high uptime, no JavaScript requirement, and zero risk of stumbling onto illegal marketplaces. You will not discover hidden services this way, but you will search the clearnet privately. If you need onion-specific discovery, use Ahmia first; only move to Torch or Haystak if Ahmia's filtered index does not return what you need.

Secure Email and Communication Services

Email over .onion protects metadata that clearnet providers cannot hide—your IP address, the time you connect, and the relay path between you and the mail server. ProtonMail's onion service, Riseup, and OnionShare each address a different scenario: ProtonMail for encrypted correspondence with non-technical contacts, Riseup for activist coordination, and OnionShare for direct file transfer without a middleman.

ProtonMail's .onion mirror routes your connection through Tor before reaching ProtonMail's servers, so the provider never sees your real IP. You still get end-to-end PGP encryption for messages, but the onion layer adds transport anonymity. Create your account only over Tor—never link it to a phone number, recovery email, or payment method tied to your real identity. ProtonMail's free tier allows one address; paid plans (starting around £4/month) add custom domains and more storage. The service requires JavaScript for the web interface, which increases fingerprinting risk but is necessary for encryption key handling in the browser.

Riseup offers email and XMPP chat for activists, with no phone verification and an invite system to limit abuse. Riseup's .onion service is community-funded and does not log IP addresses. The trade-off: account creation requires an invite code from an existing user, so new users must find a trusted contact first. Riseup's operational security is strong—the collective publishes detailed hosting best practices[8]—but uptime depends on volunteer infrastructure. If the host computer is offline, the service is offline[7], so expect occasional unavailability during maintenance.

OnionShare is not an email provider but a file-transfer tool that creates a temporary .onion address on your own machine. You generate a link, send it to your recipient over a separate secure channel (such as Signal or encrypted email), and they download the file directly from your computer via Tor. No third-party server stores the file, so there is no central point of compromise. The downside: both sender and recipient must be online at the same time, and your machine's uptime determines availability[7]. OnionShare is free, open-source, and works on Windows, macOS, and Linux.

Setup Steps for Anonymous Email

1. Download Tor Browser and verify the signature before installing.

2. Create your account only over Tor: Navigate to the provider's .onion address (verify it on their clearnet site or via PGP-signed announcement).

3. Never link to real identity: Skip phone verification, use a pseudonym, and pay with cryptocurrency if the service requires payment.

4. Generate a PGP key pair using GnuPG or Mailvelope, and upload your public key to the provider's key directory.

5. Test encryption: Send a test message to yourself, decrypt it locally, and confirm the provider cannot read the content.

Conditional Scenario

An activist in a censored region needs to send encrypted documents to a journalist abroad. Riseup's .onion email service bypasses local internet filtering because the connection never leaves the Tor network until it reaches Riseup's servers. The activist generates a PGP key pair, encrypts the documents locally, and attaches them to an email sent over Riseup's onion address. The journalist decrypts the files with their private key. Even if the email provider is compromised, the encrypted attachment remains unreadable. The Freedom of the Press Foundation advises against using a home or office connection for such submissions and recommends public wifi or the Tails operating system for additional safety[5].

Limitations: Email over .onion does not guarantee the recipient's security. If your contact uses a clearnet provider that logs metadata or does not support PGP, your message leaves a trail on their side. Onion services also depend on the host's uptime[7] and proper key management—if you lose your private key or it becomes readable by others on the system, your encryption fails[8]. For highest-risk scenarios, combine onion email with Tails, PGP, and a pre-arranged communication protocol that limits exposure if one channel is compromised.

News, Journalism, and Whistleblowing Platforms

Reading independent journalism over Tor protects your browsing history from your internet provider and local network. Submitting documents to a news organisation via SecureDrop adds a second layer: the publication never learns your IP address or device fingerprint, so even a court order cannot reveal your identity from server logs.

The Guardian, The New York Times, and ProPublica each run SecureDrop instances reachable only via .onion addresses. ProPublica's SecureDrop is at 33xu4yhum2eiisxm6fntaslayop76fvaqgt3ak5dakdm3t7cub25cead.onion, as recorded in the Freedom of the Press Foundation's official directory[6]. SecureDrop does not record the source's IP address, browser type, or operating system[4]. The system was originally developed for The New Yorker by Kevin Poulsen and Aaron Swartz and is now maintained by the Freedom of the Press Foundation[4].

How SecureDrop works: You navigate to the publication's .onion address in Tor Browser, upload documents or write a message, and receive a randomly generated codename. The journalist retrieves submissions on an air-gapped workstation, replies via the codename, and you check back later for responses. No account registration or email is required, so there is no persistent identifier linking submissions.

BBC's Tor mirror delivers the same news articles as the clearnet site but routes your connection through the Tor network, hiding your IP from the BBC and exit nodes. Archive.today's .onion service lets you save snapshots of web pages anonymously, useful for preserving evidence or bypassing paywalls without leaving a trace on the archive's clearnet logs.

Verification is critical: Never trust a SecureDrop address from a third-party list. Check the publication's official clearnet website for their .onion address, ideally in a PGP-signed announcement or a dedicated 'Tips' page. The Freedom of the Press Foundation maintains a directory of verified SecureDrop instances[6], but always cross-reference with the newsroom's own site.

Legal distinction: Reading news over Tor is legal in the UK and most jurisdictions. Submitting to SecureDrop is protected by press-freedom laws in some countries, but not all. The Freedom of the Press Foundation advises against using a home or office connection for submissions and recommends public wifi or the Tails operating system for additional safety[5]. If the host computer is offline, the service is offline[7], so expect occasional unavailability during maintenance or server updates.

Use SecureDrop when the risk of exposure outweighs the inconvenience of a multi-step process. For routine news reading, the BBC's Tor mirror offers simpler access without the operational security overhead of a whistleblowing platform.

Libraries, Archives, and Research Resources

Academic databases and digital libraries over Tor give you access to research that may be paywalled, censored, or unavailable in your country. The Internet Archive's .onion mirror, Library Genesis, and Sci-Hub each serve a different need: the Archive for historical texts and web snapshots, LibGen for textbooks and monographs, and Sci-Hub for journal articles behind publisher paywalls.

The Internet Archive's .onion service mirrors the clearnet site's full collection—books, audio, video, and the Wayback Machine—without logging your IP address. You can search for out-of-print books, download public-domain texts, or retrieve archived versions of websites that have since disappeared. The Archive does not host pirated content; everything in its lending library follows controlled digital lending rules or is already in the public domain. Uptime matches the clearnet site, and no JavaScript is required for basic browsing.

Library Genesis and Sci-Hub operate differently: both provide access to copyrighted academic materials without publisher authorisation. LibGen hosts millions of textbooks, research papers, and fiction titles uploaded by users; Sci-Hub bypasses journal paywalls by fetching papers from institutional subscriptions. Researchers use these services when their institution cannot afford expensive subscriptions or when a paper is not available through legal channels. Accessing pirated content may violate copyright law in the UK and many other jurisdictions, even if the material is used for personal study. The legal risk falls on the user, not just the site operator.

Conditional scenario: A postgraduate student in a country with restricted internet needs a recent journal article for their thesis. Their university library does not subscribe to the publisher, and purchasing a single article costs £30. The student connects via Tor, navigates to Sci-Hub's .onion mirror, enters the article's DOI, and downloads a PDF. The connection never leaves the Tor network, so the student's internet provider and local authorities do not see the request. The copyright holder, however, still considers this unauthorised distribution, and the student assumes the legal risk of that access.

Limitations: Onion library mirrors depend on the host's uptime—if the server is offline, the service is offline[7]. LibGen and Sci-Hub addresses change frequently due to legal pressure, so verify the current .onion address from a trusted Tor directory before each session. The Internet Archive's mirror is stable and legal; LibGen and Sci-Hub carry copyright risk that varies by jurisdiction. Use these tools when the alternative is no access at all, and understand that 'no logs' does not mean 'no legal consequences' if your local law prohibits circumventing paywalls.

Forums and Communities Worth Your Time

Discussion forums on Tor help you learn operational security, troubleshoot technical issues, and stay current on service changes without revealing your identity. A trustworthy forum has transparent moderation, a documented history, and no financial incentive to push you toward scams. The three most reliable communities are Dread, r/onions accessed via Tor, and Envoy.

Dread is a Reddit-style forum built for Tor, covering privacy tools, OpSec guides, and service reviews. Moderators enforce strict rules against market promotion and referral spam, and the site has operated continuously since 2018. You do not need an email address to register, and all traffic stays within the Tor network. Dread's longevity and public moderation logs make it the most established forum for privacy-focused users. The trade-off: uptime depends on the host's infrastructure, so expect occasional downtime during DDoS mitigation or server maintenance[7].

r/onions via Tor gives you access to Reddit's onion-services subreddit without leaving the Tor network. The community shares verified .onion addresses, warns about scams, and discusses Tor Browser updates. Moderation is public and tied to Reddit's site-wide rules, so aggressive referral links and market promotion are removed quickly. You need a Reddit account, but you can create one over Tor using a pseudonym and no email verification.

Envoy is a smaller forum focused on operational security and privacy research. The community is invite-only, which limits spam but also makes initial access harder. Envoy's moderators publish a public log of bans and rule changes, and the forum does not allow market links or cryptocurrency solicitation.

Red Flags That Signal a Scam Forum

• Moderators asking for cryptocurrency to 'verify' your account or unlock sections.

• Aggressive referral links in pinned threads or user signatures, especially to markets or wallet services.

• No public moderation log: trustworthy forums document bans, rule changes, and admin actions so users can verify accountability.

• Newly registered domains with no archive history: scam forums appear after a market exit scam, harvest user credentials, and disappear within weeks.

Forums that exist solely to scam newcomers often pose as 'official' directories or 'verified' market lists. If a forum's only purpose is to funnel you toward a single market or phishing site, treat every link as hostile. Cross-reference onion addresses with multiple sources—Dread, r/onions, and the service's own clearnet announcement—before visiting. For a broader checklist of what makes a dark web site trustworthy, see Best Dark Web Sites: A Comprehensive Overview.

Use forums to learn and verify, not to follow referral links blindly. A community that values your operational security will never ask for payment to participate or pressure you to visit external sites without independent verification.

Safety Rules That Prevent Most Onion Site Disasters

Most onion site disasters trace back to one mistake: clicking a link from an unverified directory and entering credentials without checking the address. A phishing site copies the layout of a legitimate service, changes one character in the .onion address, and waits for you to log in. Your username and password travel to the attacker's server, and you lose access to the real account before you notice the substitution.

Pre-session checklist prevents this:

1. Update Tor Browser to the latest version before each session—security patches close exploits that deanonymise users[10].

2. Set security level to Safest in Tor Browser's shield menu, which disables JavaScript and blocks most active content.

3. Verify the .onion address from at least two independent sources: the service's clearnet site (if it has one), a trusted forum like Dread or r/onions, and the Freedom of the Press Foundation's SecureDrop directory for whistleblowing platforms[6].

4. Check for HTTPS equivalent: legitimate onion services use HTTPS even though Tor already encrypts traffic, signalling proper server configuration.

5. Never reuse passwords across onion services—a compromised forum account should not unlock your email or market profile.

Disable JavaScript unless the service explicitly requires it and you trust the operator. JavaScript can fingerprint your browser, exploit unpatched vulnerabilities, and bypass Tor's anonymity protections. The Safest security level in Tor Browser blocks JavaScript by default; lowering it trades convenience for exposure.

Use Tails or a virtual machine for high-risk activities. Tails routes all connections through Tor, leaves no trace on the host computer, and resets to a clean state after each session. A VM isolates onion browsing from your main operating system, so malware from a downloaded file cannot access your personal files or clearnet accounts.

Avoid downloading files from onion sites whenever possible. PDFs, images, and executables can contain malware or metadata that leaks your real IP address when opened outside Tor Browser. If you must download, open files only inside Tails or a disposable VM, and never on your main system.

The most common failure is trusting a directory without cross-referencing. One phishing link costs you the account; one malicious download can deanonymise your entire session. Verify every address, disable JavaScript, and treat every file as hostile until proven otherwise.

How to Verify an Onion Site Before You Use It

Verification fails often—that's the point. A phishing site that survives scrutiny is rare; most collapse when you check the address against two independent sources. The goal is not to trust every service you find, but to reject every service you cannot confirm.

Step-by-step verification:

1. Find the .onion address on the organisation's clearnet site. ProPublica publishes its SecureDrop address—33xu4yhum2eiisxm6fntaslayop76fvaqgt3ak5dakdm3t7cub25cead.onion—directly on its 'How to Send Us Files More Securely' page[6]. DuckDuckGo lists duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion on its own site[1]. If the service has no clearnet presence and no verifiable announcement, treat it as untrustworthy until proven otherwise.

2. Check for a signed canary or PGP key. Legitimate organisations publish a PGP-signed statement or warrant canary that confirms the current .onion address. The signature proves the message came from the organisation's key, not an impersonator. If you cannot verify the signature or the organisation does not publish one, the address remains unconfirmed.

3. Cross-reference with two independent directories. Compare the address you found with entries in the Freedom of the Press Foundation's SecureDrop directory[6], a trusted forum like Dread or r/onions, and the service's own clearnet announcement. If all three match, the address is likely legitimate. If one differs by a single character, you have found a phishing site.

4. Test with a low-stakes interaction first. Before submitting sensitive information, visit the service and perform a non-critical action: search DuckDuckGo for a generic term, browse ProPublica's public articles, or read a forum thread without logging in. If the site behaves as expected and the address matches your verified records, proceed. If anything feels inconsistent—broken links, missing content, unexpected login prompts—abandon the session and re-verify the address.

Conditional scenario: You want to verify ProPublica's SecureDrop before submitting a document that could identify a whistleblower. You visit ProPublica's clearnet site, copy the .onion address from the 'How to Send Us Files More Securely' page, and paste it into Tor Browser. You then check the Freedom of the Press Foundation's SecureDrop directory and confirm the address matches[6]. You search Dread for recent threads about ProPublica's SecureDrop and find no reports of downtime or compromise. Finally, you visit the .onion address, read the submission instructions, and close the browser without uploading anything. Only after all four steps confirm the same address do you return in a separate session—ideally from public wifi and using Tails[5]—to submit the document.

Verification fails when an address does not appear on the clearnet site, when directory listings conflict, or when no PGP signature exists to confirm authenticity. That failure protects you. A service you cannot verify is a service you should not use, no matter how legitimate it appears. The inconvenience of cross-referencing is the cost of avoiding phishing sites that harvest credentials and deanonymise users.

Who Each Site Suits

If you want private search without giving up familiar results, choose DuckDuckGo's onion service

You get search results comparable to a mainstream engine, but your queries stay inside the Tor network and DuckDuckGo does not store your search history. The onion address is published on DuckDuckGo's own clearnet site, so you can verify it before relying on it[1]. Choose this when you need everyday answers and want to avoid the tracking that comes with standard search engines.

If you need to submit sensitive documents to a news organization, choose ProPublica's SecureDrop onion

ProPublica publishes its SecureDrop address directly on its clearnet 'How to Send Us Files More Securely' page, and the same address appears in the Freedom of the Press Foundation's SecureDrop directory[6]. This double listing gives you a way to confirm the address is genuine before you upload anything. Choose this when the document could identify a whistleblower or expose misconduct, and use Tails or a disposable VM for the actual submission[5].

If you want to learn operational security and verify services before using them, choose Dread

Dread has operated since 2018, requires no email address to register, and its moderators publish logs of bans and rule changes[7]. The forum covers privacy tools, OpSec guides, and service reviews without pushing you toward markets. Choose this when you need to cross-reference an onion address or read what other users report about downtime and scams.

If you want a smaller, research-focused community, choose Envoy

Envoy focuses on operational security and privacy research, and its invite-only structure keeps spam low. Moderators publish a public log of bans and rule changes, and the forum does not allow market links or cryptocurrency solicitation. Choose this if you already have some Tor experience and want deeper technical discussion, but expect the invite requirement to slow down initial access.

If you want a Reddit-style feed of verified onion addresses and scam warnings, choose r/onions via Tor

The community shares verified .onion addresses, warns about phishing attempts, and discusses Tor Browser updates under Reddit's public moderation rules. You need a Reddit account, but you can create one over Tor with a pseudonym and no email verification. Choose this when you want a fast way to check whether a directory listing or service announcement is legitimate before you visit it.

What to Choose

For most readers, start with DuckDuckGo’s onion service. You get familiar search results, and the address is verifiable on DuckDuckGo’s own clearnet site[1]. Use it for everyday browsing when you want to avoid tracking without changing how you search.

Choose ProPublica’s SecureDrop onion only when you need to submit sensitive documents to a news organization. Its address appears both on ProPublica’s clearnet page and in the Freedom of the Press Foundation’s SecureDrop directory, so you can confirm it before uploading anything[6].

Choose Dread when you need to cross-reference an onion address or read reports about downtime and scams. The forum has operated since 2018 and does not require an email address to register[7].

Avoid any service you cannot verify from at least two independent sources. A single-character difference in an address usually means a phishing site.

If you are unsure which directory or forum to trust, see Best Dark Web Sites: A Comprehensive Overview for a broader comparison.

Before you commit to any site, write down the two sources you used to verify its address. If you cannot name both, do not use it.