List of Onion Sites: Explore the Dark Web Safely

What Counts as an Onion Site (and What Doesn't)

An onion site uses the special-use top-level domain .onion and is reachable only through the Tor network[1]. You cannot type a .onion address into Chrome, Firefox or Safari and expect it to load; Tor Browser routes your connection through a chain of relays that decrypt layers of encryption—hence 'onion'—to reach the service without revealing your IP address or the server's location[2].

Not all dark-web content lives on onion sites. The term 'dark web' also covers I2P eepsites, Freenet, and invite-only forums on the clearnet that simply block search-engine crawlers. Conversely, many onion services are legal: news organisations, privacy-focused email providers, and academic archives run .onion mirrors to offer censorship-resistant access. BBC, ProPublica, and The Guardian each maintain official onion addresses for readers in countries that block their main domains.

How onion addresses are created

Each .onion address is derived from the service's ed25519 public key, a version field, and a checksum, then base32-encoded into 56 characters[6]. This cryptographic binding means Tor can verify you are connecting to the genuine service and that no relay is tampering with the stream[6]. Operators do not choose the address or register it with a central authority[2]; the string is generated when the service starts, which is why onion URLs look random.

Surface-web mirrors are not onion sites. Some directories link to clearnet pages about Tor services or to proxy gateways like onion.pet. Those pages are accessible without Tor Browser and do not carry the end-to-end encryption or location-hiding properties of a true onion service[2]. If the URL ends in .com, .net, or anything other than .onion, you are not on the Tor network.

Between 2021 and 2024 the number of onion services grew roughly 50 per cent—from around 500,000 to 800,000[7]—and estimated data throughput nearly tripled from 6 Gbit/s to 17 Gbit/s[7]. That growth reflects both legitimate use and the ease with which anyone can spin up a service; in 2024 the Tor Project released OnionSpray, a toolkit that converts existing websites into .onion domains without deep technical knowledge[8].

Onion does not mean illegal. Hosting or visiting a .onion site is lawful in the United Kingdom and most jurisdictions; what matters is the content and your actions. Buying controlled substances, sharing child-abuse material, or hiring criminal services remains illegal regardless of the network you use. An onion address simply hides where a server is, not what it does.

Before You Open Any Link: Minimum Safety Setup

You need three things in place before you visit a single onion address: the official Tor Browser, up-to-date software, and a clear understanding of what Tor does—and does not—protect.

Download Tor Browser only from the Tor Project. Go to https://download.torproject.org/ and verify the connection shows HTTPS in your address bar[3]. Third-party mirrors, app stores, and torrent sites have distributed modified copies that log traffic or inject malware. After downloading, check the OpenPGP signature file (.asc) with GnuPG to confirm the package was built by the Tor developers and has not been tampered with[4]. The Tor Project's support pages walk you through signature verification step by step.

Keep Tor Browser updated. The project releases patches for security flaws and network changes; running an outdated version exposes you to known exploits. Tor Browser checks for updates automatically when you launch it, but you should manually confirm you are on the latest release at least once a month.

Adjust your security level

Tor Browser ships with three security levels[5]:

• Standard – JavaScript enabled, all features work, highest risk of browser exploits.

• Safer – JavaScript disabled on non-HTTPS sites; some interactive elements break.

• Safest – JavaScript disabled by default on all sites; many onion services will appear broken or text-only.

For a first visit to an unknown onion site, set the level to Safer or Safest. You can lower it later for a specific service you trust. JavaScript exploits have been used in the past to unmask Tor users by forcing the browser to make a direct connection outside Tor, leaking your real IP address.

Enable HTTPS-Only Mode. Tor encrypts traffic between relays, but the final hop to a clearnet destination depends on that website using HTTPS[9]. Onion services are end-to-end encrypted by design[2], so HTTPS-Only Mode matters less for .onion addresses—but turn it on anyway to protect any accidental clearnet requests.

What a VPN does (and doesn't do)

A VPN hides your Tor usage from your internet provider, but it does not make you more anonymous on the Tor network itself. Your VPN provider can see you are connecting to Tor; the Tor entry relay cannot see your home IP, only the VPN's exit IP. Whether that trade-off suits you depends on whether you trust your ISP or your VPN more. A VPN is never a substitute for Tor Browser when visiting onion sites; without Tor, .onion addresses will not resolve.

The fastest way to deanonymize yourself

Logging into a personal account—email, social media, cloud storage—while using Tor Browser links your Tor session to your real identity. Even if the site is accessed over Tor, the moment you authenticate with credentials tied to your name, phone number, or payment method, the anonymity layer collapses. Reusing usernames, posting writing samples, or uploading photos with embedded metadata can correlate your Tor activity with your clearnet presence just as effectively.

Check once more: official Tor Browser from torproject.org, signature verified, security level raised, no personal logins. Only then open the first link.

How to Verify an Onion Link Is Genuine

A 56-character .onion address[2] looks random because it is derived from the service's public key[6], but that cryptographic binding only proves you are connecting to the server that generated the address—not that the server is the one you intended to reach. Phishing clones copy the layout, branding, and content of a legitimate onion service, change the address by one or two characters, and wait for users to log in or paste wallet keys. You need to cross-check every link against multiple independent sources before you trust it.

Start with the official clearnet site. Many organisations publish their .onion address on their main website: ProtonMail lists its onion domain at proton.me, the BBC posts its onion mirror on bbc.co.uk, and The Guardian includes its .onion URL in the site footer. If the service has a clearnet presence, that is your first reference point. Copy the address directly from the HTTPS page; do not retype it from memory or a screenshot.

Check PGP-signed directories. A handful of community-maintained lists—such as the one at dark.fail—are signed with an OpenPGP key, so you can verify the file has not been altered since the maintainer published it. Download the list, download the signature file, and use GnuPG to confirm the signature matches the maintainer's public key. Unsigned directories on forums, pastebin clones, or social media are trivial to fake.

Conditional scenario: verifying a market link from social media

Suppose you see a post on Reddit claiming to share the 'official' address for a marketplace. The URL ends in .onion, the post has upvotes, and a few comments say 'works for me'. Here is how to confirm it is not a phishing clone:

1. Do not click the link yet. Copy the address into a plain-text file.

2. Search the marketplace's name plus 'official onion' on a clearnet search engine. Look for the service's own clearnet landing page or a verified mirror list.

3. Compare the address character by character. Phishing clones often swap a single letter—'vww' instead of 'www', 'rn' instead of 'm'—hoping you will skim past the difference.

4. Check a second independent source: a PGP-signed directory, a long-running wiki that logs edit history, or the marketplace's presence on Dread (an onion-based Reddit alternative). If two sources that do not copy from each other list the same address, confidence rises.

5. If the addresses match, paste the link into Tor Browser. If they do not match or you find no corroborating source, assume the Reddit post is a phishing attempt.

Why phishing works. Users who skip verification and log straight in hand over their username, password, and two-factor backup codes to an attacker. The clone may even proxy your session to the real site so everything appears to function, while silently recording credentials and wallet addresses. By the time you notice funds missing, the phishing server has vanished.

Cross-checking takes two minutes. Recovering from a compromised account—or lost cryptocurrency—can take months or prove impossible. Treat every new onion link as hostile until you have confirmed it against at least two independent, authoritative sources.

Curated List: Safe and Legal Onion Sites by Category

Below is a vetted selection of onion services that are legal, publicly documented, and maintained by organisations with a clearnet reputation. Every address should still be cross-checked against the provider's official website or a PGP-signed directory before you visit; this list gives you a starting point, not a guarantee that the service is online or unchanged.

All traffic to these .onion addresses is end-to-end encrypted by the Tor network[2], so you do not need HTTPS to protect your connection—though many services offer it anyway. The addresses are long and random[2] because they derive from each service's public key[6]; you cannot guess or brute-force a legitimate URL, which is why copying the exact string matters.

Privacy tools and communication

ProtonMail onion – Proton's webmail interface is accessible over Tor, letting you read and send encrypted email without revealing your IP address to Proton's servers. The onion address is published on proton.me under the 'Tor' section of their support pages. ProtonMail requires JavaScript for the full interface, so you may need to lower Tor Browser's security level from Safest to Safer[5].

Riseup – A volunteer collective offering activist-focused email, chat, and file storage. Riseup's onion services are listed at riseup.net/en/security/network-security/tor, and the collective publishes a canary statement and PGP key so you can verify updates. Accounts require an invitation code from an existing user, which keeps the service small and trusted.

News outlets and investigative journalism

BBC News onion – The BBC runs an onion mirror of its international news site to serve readers in countries that block bbc.com. The address is posted on the main BBC website and has been publicly documented since 2019. Content is identical to the clearnet version; the onion mirror simply hides your location from network observers.

The Guardian onion – The Guardian's .onion address appears in the footer of theguardian.com and mirrors the full news archive. Journalists encourage sources to use the onion site when submitting tips through SecureDrop, the paper's whistleblower platform.

ProPublica onion – ProPublica, a non-profit investigative newsroom, maintains an onion mirror at an address published on propublica.org. The site includes the same long-form investigations and data projects available on the clearnet, with no paywall or registration.

Search engines and directories

DuckDuckGo onion – DuckDuckGo's onion address is listed on duckduckgo.com/tor and provides the same search results as the clearnet site, minus JavaScript-based features. It does not index .onion services by default; it searches the clearnet web through Tor. For onion-specific results, you need a different tool.

Ahmia – Ahmia is a search engine that crawls and indexes onion services, filtering out child-abuse material and obvious scams before listing results. The project is run by Juha Nurmi and publishes its onion address on ahmia.fi. Ahmia also offers a clearnet gateway, but visiting the onion version keeps your queries inside the Tor network. Results include a brief description and the date the service was last reachable; dead links are common because onion sites change addresses or go offline without notice.

Libraries and archives

Internet Archive onion – The Internet Archive offers an onion mirror of its Wayback Machine and text collections. The address is published on archive.org and lets you browse historical snapshots of websites without exposing your IP. Upload and account features may be limited on the onion version.

Z-Library onion – Z-Library is an ebook and academic-paper repository that moved to onion-only operation after its clearnet domains were seized in 2022. The project publishes official addresses through its Telegram channel and a signed message on its subreddit. Because the addresses rotate to evade takedowns, always verify the link against the project's latest announcement before uploading personal data or logging in.

Infrastructure and documentation

Tor Project onion – The Tor Project itself runs an onion mirror of torproject.org, so you can download Tor Browser, read documentation, and check for updates entirely over Tor. The address is listed on the clearnet site's footer. Using the onion mirror hides the fact that you are visiting Tor-related pages from anyone monitoring your network.

Tor Metrics onion – Tor Metrics publishes daily graphs of relay counts, bandwidth, and onion-service statistics[10]. The onion version of metrics.torproject.org is useful if you want to research Tor usage trends without revealing that interest to your ISP.

What 'safe' means in this context

Every service listed here is operated by an entity with a public identity, legal registration, or long-standing community reputation. That does not mean the service is immune to compromise—servers can be hacked, operators can be coerced, and onion addresses can be cloned by phishing sites. 'Safe' means the service itself is not a scam and the content is legal under UK law; it does not mean your activity on the service is private from the operator, from a court order, or from an exploit you have not patched.

For deeper exploration of onion search tools and how they rank results, see Best Dark Web Search Engines for 2026. If you are evaluating community-shared links, Dark Web Link Reddit: Finding Reliable Sources explains how to separate verified directories from phishing traps.

Red Flags: Onion Sites You Should Never Visit

Not every .onion address leads to a library or a news mirror. Some services exist solely to defraud users, distribute illegal material, or collect evidence for law enforcement. You need to recognise warning signs before you click, because visiting certain content can carry legal consequences even if you never register, pay, or download a file.

Sites promising illegal goods upfront. Marketplaces that advertise narcotics, stolen credit cards, or forged documents in their landing-page banner are either scams designed to steal cryptocurrency or honeypots run by investigators. Legitimate harm-reduction forums discuss substances in educational terms and do not process transactions; any site asking you to deposit Bitcoin before you see a product catalogue is a theft operation. If the service requires cryptocurrency upfront with no escrow, no reviews older than a few weeks, and no presence on established forums like Dread, assume it will vanish the moment you transfer funds.

Registration forms asking for personal email. An onion service that demands a Gmail or Outlook address to create an account is either incompetent or malicious. Tor hides your IP[2], but linking your real email to an onion account hands investigators a direct identifier. Legitimate privacy-focused services either require no registration at all or accept anonymous aliases with no verification. If a site insists on a phone number, recovery email, or identity document, close the tab.

Child sexual abuse material. Hosting, distributing, or possessing CSAM is illegal in the UK under the Protection of Children Act 1978 and the Criminal Justice Act 1988. Merely accessing such content—even accidentally—can result in prosecution, and Tor does not shield you from forensic attribution once you are a suspect. Law enforcement agencies run long-term monitoring operations on known CSAM forums, logging user behaviour and deploying browser exploits to capture real IP addresses. If you encounter this material, do not click further; report the .onion address to the Internet Watch Foundation (iwf.org.uk) or the National Crime Agency.

Phishing clones of known services. A site that looks identical to ProtonMail or a cryptocurrency exchange but has a .onion address one character different from the official URL is a credential-harvesting trap. Always cross-check addresses against the provider's clearnet page or a PGP-signed directory, as explained in the verification section above.

Law enforcement is watching

'Hidden' does not mean 'unmonitored'. Operation Onymous, a coordinated action by the FBI, Europol, and other agencies in 2014, seized servers running more than 400 onion services, including the Silk Road 2.0 marketplace. Investigators used a combination of traffic analysis, server misconfiguration, and undercover purchases to identify operators and users. Since then, agencies have deployed browser exploits targeting outdated versions of Tor Browser, infiltrated marketplace staff, and run their own onion services to gather evidence.

If you visit a site that later turns out to be under law-enforcement control, your Tor session logs, any registration details you provided, and the timing of your visits may become part of a criminal case. Tor Browser's default settings[5] and HTTPS-Only Mode[9] reduce some attack surfaces, but they cannot protect you from legal risk if the content itself is prohibited.

Treat any onion site offering illegal services, requesting personal data, or displaying CSAM as a direct threat to your freedom. The safest click is the one you do not make.

What to Do When a Link Is Dead or Unreachable

You will encounter dead onion addresses constantly. Services go offline for server maintenance, operators abandon projects without notice, and law enforcement seizes domains during investigations. Unlike clearnet websites, onion services have no central registry or DNS fallback[1]—if the operator's server is down, the address simply will not load, and Tor Browser will display a connection error after several minutes of trying.

When a link fails, follow this troubleshooting sequence before assuming the service is gone forever:

1. Check the service's official clearnet page. Many established projects—ProtonMail, the BBC, The Guardian—publish their current .onion address in the footer or a dedicated Tor section of their main website. If the operator has migrated to a new address or temporarily taken the service offline, the clearnet page will usually explain why. This step prevents you from wasting time on an address that was intentionally retired.

2. Search Ahmia or another vetted onion directory. Ahmia indexes active onion services and removes listings that have been unreachable for an extended period. Enter the service name (not the full .onion string) into Ahmia's search box; if the directory shows a different address with a recent crawl date, that is likely the current URL. Do not rely on the first result—compare the description and any linked clearnet reference to confirm it matches the service you want.

3. Avoid random 'onion link lists' on forums. Unmoderated lists on Reddit, Pastebin, or chan-style boards are frequently seeded with phishing clones that mimic legitimate services to harvest credentials or cryptocurrency. A list with no publication date, no explanation of how addresses were verified, and no community discussion is more dangerous than helpful. If you must use a community-shared link, cross-reference it against the service's official clearnet announcement or a PGP-signed directory.

Why onion services disappear

An onion service depends entirely on the operator's server uptime[2]. There is no hosting company keeping a backup online, no domain registrar holding the name in escrow, and no automatic failover if the machine loses power. If the operator's server goes offline—because of a hardware failure, a raid, or simply forgetting to renew hosting—the .onion address becomes unreachable until that specific server comes back.

Version-3 onion addresses[2] are derived from the service's cryptographic key[6], so an operator cannot transfer an address to a new server the way you would transfer a .com domain. If the private key is lost or the server is destroyed, the address is gone permanently, and the operator must generate a new one and re-announce it.

Dead links are a feature of the ecosystem, not a bug. Treat every saved .onion bookmark as provisional, verify addresses before entering credentials, and expect that any service without a clearnet presence or community reputation may vanish without explanation.

How to Find New Onion Sites Without Getting Trapped

You cannot browse onion services the way you browse the clearnet. There is no Google index, no DNS suggestion when you mistype an address, and no browser history shared across devices[1]. Discovery happens through a handful of specialist tools—onion search engines, curated wikis, and PGP-signed directories—each with different trade-offs between breadth and safety. The challenge is separating legitimate discovery methods from the scam-filled link dumps that dominate Reddit threads and Telegram channels.

Legitimate discovery methods

Ahmia is the most established onion search engine, indexing services that meet basic criteria: no child abuse material, no obvious scams, and a working server at the time of the last crawl. Ahmia's clearnet interface (ahmia.fi) lets you search by keyword and returns .onion addresses with short descriptions. The index is not exhaustive—private services that block crawlers will not appear—but every result has been reachable within the past few weeks, which filters out the majority of dead links.

DuckDuckGo onion offers a Tor-accessible version of its search engine at an address published on DuckDuckGo's clearnet help pages. It indexes both clearnet and onion content, though onion results are sparse compared to Ahmia. The advantage is that DuckDuckGo does not log searches[9], so your query history stays on your device.

The Tor Project's community wiki maintains a short list of vetted onion services—news sites, privacy tools, and documentation mirrors—on its support pages. This list is manually curated, updated infrequently, and contains fewer than twenty entries, but every address is verified by Tor Project staff before publication. If you want a starting point with near-zero risk of phishing, this is it.

PGP-signed directories published by established operators (for example, Z-Library's signed Telegram announcements or Riseup's documentation) provide cryptographic proof that the address came from the service's maintainers. You verify the signature using GnuPG[4] and the operator's public key, which is usually available on their clearnet site. This method requires more technical effort but eliminates the possibility that a third party inserted a fake address into the list.

Where not to look

Reddit threads and Telegram channels mix real links with scams in equal measure. A post titled 'Updated onion list 2026' on a general subreddit will often include phishing clones of ProtonMail, fake marketplaces designed to steal cryptocurrency, and addresses that were valid in 2018 but have since been abandoned or seized. Moderators rarely verify links before approving posts, and upvotes reflect popularity, not accuracy. If you use a community-shared link, treat it as untrusted until you cross-reference it against an official source.

For a detailed breakdown of which Reddit communities enforce verification and which do not, see Dark Web Link Reddit: Finding Reliable Sources.

Verification checklist before you visit

Even a link from a trusted directory can be compromised if an attacker hijacks the operator's server or publishes a lookalike address. Before entering credentials, uploading files, or sending cryptocurrency, run through this checklist:

1. Cross-reference the address. Compare the full 56-character .onion string[2] against at least two independent sources: the service's clearnet page, a PGP-signed announcement, or a vetted directory like Ahmia. A single-character difference means you are looking at a phishing clone.

2. Check for a TLS certificate on the onion. Although onion traffic is end-to-end encrypted within Tor[2], some services add HTTPS to signal authenticity. If Tor Browser shows a padlock in the address bar and the certificate matches the service name, that is a positive sign. If the certificate is self-signed or missing, proceed with caution—legitimate services like ProtonMail and the BBC use HTTPS on their onion mirrors.

3. Test with a low-stakes visit first. Load the landing page, read the about section, and check whether the design and content match what you expect from the service. Do not log in, do not enter personal data, and do not deposit funds until you have confirmed the address through multiple channels. If the site asks for an email address or phone number during the first visit, close the tab—legitimate privacy-focused onion services do not require personal identifiers[11].

Discovery on Tor is slower and less convenient than clearnet browsing, but that friction is deliberate. Taking the time to verify an address before you interact with it is the difference between finding a useful resource and handing your credentials to a phishing operation.

Legal Boundaries: What You Can and Cannot Do on Onion Sites

Using Tor Browser and visiting onion services is legal in most jurisdictions, including the United Kingdom, the United States, and the European Union. Downloading Tor from the official Tor Project website[3], verifying its signature[4], and connecting to .onion addresses[1] does not violate any law. Privacy tools are not criminal instruments—journalists, activists, and researchers rely on Tor every day to protect their sources and bypass censorship[2].

What crosses into illegal territory is the content you access and the transactions you complete. Viewing, downloading, or distributing child sexual abuse material is a serious criminal offence in every country where Tor operates. Purchasing controlled substances, stolen data, counterfeit documents, or hacking tools through an onion marketplace is prosecuted the same way it would be on the clearnet. Participating in fraud, harassment, or computer intrusion does not become lawful simply because you used Tor to do it.

Anonymity protects your privacy during the connection, but it does not grant immunity from investigation. Law enforcement agencies monitor onion services, infiltrate marketplaces, and deploy technical exploits to identify users who engage in prohibited activity. Operation Onymous demonstrated that servers can be seized, operators can be arrested, and transaction logs can be subpoenaed even when services are hosted as onion addresses[2]. If you visit a site that is later revealed to be under law-enforcement control, any credentials you entered, cryptocurrency you sent, or files you uploaded may become evidence in a criminal case.

Where operational security fails

Most arrests linked to onion services result from mistakes outside Tor itself. Users log into a marketplace using an email address tied to their real identity, reuse usernames across clearnet and onion accounts, or discuss illegal purchases on unencrypted messaging apps. Others disable JavaScript protections[5], ignore HTTPS warnings[9], or access onion sites over a VPN that keeps connection logs. Each of these choices creates a data point that investigators can correlate with other evidence to identify you.

Tor Browser's default configuration[5] reduces some attack surfaces—JavaScript is enabled on HTTPS sites but restricted on non-HTTPS connections, and HTTPS-Only Mode[9] forces encrypted connections where possible. Raising the security level to 'Safer' or 'Safest' disables more scripts but may break functionality on legitimate services. Even with maximum protections, Tor cannot prevent you from revealing your identity through the information you voluntarily provide to a site.

What you can safely do

You are free to read news on the BBC's onion mirror, check email through ProtonMail's onion service, search archives on the Internet Archive's onion address, and browse documentation on the Tor Project's own onion sites[2]. These activities are legal, widely encouraged by privacy advocates, and carry no more risk than visiting the same organizations on the clearnet. Onion services exist to protect your privacy, not to facilitate crime.

If you are unsure whether a particular action is lawful, assume it is not until you have consulted local regulations or legal advice. Tor gives you the tools to browse privately; it is your responsibility to use them within the boundaries of the law.

Typical Mistakes and Misconceptions

Assuming every onion address in a list is still live

Community-shared lists rarely record when an address was last checked. An onion service can disappear overnight if its operator takes it offline, its server is seized, or the address is simply abandoned. The 2024 TU Delft study counted roughly 0.8 million onion services, but that figure reflects services observed at a point in time, not a stable directory[7]. Before you invest time in a site, cross-reference its address against a vetted directory like Ahmia or an official clearnet announcement, and expect that some fraction of any list you find will already be dead.

Believing that Tor alone makes a site trustworthy

Tor encrypts your connection to an onion service end-to-end, but it does not verify who operates that service[2]. A phishing clone can run as an onion service just as easily as the real ProtonMail or BBC mirror. The address itself is derived from a public key and checksum, which lets Tor confirm you reached the intended address—not that the address belongs to a legitimate organization[6]. Treat the onion address as an unverified identifier until you have confirmed it against the service's clearnet page or a PGP-signed announcement.

Disabling JavaScript as a universal safety measure

Raising Tor Browser's security level to 'Safest' disables JavaScript by default on all sites, which reduces the attack surface[5]. Many legitimate onion services, including search engines and webmail interfaces, rely on JavaScript for basic functionality and will break or refuse to load. The 'Safer' level is a middle ground: JavaScript remains disabled on non-HTTPS sites but enabled where a secure connection exists[5]. Choose the level based on the site you are visiting and what you plan to do there, not as a blanket rule.

Confusing 'hidden service' with 'illegal service'

Onion services were formerly called 'hidden services,' and the old name still leads people to assume the technology exists to conceal wrongdoing[2]. The feature hides the service's location and IP address, which is useful for journalists, activists, and organizations that face censorship[2]. The same infrastructure hosts news mirrors, privacy documentation, and legal archives alongside marketplaces and forums that facilitate crime. The legality of what you do on an onion site depends on the content you access and the transactions you complete, not on the fact that you used Tor to reach it.

Skipping signature verification because the download 'looks official'

Every Tor Browser download is accompanied by an OpenPGP signature file that you can verify with GnuPG to confirm the package came from the developers[4]. Many users skip this step and rely on the site's appearance or a padlock icon, which only confirms the connection is encrypted, not that the file is authentic[9]. An attacker who compromises a mirror or intercepts a download can serve a modified browser that leaks your traffic. Download from the official Tor Project address and verify the signature before you run the installer[3].

Assuming onion services with HTTPS are automatically safer

HTTPS on an onion service can signal that the operator has configured a certificate, but it is not a guarantee of legitimacy. Onion traffic is already end-to-end encrypted within the Tor network, so HTTPS adds identity signaling rather than essential transport security[2]. A phishing site can obtain a certificate for a lookalike name, and a legitimate service may choose to run without HTTPS because the onion address itself provides cryptographic integrity[6]. Use HTTPS as one signal among several—cross-referencing the address against official sources matters more than the padlock.

Key Takeaways

• Onion services are a neutral privacy technology, not a marker of illegal activity. The BBC, ProtonMail, and the Internet Archive all run onion mirrors for legitimate reasons.

• Any list of onion addresses is a snapshot, not a guarantee. A service can go offline without notice, so cross-reference each address against an official clearnet announcement or a vetted directory like Ahmia before you rely on it.

• Tor encrypts your connection but does not verify who operates the service. Treat an onion address as unverified until you confirm it through a PGP-signed announcement or the organization's clearnet page.

• Most operational security failures happen outside Tor: reused usernames, real email addresses, or unencrypted messaging apps create the data points that identify users.

• Start with legal, documented services. Reading BBC News, checking ProtonMail, or browsing Tor Project documentation carries no more risk than visiting the same organizations on the clearnet.

If you are ready to build a vetted starting list, begin with our guide to Essential Dark Web Links: Your Guide to Safe Browsing.