Dark Web Onion Links: What You Need to Know

What an Onion Link Actually Is (and Isn't)

An onion link is a web address ending in .onion that exists outside the global Domain Name System. The Internet Engineering Task Force registered .onion as a special-use name under RFC 6761, treating it the same way as .local, .localhost, and .example — domains that standard DNS resolvers must not process[4]. Registrars are prohibited from selling .onion names, and caching DNS servers must return NXDOMAIN for all .onion queries[1]. This means you cannot type an onion address into Chrome, Firefox, or Safari and expect it to resolve; applications that do not implement the Tor protocol should generate an error instead[1].

The .onion domain functionally corresponds to the identity of a given service, combining location and authentication in a single string[1]. When you connect to an onion service, the address itself proves you are reaching the correct server, because the address is derived from the service's public key. This design provides end-to-end encryption and obscures both the server's location and your own IP address from each other[1].

What a Real Onion Address Looks Like

Version 3 onion addresses are 56 characters long, consisting of lowercase letters and digits followed by .onion. For example, a v3 address might look like thehiddenwiki4fgp6xvmn3xvzqxwgwg5gvdvvdvdvdvdvdvdvdvdvdvdvd.onion (this is a format example, not a real site). The length comes from encoding a full public key rather than just a hash[2]. Version 2 addresses were 16 characters long, but the Tor Project removed v2 support from the code base on 15 July 2021 and disabled v2 in stable client releases on 15 October 2021, making all v2 addresses unreachable[3]. The Project labelled v2 addresses 'fundamentally insecure' and urged operators to migrate immediately[2]. If you encounter a 16-character .onion link today, it will not load.

Common Misconceptions

Onion links are not inherently illegal. U.S. Department of Justice guidance states that 'while accessing the dark web is not illegal,' these services simply require special software rather than standard browsers[5]. The FBI defines DarkNet content as 'not indexed' and requiring 'unique software, configuration, or authorisation to access'[6], but passive information gathering from an online forum — even one where criminal conduct occurs — is unlikely to constitute a federal crime when done without criminal intent[7]. The legal risk comes from what you do on a site, not from visiting it. Dark Web Definition: What You Should Know covers the distinction between accessing the network and engaging in illegal activity.

Onion services are also not indexed by Google or any conventional search engine, because they are not part of the public internet's DNS infrastructure. Tor Metrics publishes daily extrapolated counts of unique .onion addresses reported by onion-service directory relays, providing the official measurement of how many services exist on the network[8], but no central registry lists them all.

How Onion Routing Works in Plain Terms

When you visit a .onion site, Tor wraps your request in three layers of encryption and sends it through three relays: a guard node, a middle relay, and an exit node. Each relay peels off one layer, sees only the previous and next hop, and forwards the packet. The guard node knows your IP address but not your destination; the middle relay knows neither; the exit node sees the final destination but not where you came from. This layered design is why the system is called 'onion routing' — each layer hides the one beneath.

The FBI notes that the Tor network provides 'privacy by obscuring the user's IP address and encrypting information'[9]. For .onion services specifically, traffic never leaves the Tor network. A traditional website on the clear web requires an exit node to bridge Tor and the public internet, meaning the exit node sees unencrypted traffic if the site uses HTTP. An onion service, however, runs inside Tor and connects directly to your Tor client through a rendezvous point, so no exit node is involved and no observer can see the content or the server's real IP address[1].

What Happens When a Link Fails

If you paste a v3 onion address into Tor Browser and see 'Unable to connect,' two scenarios are most common:

• The service is offline. Onion services go down for maintenance, shut down permanently, or experience connectivity issues. Tor Browser will show a connection error, and retrying after a few minutes may succeed if the operator restarts the server.

• The link is fake or mistyped. A single wrong character in a 56-character address will produce an invalid public key, and Tor will fail to establish a circuit. You will see the same connection error, but retrying will never work because the address does not correspond to any real service.

You cannot distinguish these cases from the error message alone. If a trusted directory lists the link and it worked yesterday, assume temporary downtime. If you copied the address from an unverified forum post, assume it may be incorrect or malicious. Onion Link: What You Need to Know for Safe Browsing explains how to verify addresses before you click.

Where Onion Links Come From and Why They're Hard to Find

Google and other search engines do not index .onion sites because these addresses exist outside the global DNS[1]. The .onion domain is formally reserved as a special-use name, meaning registrars must not register these names and caching DNS servers must return NXDOMAIN for all .onion queries[1]. Applications that do not implement the Tor protocol should generate an error when you try to use an onion address[1]. This design ensures that onion services remain invisible to conventional crawlers and search algorithms.

Instead of search engines, you find onion links through directories, curated lists, and word-of-mouth. Community-maintained directories compile addresses by category — marketplaces, forums, news sites, whistleblower platforms — but these lists are snapshots, not live indexes. Tor Metrics publishes daily extrapolated counts of unique .onion addresses reported by onion-service directory relays[8], showing that thousands of services exist on the network, yet no central registry tracks them all. You must rely on third-party directories that may be incomplete, outdated, or compromised.

The Problem of Link Rot

Many onion services are short-lived or move addresses without notice. An operator might shut down a forum, migrate to a new v3 address after a security incident, or simply stop paying for hosting. When a service goes offline, its .onion address becomes unreachable, and any directory entry pointing to it turns into dead weight. This phenomenon — link rot — is more severe on Tor than on the clear web, because onion services leave no DNS record or redirect when they disappear. A link that worked last month may fail today, and you have no automated way to discover the new address.

Version 2 onion addresses, which were 16 characters long, became entirely unreachable after the Tor Project removed v2 support on 15 October 2021[3][2]. Directories that listed v2 links now contain thousands of dead entries. Even v3 addresses, which are 56 characters long and derived from a full public key[2], can vanish overnight if the operator stops running the service.

A Documented Example: The CIA's Official Onion Site

Not all onion services are ephemeral or illicit. The Central Intelligence Agency operates an official .onion site to allow sources in restrictive countries to submit tips securely. The service has run for years, demonstrating that legitimate organisations use onion addresses for real-world purposes. You can verify the CIA's onion address through the agency's public website, where it publishes the link alongside instructions for Tor Browser. This example shows that onion services are not inherently criminal; they are a tool for privacy and censorship resistance, used by journalists, activists, and government agencies alike.

When you rely on directories, prioritise those that cite official sources or provide PGP signatures for each link. A signature proves the directory maintainer vouches for the address, reducing the risk of typos or malicious substitutions. Even so, treat every onion link as provisional until you confirm it through a second trusted channel.

The Difference Between Deep Web, Dark Web, and Onion Services

People use 'deep web', 'dark web', and 'onion services' interchangeably, but each term describes a different layer of the internet. Mixing them up leads to confusion about what you're actually accessing and what risks you face. The deep web is the largest category, the dark web is a small subset of it, and onion services are one technology within the dark web.

The deep web is anything not indexed by search engines. Your email inbox, online banking portal, company intranet, paywalled news articles, and private social media posts all sit on the deep web because Google cannot crawl them. No special software is required; you access these sites through Chrome, Firefox, or Safari by logging in with credentials. The FBI defines DarkNet content as 'not indexed'[6], but that definition alone would include your Gmail account, which is clearly not part of the dark web.

The dark web is a subset of the deep web consisting of overlay networks that use the public internet but require specific software, configuration, or authorisation to access[6]. The U.S. Department of Justice describes the dark web as services and websites that 'cannot be accessed through standard web browsers and require special software'[5]. Tor is the most widely known dark web network, but I2P, Freenet, and other overlay networks also exist. These networks obscure your IP address and the server's location, providing privacy and censorship resistance that standard HTTPS cannot match.

Onion services are a subset of the dark web that runs exclusively on the Tor network. An onion service uses a .onion address, which is formally reserved outside the global DNS[1] and combines location and authentication in a single string[1]. When you visit an onion service, traffic never leaves Tor; there is no exit node, and both you and the server remain hidden from each other. Not every dark web site is an onion service — some dark web forums run on I2P or other networks — and not every Tor user visits onion services, because Tor Browser can also access regular websites.

How the Three Layers Compare

The table shows that most of the deep web is mundane. Estimates suggest the deep web is hundreds of times larger than the surface web, but the vast majority consists of private databases, subscription content, and password-protected pages. The dark web is a tiny fraction of the deep web, and onion services are a small fraction of the dark web. Tor Metrics publishes daily counts of unique .onion addresses[8], typically showing a few thousand active services at any given time, compared to billions of indexed pages on the surface web.

Dark Web Definition: What You Should Know explains the legal and technical boundaries in more detail, but the core distinction is simple: the deep web is private by design (login required), the dark web is private by technology (overlay network required), and onion services are private by architecture (Tor-only, no exit node). Accessing the dark web is not illegal[5], but the content you find there and your actions on those sites determine legal risk, not the act of connecting.

How to Open an Onion Link Safely: Step-by-Step

Visiting an onion service requires Tor Browser and a deliberate approach to configuration. The U.S. Department of Justice notes that accessing the dark web is not illegal[5], but careless setup can expose your identity or link your Tor activity to personal accounts. Follow this sequence to minimize those risks.

Download and Verify Tor Browser

1. Go to the official Tor Project website and download Tor Browser for your operating system. Do not use third-party mirrors or app stores; attackers distribute modified versions that log traffic or inject malware.

2. Verify the digital signature of the installer file. The Tor Project publishes PGP signatures alongside each release, and verifying the signature confirms the file has not been tampered with during download. Instructions for signature verification appear on the download page; skip this step only if you accept the risk of running unverified software.

3. Install and launch Tor Browser. The first-run wizard offers a 'Connect' button for standard networks and a 'Configure' option if you are behind a firewall or need to use a bridge. Most users in the UK can click 'Connect' immediately.

Tor Browser is a modified version of Firefox, pre-configured to route all traffic through the Tor network. You do not need to install or configure anything else; the browser handles circuit selection, encryption, and onion address resolution automatically.

Paste the Onion Address and Connect

Once Tor Browser shows 'Connected to the Tor network,' paste the .onion address into the address bar and press Enter. The browser will establish a circuit through three relays and connect to the onion service's rendezvous point[1]. If the service is online and the address is correct, the page will load. If you see 'Unable to connect,' the service may be offline or the address may be invalid; Tor Browser cannot distinguish these cases from the error message alone.

Do not type the address by hand. A single wrong character in a 56-character v3 onion address will produce an invalid public key, and Tor will fail silently. Copy and paste from a trusted directory or a PGP-signed list to avoid typos.

Critical Warnings: What Not to Do

• Do not maximize the browser window. Tor Browser opens in a fixed size to prevent fingerprinting based on screen resolution. Maximizing the window leaks information about your display, making you easier to track across sessions. Resize the window if you must, but avoid full-screen mode.

• Do not log into personal accounts. Signing into Gmail, Facebook, or any service tied to your real identity while using Tor Browser links your anonymous session to your legal name. If you must access a personal account, do so in a separate standard browser, never in Tor Browser.

• Do not install browser extensions or plugins. Tor Browser disables Flash, Java, and most JavaScript by default to prevent tracking and exploits. Adding extensions reintroduces attack surface and may bypass Tor's protections.

These rules apply regardless of which onion service you visit. The U.S. Department of Justice advises that passively collecting information from an online forum is unlikely to constitute a federal crime when done without criminal intent[7], but operational security failures — such as logging into a personal email account mid-session — can unmask you even if your browsing activity is lawful.

Free Dark Web: Exploring Safe Access Points covers additional configuration steps for users who need bridge relays or want to harden Tor Browser further. For most first-time visitors, the default settings provide adequate privacy as long as you follow the warnings above and avoid downloading files or enabling scripts on untrusted sites.

Typical Mistakes People Make with Onion Links

First-time users make predictable errors that undermine Tor's protections or expose them to scams. Most mistakes stem from treating onion services like regular websites or misunderstanding how Tor interacts with other privacy tools. Below are seven common errors, the consequence of each, and the correct approach.

Using a VPN Incorrectly with Tor

Many guides recommend combining Tor and a VPN, but the order matters. Connecting to a VPN before launching Tor Browser (Tor-over-VPN) hides your Tor usage from your internet provider but does not improve anonymity within the Tor network; your guard relay still sees the VPN exit IP, not your real address. Connecting to a VPN after Tor (VPN-over-Tor) is rarely useful and requires manual configuration that most users get wrong, often leaking traffic outside Tor.

The Tor Project's official guidance is that most users do not need a VPN at all. If your threat model includes hiding Tor usage from your ISP, use a bridge relay instead of a VPN. Bridges are built into Tor Browser's configuration wizard and do not introduce a third party that can log your activity. If you insist on a VPN, connect to it before starting Tor Browser, never after, and understand that the VPN provider will see your real IP and the fact that you are connecting to Tor.

Clicking Onion Links from Random Forums

Pasting an onion address you found on Reddit, Twitter, or an unverified forum is the fastest way to land on a phishing clone or a honeypot. Attackers register domains that look like popular onion services — changing one character in a 56-character v3 address[2] — and post the fake link in public threads. When you connect, the site harvests credentials, injects malware, or logs your activity for deanonymisation.

Always verify onion addresses through two independent trusted sources. If a directory lists an address, cross-check it against the service's official clearnet site (if one exists) or a PGP-signed announcement. The CIA's onion site, for example, publishes its .onion address on the agency's public website, allowing you to confirm the link before connecting. Never trust a single forum post, even if it has upvotes or positive comments; reputation on public forums is trivial to fake.

Assuming HTTPS Applies the Same Way

You will see 'https://' in the address bar when visiting some onion services, but HTTPS over Tor does not provide the same guarantees as HTTPS on the clearnet. On a regular website, HTTPS encrypts traffic between your browser and the server and validates the server's identity through a certificate authority. On an onion service, Tor already encrypts traffic end-to-end and the .onion address itself functions as the server's identity[1], so a certificate authority adds little value.

Some onion services still use HTTPS to satisfy browser warnings or to enable certain web features, but the certificate is often self-signed or issued for a placeholder domain. Do not treat the presence of HTTPS as proof of legitimacy; verify the onion address through a trusted source instead. Conversely, the absence of HTTPS on an onion service does not mean the connection is insecure, because Tor's onion routing already provides encryption and authentication.

Downloading Files from Onion Sites

Files downloaded through Tor Browser can contain metadata that reveals your real identity or malware that bypasses Tor's protections. A PDF might embed your computer's username or timezone, an image might contain EXIF data with GPS coordinates, and an executable can phone home to a command server the moment you run it. Even opening a document in a standard application outside Tor Browser can trigger network requests that leak your IP address.

If you must download a file, open it inside a virtual machine or a disposable operating system like Tails, which routes all traffic through Tor and wipes itself on shutdown. Never open downloaded files in your host operating system, and never run executables from onion sites unless you have verified the file's PGP signature against a known public key. The safest approach is to avoid downloading files entirely; if a service requires you to download something to proceed, question whether you trust the operator enough to accept that risk.

Using a Phone Browser

Tor Browser for Android exists, but mobile operating systems leak far more identifying information than desktop systems. Your phone constantly broadcasts data about installed apps, screen size, battery level, sensor readings, and network environment. Even with Tor Browser, background apps can make network requests that bypass Tor, and the small screen makes phishing sites harder to spot.

If you must use Tor on a phone, use the official Tor Browser for Android from the Google Play Store or F-Droid, not a third-party app. Disable location services, close all other apps, and avoid logging into any accounts. Understand that mobile Tor usage is inherently less secure than desktop usage; if your threat model includes state-level adversaries or sophisticated attackers, use Tor Browser on a dedicated laptop running Tails instead.

Trusting Search Results from Sketchy 'Onion Search Engines'

Several websites claim to index .onion addresses and offer search functionality, but most are scams. These 'search engines' return results padded with phishing links, defunct v2 addresses, or ads for illegal services. Some log your queries and IP address (if you access them without Tor), while others inject malicious scripts into the results page.

There is no Google equivalent for onion services. Tor Metrics publishes aggregate statistics on the number of active .onion addresses[8], but it does not index content or provide search. Legitimate directories exist — such as the Hidden Wiki mirrors and community-curated lists — but even these require manual verification of each link. Treat any onion search engine with extreme skepticism, and never click a result without cross-checking the address through a second trusted source.

Confusing v2 Links (Dead Since 2021) with v3

Version 2 onion addresses are 16 characters long and have been unreachable since 15 October 2021, when the Tor Project removed v2 support from stable client releases[3]. The Tor Project stated that v2 addresses are 'fundamentally insecure'[2], yet thousands of directories and forum posts still list v2 links. If you paste a 16-character .onion address into Tor Browser, you will see 'Unable to connect' with no explanation that the address format is obsolete.

Version 3 onion addresses are 56 characters long and contain a full public key rather than a hash[2]. They are the only supported format. If a directory lists a mix of v2 and v3 addresses, ignore the v2 entries entirely; they are link rot, not temporarily offline services. When saving onion addresses for future use, note the character count: 16 means dead, 56 means potentially active.

Onion Link: What You Need to Know for Safe Browsing explains how to verify address formats and check whether a service is genuinely offline or simply using an outdated protocol version. The key lesson is that length alone tells you whether a link can possibly work before you waste time troubleshooting a connection that will never succeed.

Legal and Safety Context: What Actually Gets People in Trouble

Accessing the Tor network and browsing .onion sites is not illegal in the United Kingdom, the United States, or most other jurisdictions. The U.S. Department of Justice explicitly states that 'while accessing the dark web is not illegal,' the dark web consists of services and websites that require special software to reach[5]. What gets people arrested is not the act of opening Tor Browser or visiting an onion address, but engaging in activities that are crimes regardless of the technology used: buying controlled substances, accessing child exploitation material, participating in fraud, or commissioning violence.

The legal line is clear in principle but easy to cross by accident. You might follow a link from a directory and land on a page hosting illegal content without realising it until images load or a transaction page appears. The correct response is to close the tab immediately and do not interact with the site — do not click further, do not create an account, do not download anything. The U.S. Department of Justice advises that passively collecting information from an online forum, even one where criminal conduct occurs, is unlikely to constitute a federal crime when done without criminal intent, but accessing a forum without authorisation can implicate the Computer Fraud and Abuse Act[7]. In practice, stumbling onto illegal content once and leaving is not what prosecutors target; patterns of repeated access, participation, or financial transactions are.

Law Enforcement Monitors Certain Onion Services

The FBI and partner agencies operate undercover onion sites and monitor popular marketplaces, forums, and file-sharing services. The FBI defines DarkNet content as 'not indexed' and consisting of 'overlaying networks that use the public Internet but require unique software, configuration, or authorisation to access'[6], and the agency has publicly documented operations in which it seized darknet marketplaces, continued running them to identify users, and arrested buyers and sellers months later[9]. If you create an account on a marketplace, upload content to a forum, or make a purchase, assume that transaction could be logged and linked to other activity.

Tor protects your IP address from the onion service operator, but it does not protect you from mistakes that reveal your identity: reusing a username from a clearnet account, entering a delivery address for a physical purchase, or logging into a personal email account in the same browser session. Operational security failures — not Tor protocol weaknesses — are how most arrests happen. Dark Web Definition: What You Should Know covers the distinction between technical anonymity and behavioural anonymity; the former is what Tor provides, the latter is what you must maintain through discipline.

Exit Nodes Are Not Relevant to Onion Services, but Understand the Broader Risk

Exit nodes — the final relay in a Tor circuit that connects to a clearnet website — can be operated by malicious actors who monitor unencrypted traffic. This risk does not apply when you visit .onion addresses, because onion services never use exit nodes; the connection stays inside the Tor network from your browser to the destination server[1]. However, if you use Tor Browser to visit a regular HTTP website (not HTTPS), the exit node operator can see and modify the traffic. Some exit nodes inject ads, strip encryption, or log credentials.

The practical implication: treat onion services and clearnet browsing as two separate threat models. When visiting .onion addresses, exit node surveillance is irrelevant. When visiting clearnet sites through Tor Browser, verify that the address bar shows 'https://' and a padlock icon; if it does not, assume the exit node operator can read everything you send. Never enter passwords, payment details, or personal information on an HTTP site accessed through Tor, even if the site appears legitimate.

What 'Legal Use' Looks Like in Practice

Journalists use onion services to receive tips through SecureDrop instances hosted by major news organisations. Activists in countries with restrictive internet policies use Tor to bypass censorship and access information without government surveillance. Researchers study darknet marketplaces to understand criminal ecosystems, and privacy-conscious individuals use onion services to avoid corporate tracking. The CIA operates an onion site to allow sources in hostile regions to contact the agency without revealing their location[9]. None of these activities are illegal, and all rely on the same .onion infrastructure that also hosts illegal content.

The difference is intent and action. Reading a forum where people discuss illegal activity is not a crime; purchasing a service advertised on that forum is. Visiting an onion site that hosts pirated content is not illegal in most jurisdictions; downloading and distributing that content may be. The technology is neutral; the law judges what you do with it, not the fact that you used it.

How to Verify an Onion Link Is Real Before You Visit

A phishing onion link looks almost identical to the real address — one or two characters different in a 56-character string — and the difference is invisible at a glance. Because .onion domains are cryptographically derived from a service's public key[1], you cannot register a memorable name or rely on a certificate authority to confirm identity. The only way to know an address is genuine is to check the full string against a source you trust, and to do that check every time you visit.

Verification Checklist

Start with the address itself. A legitimate v3 onion address is exactly 56 characters long and ends in .onion[2]. If the address is 16 characters, it is a v2 link and has been unreachable since 15 October 2021[3]. Copy the full address from a trusted directory or the service's official clearnet website, then paste it into a text editor alongside the address you want to verify. Compare character by character; do not rely on visual scanning, because similar-looking letters (l and 1, O and 0) are easy to miss.

Cross-reference the address with multiple independent sources. If a news organisation publishes its SecureDrop onion address on its clearnet site, on its Twitter account, and in a press release, and all three match, the address is almost certainly correct. If you find the address only on a single forum post or a third-party directory with no attribution, treat it as unverified. The Tor Project's official blog and support pages list onion addresses for core services; use those as a baseline for comparison.

Signed Statements and PGP Signatures

Some onion services publish a signed canary statement or PGP signature on their clearnet site to prove ownership of an onion address. The operator signs the .onion address with a PGP key whose fingerprint is publicly known, and you verify the signature using GnuPG or a similar tool. If the signature is valid and the key fingerprint matches the one published on the service's official channels, you can trust the address.

This method requires you to understand PGP key verification, which is beyond the scope of this checklist but widely documented. The key point is that a signature links the onion address to an identity you already trust through another channel. Without that link, the address is just a string of characters with no provable owner.

Onion Service Authentication

Tor's onion service authentication allows an operator to restrict access to users who possess a specific cryptographic key. When you try to visit an authenticated onion service without the key, Tor Browser displays an error rather than connecting. If a service uses this feature, the operator will provide you with a private key file and instructions to add it to Tor Browser's configuration.

Authentication does not help you verify that an address is real before your first visit, but it does prevent phishing: an attacker cannot clone an authenticated onion service without also stealing the operator's private authentication keys. If a service you use enables authentication, follow the setup instructions and save the key file securely. The feature is not common outside high-security environments, but when available it is the strongest assurance that you are connecting to the intended server.

Spotting a Phishing Link: Conditional Scenario

Imagine a popular marketplace operates at examplemarket7a3b2c1d4e5f6g8h9i0j1k2l3m4n5o6p7q8r9s0t1u2v3w4x.onion. A phishing site registers examplemarket7a3b2c1d4e5f6g8h9i0j1k2l3m4n5o6p7q8r9s0t1u2v3w4y.onion — identical except for the final character. If you paste the fake address into Tor Browser, the site loads normally, displays the same layout and branding as the real marketplace, and prompts you to log in. The moment you enter your credentials, the attacker captures them and uses them to access your real account on the legitimate site.

The only defence is to verify the address before you visit. Check the saved bookmark, compare it to the official announcement, and do not trust autocomplete or recently visited links in your browser history. If you suspect you have visited a phishing site, change your password on the real service immediately, and assume any information you entered on the fake site is compromised.

Dark Web Onion: Understanding Its Role provides additional context on how onion addresses function and why character-by-character verification is non-negotiable. The takeaway is simple: treat every .onion address as untrusted until you have confirmed it through two independent, authoritative sources, and never assume that a site is legitimate because it looks professional or appears in search results.

What Onion Links Can't Do: Limitations and Misconceptions

Onion links are not a magic shield. They obscure your IP address from the server you visit and encrypt traffic through the Tor network, but they do not guarantee complete anonymity, protect you from malware, or prevent social engineering attacks. The Tor Project states that onion services combine location and authentication, providing end-to-end encrypted access where the server's identity and location are obscured from the client[1], yet this technical protection does not extend to user behaviour or endpoint security. If you assume that visiting an .onion address makes you invisible or invulnerable, you will make mistakes that compromise your privacy or safety.

Traffic Analysis and User Error Break Anonymity

Tor protects the content of your traffic and hides your IP address, but it cannot prevent traffic analysis by an adversary who controls both your internet service provider and the guard relay you connect to, or who monitors the onion service and correlates timing patterns. If you are the only person in your city accessing Tor at 3am and the only user visiting a specific onion service at that moment, a sufficiently resourced observer can infer the connection even without decrypting the traffic. This is a theoretical risk for most users, but it is a documented limitation of onion routing.

More common is the risk of user error. If you log into a personal email account in Tor Browser, post on a forum using a username tied to your real identity, or enter a delivery address for a physical purchase, you have linked your activity to your identity. Tor cannot protect you from yourself. The network anonymises your connection; it does not anonymise your behaviour, and operational security failures are how most users are identified when law enforcement investigates darknet activity.

Onion Services Do Not Filter Malware

An onion address is a routing mechanism, not a security guarantee. Visiting a .onion site does not mean the content is safe, vetted, or free from malware. If a site serves a malicious download, clicking it will infect your device just as it would on the clearnet. Tor Browser includes some protections — it blocks plugins that can leak your IP address, disables JavaScript by default on the safest security level, and isolates each site's data — but these are not substitutes for caution.

Treat every file download from an onion service as potentially hostile. Do not open executables, do not enable macros in documents, and do not trust a file simply because it came from a site that others recommend. If you must download something, do so inside a virtual machine or on a dedicated device that contains no personal information. The Tor network encrypts your connection to the server, but it does not scan the server's content for threats.

Social Engineering Works Regardless of the Network

Phishing, scams, and confidence tricks are more common on onion services than technical exploits, because they require no sophisticated infrastructure and they work. A fake marketplace that looks identical to a real one will steal your cryptocurrency. A forum post offering a 'verified vendor' will lead you to an exit scam. A private message claiming to be from site administration will ask for your password or recovery phrase. None of these attacks rely on breaking Tor; they rely on you trusting the wrong person or site.

The anonymity of onion services makes scams easier to execute and harder to remedy. There is no customer service, no dispute resolution, and no legal recourse. If you send payment to a fake vendor, the money is gone. The best defence is scepticism: verify every address, assume every unsolicited offer is fraudulent, and never share credentials or keys with anyone who contacts you first.

Onion Services Are Slower and Often Unreliable

Because Tor routes your traffic through three relays before reaching the onion service, and the service's traffic also travels through three relays in the opposite direction, latency is higher than a direct clearnet connection. Pages load slowly, images take time to render, and large downloads can time out. This is an inherent trade-off of onion routing; the additional hops that protect your anonymity also add delay.

Onion services also go offline frequently. Operators may shut down without notice, servers may crash, or the Tor network may experience congestion that makes certain services unreachable. If you visit an onion address and see a 'site not found' error, it does not necessarily mean the address is wrong; the service may simply be down. Unlike clearnet sites with uptime guarantees and redundant infrastructure, onion services are often run by individuals or small groups with limited resources, and reliability is not a priority.

Many Directories Are Outdated or Malicious

Link rot is pervasive in onion directories. A site that was active six months ago may be gone, and the directory listing it may not have been updated. Worse, some directories intentionally list phishing links or defunct addresses to drive traffic to ads or scam sites. The Tor Project does not endorse any third-party directory, and Tor Metrics publishes daily counts of unique onion addresses reported by directory relays[8] but does not curate or verify individual links.

If you rely on a directory, cross-reference every address with an independent source before you visit. Do not assume that a link is current or legitimate because it appears on a popular list. The safest approach is to find onion addresses directly from the service operator's official clearnet site, social media account, or signed announcement, and to bookmark verified addresses in Tor Browser rather than searching for them each time.

Tor Is Not Illegal, but It Does Not Make Illegal Activity Legal

Accessing the Tor network and visiting onion services is legal in the United Kingdom and most other jurisdictions. A U.S. Department of Justice audit confirms that 'while accessing the dark web is not illegal,' the dark web consists of services and websites that require special software and cannot be accessed through standard browsers[5]. However, the legality of access does not extend to what you do once you are there. If you purchase controlled substances, download child exploitation material, or participate in fraud, you are committing a crime, and Tor does not provide immunity from prosecution.

Law enforcement agencies monitor onion services, operate undercover sites, and use forensic techniques to identify users who engage in illegal activity. The FBI notes that the Tor network provides 'privacy by obscuring the user's IP address and encrypting information'[9], but that privacy is not absolute, and investigators have successfully traced users through operational security failures, financial transactions, and physical evidence. The misconception that Tor makes you untouchable is dangerous; it leads to overconfidence and careless behaviour that can result in arrest.

The bottom line is that onion links are a tool for privacy, not a guarantee of safety or legality. They reduce the risk of surveillance and tracking, but they do not eliminate it, and they do not protect you from your own mistakes or from the consequences of illegal actions. Understand what onion services can and cannot do, manage your expectations, and approach every link with the assumption that it may be slower, less reliable, or more dangerous than you expect.

Common Mistakes and Misconceptions

Most confusion around onion links comes from treating them as either a magic cloak or a guaranteed trap. The reality is narrower: they are a routing mechanism with specific technical properties and specific failure modes. Understanding where people go wrong helps you avoid the mistakes that actually cause harm.

Assuming Every 16-Character Onion Address Still Works

Many old tutorials and link lists contain version 2 onion addresses, which are 16 characters long. The Tor Project removed v2 support from the code base in Tor 0.4.6.x on July 15, 2021, and stable clients disabled v2 on October 15, 2021, making those addresses unreachable[3]. If you copy a 16-character address from an outdated directory, you will see a connection error and may assume Tor is broken.

Version 3 addresses are 56 characters long because they contain a full public key rather than just a hash[2]. When you find an onion link, count the characters before you try to open it. A 16-character address is dead, not broken; you need the v3 equivalent from the service operator's current announcement.

Thinking a VPN Adds Meaningful Security on Top of Tor

A common recommendation is to combine Tor with a VPN for 'extra anonymity'. In practice, this adds a single point of failure: the VPN provider sees your real IP address and the fact that you are connecting to the Tor network. Tor already encrypts your traffic and routes it through three relays, and the .onion protocol combines location and authentication to obscure the server's identity from the client[1].

Using a VPN does not make you more anonymous; it shifts trust from your internet service provider to a commercial VPN company. If you need Tor, use Tor Browser alone and keep its default settings. The exception is when you need to hide the fact that you are using Tor from your ISP, but that is a different goal than anonymity.

Maximizing the Tor Browser Window

Tor Browser standardizes the window size for every user to prevent fingerprinting. If you maximize the window or drag it to a custom size, your screen resolution becomes a unique identifier that can be combined with other browser characteristics to track you across sessions. This is a documented design choice in Tor Browser, not a bug.

Leave the window at its default size and do not enter full-screen mode. The same applies to zoom levels and custom fonts: any deviation from the default profile makes your browser more identifiable. The anonymity Tor provides depends on looking like every other Tor Browser user.

Copying Onion Addresses from Random Directories Without Verification

Link directories are the most common entry point for new users, and they are also the most common source of phishing links. A directory may list an address that looks correct but points to a cloned site designed to steal your credentials or cryptocurrency. Tor Metrics publishes daily counts of unique onion addresses reported by directory relays[8], but it does not curate or verify individual links.

Before you visit any onion address, verify it from two independent sources. The safest method is to find the address on the service operator's official clearnet site, signed social media account, or public announcement, then compare it character-by-character with the directory listing. Bookmark verified addresses in Tor Browser so you do not need to search for them again.

Logging into Personal Accounts Inside Tor Browser

Tor hides your IP address from the server you visit, but it does not hide your identity if you voluntarily provide it. Logging into a personal email account, a social media profile, or any service tied to your real name links your Tor activity to your identity. The same applies to entering a delivery address for a physical purchase or posting under a username you use elsewhere.

Create separate identities for any activity you want to keep private, and never mix them with accounts that contain real information. Tor protects the connection, not the content you choose to send through it. The network anonymizes your routing; it does not anonymize your behavior.

Treating .onion as a Security or Legitimacy Signal

An onion address tells you nothing about the safety or legitimacy of the site behind it. The .onion domain is a Special-Use Domain Name reserved by RFC 7686, meaning it is outside the global DNS and registrars must not register .onion names[1]. It is a namespace, not a trust seal. A malicious site can use an onion address just as easily as a legitimate one.

Do not assume that a professional-looking onion site is vetted or safe. Phishing sites replicate branding, layout, and even customer review sections to trick users into sending payment. Treat every file download as potentially hostile, and never enter credentials or cryptocurrency keys into a site you have not verified through an independent source.

Believing Tor Makes Illegal Activity Undetectable

Accessing the Tor network and visiting onion services is legal in the United Kingdom and most jurisdictions. A U.S. Department of Justice audit states that 'while accessing the dark web is not illegal,' the dark web consists of services and websites that require special software and cannot be accessed through standard browsers[5]. However, legality of access does not extend to what you do once you are there.

Law enforcement agencies monitor onion services, operate undercover sites, and use forensic techniques to identify users who engage in illegal activity. The FBI notes that the Tor network provides 'privacy by obscuring the user's IP address and encrypting information'[9], but that privacy is not absolute. Investigators have traced users through operational security failures, financial transactions, and physical evidence, and the misconception that Tor makes you untouchable leads to overconfidence and careless behavior.

The pattern across all these mistakes is the same: people assume onion links provide more protection than they actually do, or they treat them as inherently dangerous without understanding the specific risks. Neither assumption helps you. Learn the technical properties, verify every address, and keep your operational behavior separate from your real identity.

Conclusions

• Treat an onion address as a routing path, not a badge of safety or legitimacy.

• Check every address before you visit it: v3 links are 56 characters long, and older 16-character v2 links no longer work.

• Resist maximizing Tor Browser and never sign into personal accounts inside it.

• Accessing onion services is legal in the UK, but illegal activity can still be traced through careless behavior.

We suggest your first safe step: review the full Onion Link: What You Need to Know for Safe Browsing checklist so you can verify addresses and configure Tor Browser correctly before opening your first link.