Onion Site: Your Guide to Accessing Hidden Resources

What an Onion Site Actually Is

An onion site is a web service that runs inside the Tor network and uses a .onion address instead of a standard domain name. You cannot reach it through Chrome, Firefox, or any browser that relies on traditional DNS. The .onion suffix is not a registered top-level domain; it exists only within Tor's routing system and resolves only when you connect through Tor Browser or another Tor client[1].

The core difference from a clearnet site is that both the server and your computer remain anonymous. When you visit a regular website, your ISP sees the destination IP address, and the server logs your IP address. When you visit an onion site, Tor routes your connection through multiple relays so neither the site nor any relay knows both who you are and where you are going. The site's server is hidden behind the same multi-hop system, so you cannot determine its physical location or IP address from the connection alone.

Address structure and cryptographic foundation

A current onion address is 56 characters long, followed by '.onion'[1]. The address encodes a full ed25519 public key, not just a hash of that key[2]. According to the Tor specification, the format is base32(PUBKEY | CHECKSUM | VERSION) + '.onion', where CHECKSUM = SHA3_256('.onion checksum' | PUBKEY | VERSION)[:2][3]. This means the address itself is a cryptographic commitment: if you connect to the correct string of 56 characters, you are guaranteed to reach the server that holds the corresponding private key.

Older onion sites used 16-character v2 addresses. Tor deprecated v2 services because the underlying technologies are vulnerable to attacks and are no longer maintained[4]. As of October 19, 2021, Tor treats v2 addresses as bad hostnames that cannot be used on a SOCKS connection[5]. If you find a 16-character address in an older guide, it will not work in any current Tor Browser release.

The Tor Project's own onion address illustrates the difference: its v2 address was expyuzz4wqqyqhjn.onion, while its v3 address is 2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion[6]. The longer string is not a typographical error; it is the result of embedding the full public key.

People often think 'onion site' and 'dark web' are synonyms for illegal marketplaces. In reality, many onion sites are legitimate mirrors of clearnet organizations, privacy tools, and directories. The CIA hosts an onion service, and the Tor Project itself runs onion versions of its own resources[7][6]. What makes a site illegal is its content or your activity there, not the fact that it uses a .onion address.

How Onion Addressing Works (V2 vs V3)

Onion addresses come in two formats: a 16-character v2 address that Tor retired in 2021, and a 56-character v3 address that is the current standard[1][8]. The difference is not cosmetic. A v3 address contains a full ed25519 public key, while v2 addresses stored only a hash of the public key[2]. This change makes v3 addresses longer but cryptographically stronger: you can verify the server's identity from the address alone, without trusting a third party.

Why v2 was retired

Tor deprecated v2 onion services because the underlying cryptography is vulnerable to different kinds of attacks and is no longer being developed or maintained[4]. The official deprecation timeline began with warnings on September 15, 2020, removed v2 support from the code base on July 15, 2021, and released stable client versions that disable v2 on October 15, 2021[8]. As of October 19, 2021, Tor treats v2 addresses as bad hostnames that cannot be used on a SOCKS connection[5]. Tor Browser 10.5.10, released on October 25, 2021, warned users that support would end in November 2021[9].

If you try to connect to a 16-character address now, the connection fails immediately. The address is not temporarily down; it is structurally unsupported. Look for a 56-character v3 replacement and verify it through the same channels you would use for any other service.

How v3 addresses are constructed

According to the Tor specification, a v3 onion address is encoded as base32(PUBKEY | CHECKSUM | VERSION) + '.onion', where CHECKSUM = SHA3_256('.onion checksum' | PUBKEY | VERSION)[:2][3]. The 56 characters encode the server's public key, a two-byte checksum, and a version byte. When you connect, Tor verifies the checksum and establishes an encrypted tunnel directly to the server that holds the matching private key.

The Tor Project's own addresses illustrate the format difference: its v2 address was expyuzz4wqqyqhjn.onion, while its v3 address is 2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion[6]. The longer string is not an error; it is the result of embedding the full public key instead of a hash.

For you, this means that a v3 address is self-authenticating. If an attacker tries to impersonate a service, they cannot generate the same 56-character string without stealing the private key. A phishing mirror can copy the design and text, but it cannot copy the exact address. Compare all 56 characters against an official source before you enter credentials or send funds.

What You Need Before Accessing an Onion Site

You need three things: Tor Browser from the official source, a verified starting point, and a clear understanding of what operational security means in practice. The first two are technical prerequisites; the third determines whether the technology protects you or creates a false sense of safety.

Tor Browser: official download only

Download Tor Browser only from the official Tor Project website at https://download.torproject.org/, where the connection is secured using HTTPS[10]. Third-party bundles, mirrors hosted on file-sharing sites, and repackaged versions introduce the risk that someone has modified the code to log your activity or inject malware. Every legitimate Tor Browser download file is accompanied by an '.asc' OpenPGP signature file that lets you verify the package was generated by its developers and has not been tampered with[11].

Verifying the signature requires an extra step, but it is the only way to confirm that the file you downloaded matches the file the Tor Project released. If you skip verification, you are trusting that no one intercepted the download or replaced the file on a mirror site. The Tor Project provides step-by-step instructions for checking the signature on Windows, macOS, and Linux; follow them before you run the installer.

A trusted starting point

You need at least one verified onion address or directory before you open Tor Browser. Typing a random string or following a link from an unverified forum post is how people reach phishing mirrors. Start with a directory like Ahmia, which indexes onion services and lets you search without leaving the Tor network, or find a known organization's onion address on its clearnet website. For example, the Tor Project's own v3 address is 2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion[6]. Compare all 56 characters against the official source; a phishing mirror can copy the design and text but cannot copy the exact address[1].

If you plan to use The Hidden Wiki or another community-maintained directory, verify its address through two independent sources before you bookmark it. A single forum post or a search result on the clearnet can point to an outdated or malicious copy.

Basic operational security habits

Tor hides your route through the network, but it does not hide what you type, upload, or download. Create a separate account for onion services; do not reuse credentials from your clearnet accounts. Remove metadata from files before you upload them; an image taken with your phone can contain GPS coordinates, device identifiers, and timestamps. Use full-disk encryption on your computer so that if someone gains physical access, they cannot read your browsing history or saved files.

People often think a VPN adds a layer of protection. The Congressional Research Service notes that using Tor in conjunction with a VPN can provide additional privacy because a VPN may conceal internet activity including the use of Tor[12]. On the other hand, a misconfigured VPN can leak your real IP address, and a VPN provider can log your activity just as an internet service provider can. If you choose to use a VPN, connect to the VPN first, then launch Tor Browser, and verify that the VPN does not log connection timestamps or destination addresses. If you are unsure how to configure it correctly, using Tor alone is safer than using Tor with a VPN that leaks metadata.

Using Tor and visiting onion sites is legal in the United States[7]. Running a Tor relay, including an exit relay that allows people to anonymously send and receive traffic, is also legal under U.S. law[13]. What is illegal is the same as on the clearnet: purchasing controlled substances, accessing child abuse material, or committing fraud. Operational security protects your privacy; it does not grant immunity from prosecution for illegal activity.

Step-by-Step: Accessing Your First Onion Site Safely

You have Tor Browser installed and a verified starting point. The next step is connecting to the Tor network, finding a low-risk onion service, and confirming that the connection works as expected. The sequence below assumes you have downloaded Tor Browser from the official source and verified the signature[10][11].

Connect to the Tor network

Launch Tor Browser. The first screen offers two options: 'Connect' and 'Configure'. If your internet service provider does not block Tor, click 'Connect'. The browser establishes a circuit through three relays and displays a confirmation page when the connection succeeds. If you see 'Congratulations. This browser is configured to use Tor', you are ready to visit an onion site.

If your ISP blocks Tor or you need to hide the fact that you are using Tor, click 'Configure' and enable a bridge. Bridges are unlisted relays that help you reach the Tor network when direct connections are blocked. The Congressional Research Service notes that some internet service providers can see that you are using Tor (but not the content), and that using Tor in conjunction with a VPN can provide additional privacy[12]. Configure the VPN before you launch Tor Browser if you choose this approach.

Use a directory or search engine

Open Ahmia or the DuckDuckGo onion service to search for onion sites. Ahmia indexes onion services and filters out illegal content; DuckDuckGo's onion mirror provides the same search interface you would use on the clearnet but routes all queries through the Tor network. Both services let you search without leaving Tor, so your queries are not logged by a clearnet search engine.

Alternatively, visit a known organization's onion mirror directly. The Tor Project's own v3 address is 2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion[6]. Copy the full 56-character address from the official source, paste it into the Tor Browser address bar, and press Enter. Do not retype it by hand; a single mistyped character will take you to a different service or a connection error.

Verify the connection

When the page loads, check the address bar. Tor Browser displays a purple onion icon next to the URL when you are connected to an onion service. The address should match the 56 characters you copied[1]. If the page asks you to log in or enter payment details, compare the address against two independent sources before you proceed. A phishing mirror can replicate the design and text but cannot replicate the exact v3 address without stealing the private key[2][3].

For a low-risk first test, visit the BBC's onion mirror or a public archive. The BBC operates an onion version of its news site to serve readers in countries where the clearnet site is blocked. You do not need to create an account or submit personal information; you can browse articles and confirm that the connection is stable. If the page loads and the address matches the verified string, you have successfully accessed an onion site.

Where to Find Onion Sites Without Getting Scammed

You need a starting point that filters out dead links and phishing mirrors. Google cannot index .onion addresses because they exist only inside the Tor network and are not resolvable through the domain name system that clearnet search engines rely on. Instead, you use directories and search engines built specifically for onion services, and you verify every address through two independent sources before you enter credentials or send funds.

Directories and search engines that index onion services

Ahmia is a clearnet-accessible search engine that indexes onion services and filters out illegal content. You can search from the clearnet at ahmia.fi or visit its onion mirror directly. Ahmia removes sites that host child abuse material and other clearly illegal content, but it does not verify that every listed service is legitimate. Treat search results as leads, not endorsements.

OnionLand and Torch are onion-only search engines. OnionLand indexes a smaller set of services and provides brief descriptions; Torch indexes a larger number of pages but does not filter content. Both run entirely within the Tor network, so your queries are not logged by a clearnet provider. Neither service verifies the authenticity of listed sites, and both indexes include outdated addresses and phishing mirrors.

The Hidden Wiki is a community-maintained directory that lists onion addresses by category. Multiple versions exist, and many are deliberately poisoned with phishing links. If you choose to use The Hidden Wiki, verify its onion address through two independent sources before you bookmark it. Compare every address you copy from the directory against the service's official clearnet page or a trusted forum thread. A link that worked last month may point to a phishing mirror today.

Why link lists are frequently outdated or poisoned

Onion addresses change when an operator migrates to a new server or loses access to the private key. Community directories rely on volunteers to update links, and there is no automated process to remove dead addresses or flag imposters. An attacker can submit a phishing mirror to a directory and wait for users who do not verify the full 56-character string[1]. The directory maintainer may not notice until someone reports the fake, and by then dozens of people may have entered credentials.

If a directory lists a 16-character address, the link is obsolete. V2 onion services were deprecated in 2021[8][4][5][9], and Tor Browser no longer connects to them. A directory that has not updated its links in three years is not a reliable source for current addresses.

How to verify an address before you use it

Find the service's official clearnet website or a verified social media account. Copy the full 56-character v3 address from that source and compare it character-by-character against the address in the directory[1]. If the service does not publish an onion address on its clearnet site, search for an announcement thread on a forum you trust and cross-check the address with at least one other independent source.

For established services, multiple independent sources will list the same address. For new or niche services, you may find only one source. In that case, bookmark the address but do not enter personal information or payment details until you can confirm it through a second channel. A phishing mirror can copy the design and text, but it cannot copy the exact v3 address without stealing the private key[2][3].

Typical Mistakes That Lead to Exposure or Scams

You know what an onion site is and how to launch Tor Browser, but most exposure and financial loss comes from user errors, not from flaws in the Tor network itself. Each mistake below has appeared in support forums and incident reports; each has a concrete consequence and a rule that prevents it.

Clicking .onion links from clearnet forums without verification

A forum post or Reddit thread lists an onion address for a marketplace, a news mirror, or a file archive. You copy the address, paste it into Tor Browser, and the page loads. The design matches screenshots you have seen, and the text sounds plausible. You create an account or deposit funds, and the site disappears the next day.

Consequence: Phishing mirrors replicate the design and text of legitimate services but use a different 56-character v3 address[1]. An attacker can register a domain on the clearnet, post a fake onion address in multiple forums, and collect credentials or cryptocurrency before anyone notices. The real service cannot recover your funds or your account because the phishing site never connected to it.

Prevention rule: Compare the full 56-character address against two independent sources before you enter credentials or send payment. Find the service's official clearnet website or a verified social media account, copy the address from that source, and check every character[1][3]. If the service does not publish an onion address on its official clearnet site, treat any forum link as unverified until you confirm it through a second channel.

Entering credentials on unverified mirrors

You visit what appears to be the DuckDuckGo onion service or the BBC onion mirror. The page asks you to log in or verify your identity. You type your email address and password, click submit, and the page reloads with an error message. You try again, then close the browser. A week later, someone logs into your clearnet email account using the same credentials.

Consequence: Credential reuse turns a single phishing page into a skeleton key for your other accounts. If you use the same password on the clearnet and on an unverified onion service, an attacker can test that combination against popular email providers, social media platforms, and payment services. Even if the onion service itself is legitimate, a man-in-the-middle attack or a compromised exit relay can capture credentials sent over an unencrypted connection inside the Tor network.

Prevention rule: Create a separate account for every onion service, and use a unique password generated by a password manager. Do not reuse credentials from your clearnet accounts. Public mirrors such as the BBC onion service do not require a login to read articles; if a page asks for credentials when the official service does not, you are on a phishing mirror.

Downloading files from unknown onion services

You find a software archive or a document repository on an onion site. The page offers a download link for a tool you need. You click the link, save the file, and open it. Your antivirus software does not flag it, so you assume it is safe. A month later, you notice unusual network activity or missing cryptocurrency from a wallet stored on the same computer.

Consequence: Malware delivered through an onion service can bypass signature-based detection because the file has no prior reputation and no known hash. Tor hides your route through the network, but it does not scan downloaded files for exploits, keyloggers, or remote-access tools. If the file modifies your system or installs a backdoor, your operational security collapses even if you followed every other rule correctly.

Prevention rule: Download files only from onion services operated by organizations with a verified clearnet presence. Check the file hash against the official source before you open it, and run the file in a disposable virtual machine or on a separate computer that does not hold sensitive data. If the service does not publish file hashes or signatures, treat the download as untrusted and do not execute it on your primary system.

Assuming all onion sites are illegal or all are safe

Two opposite misconceptions cause different problems. The first: you believe that visiting any onion site is illegal, so you avoid Tor entirely or use it only for activities you consider high-risk. The second: you believe that because Tor is legal and privacy-focused, every onion service must be safe or at least tolerated by law enforcement.

Consequence of the first misconception: You miss legitimate privacy tools and information sources. The Congressional Research Service confirms that using Tor is legal in the United States[12][7], and running a Tor relay is also legal[13]. Organizations such as the BBC, Facebook, and the CIA operate onion services to serve users in censored regions or to protect source confidentiality. Avoiding these services because of a mistaken belief that Tor itself is illegal leaves you reliant on clearnet channels that may be monitored or blocked.

Consequence of the second misconception: You assume that because a site is reachable through Tor, it must be either legal or undetectable. Law enforcement agencies operate honeypots, infiltrate marketplaces, and trace cryptocurrency transactions. Accessing child abuse material, purchasing controlled substances, or committing fraud remains illegal regardless of the network you use[7]. Tor hides your route; it does not grant immunity from prosecution.

Prevention rule: Understand that Tor is a tool, not a legal shield. Use onion services for privacy, research, and access to information in censored environments. Do not use them to commit acts that are illegal on the clearnet. If you are unsure whether an activity is lawful in your jurisdiction, consult local regulations or legal advice before you proceed.

Legal Status and Practical Boundaries

Using Tor and visiting onion sites is legal in most jurisdictions, including the United States and the United Kingdom[12][7]. The Tor network was originally created by the U.S. Naval Research Laboratory in 2002[12], and government agencies continue to use it for operational security. Running a Tor relay, including an exit relay that allows people to anonymously send and receive traffic, is legal under U.S. law[13]. The Freedom of the Press Foundation confirms that there is nothing illegal about using the Tor anonymity network in the United States, and notes that government actors depend on it—for example, the CIA hosts an onion service[7].

Legal use of Tor does not make illegal activity legal. Accessing child abuse material, purchasing controlled substances, committing fraud, or engaging in other criminal acts remains illegal regardless of the network you use[7]. Law enforcement agencies operate honeypots, infiltrate marketplaces, and trace cryptocurrency transactions. Documented cases show that mere access to Tor was not prosecuted, but transactions or possession of illegal material led to charges. In 2016, Seattle police mistakenly raided a privacy activist operating a Tor exit relay, but no charges were filed because running the relay itself was lawful[13].

What changes when you leave the US or UK

If you are outside the United States or the United Kingdom, check local laws before you download Tor Browser. Some countries block Tor traffic or criminalise the use of anonymity tools. Your internet service provider can see that you are using Tor, though it cannot see the content of your traffic[12]. Using Tor in conjunction with a VPN may conceal your use of Tor from your ISP, but it does not change the legal status of your activity[12].

The line between legal access and illegal conduct is the same on onion sites as it is on the clearnet. Privacy tools protect your route through the network; they do not grant immunity from prosecution. If an activity is illegal in your jurisdiction, performing it through Tor does not make it lawful.

How to Verify an Onion Site Is Genuine

A phishing mirror can replicate every visual element of a legitimate onion service, but it cannot copy the exact 56-character v3 address without stealing the private key[2][3]. Verification means comparing the full address against a source you trust, not judging the design or the text on the page.

Check the full v3 address against an official clearnet source

Find the organization's public website or verified social media account. Copy the 56-character address from that source and compare it character-by-character against the address in your browser[1]. The Tor Project's own v3 address is 2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion[6]. If you visit a directory that lists a different address for the Tor Project, you know the directory is compromised or outdated.

For example, if you want to verify the BBC's onion mirror, visit the BBC's clearnet site and look for an official announcement or a dedicated page listing the onion address. Copy that address and paste it into a text editor alongside the address from the directory. Check every character. A single changed letter means you are looking at a phishing site.

Look for TLS certificates on onion services that support them

Some onion services present a TLS certificate even though the onion protocol already encrypts traffic end-to-end. Facebook's onion service uses a certificate issued to facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion. When you visit that address in Tor Browser, the browser displays a padlock icon and shows the certificate details. A phishing mirror can copy the page design, but it cannot present a valid certificate for the real address unless it controls the private key.

Not all onion services use TLS certificates, and the absence of a certificate does not mean the site is fake. However, if the official service publishes a certificate fingerprint on its clearnet site, you can compare the fingerprint in Tor Browser's security panel against the published value. A mismatch confirms you are on a phishing mirror.

Use known mirrors published by established organizations

The BBC, Facebook, and The New York Times each operate onion services and publish the addresses on their clearnet websites. These organizations have a reputation to protect and a public presence that makes impersonation costly. When you visit one of these mirrors, you can verify the address against the official clearnet announcement and trust that the service is genuine.

If a news organization or a privacy tool does not publish an onion address on its official clearnet site, treat any address you find in a directory or forum as unverified. Bookmark the address, but do not enter credentials or payment details until you confirm it through a second independent channel. A phishing mirror cannot survive long if multiple independent sources refuse to list it, but a single compromised directory can send thousands of users to a fake site before anyone notices.

What Onion Sites Cannot Do for You

Onion sites route your traffic through three relays and encrypt each layer, but they do not make you invisible. Tor hides your IP address from the destination server and hides the destination from your internet service provider, yet it does not protect you from mistakes you make after the connection is established. If you log into a personal account, share identifying details, or download malware, the anonymity Tor provides collapses at the point where you reveal yourself.

Onion sites do not encrypt traffic beyond the Tor exit node

When you visit a clearnet website through Tor, your traffic exits the network at the final relay and travels to the destination server. If the site uses plain HTTP instead of HTTPS, that last hop is unencrypted and visible to anyone monitoring the exit relay or the network between the relay and the server. Onion services eliminate the exit node because the connection terminates inside the Tor network, so this risk does not apply when you visit a .onion address. However, if an onion service links to a clearnet resource—an image hosted on a third-party server, a payment processor, or an embedded video—your browser fetches that resource through an exit relay, and the same unencrypted-hop risk returns.

What this means for you: Tor Browser blocks many third-party requests by default, but you must check the security level in the shield icon and avoid sites that load external clearnet content when you need full protection. Tor does not scan or filter the data you send; it only hides the route.

Logging into personal accounts links your identity to the session

If you open Tor Browser, connect to an onion site, and log into your Facebook account, your email address, or any service tied to your real identity, you have told that service who you are. The site operator now knows your account name, and if the service logs IP addresses or browser fingerprints, it can correlate your Tor session with your clearnet activity. Law enforcement or a civil litigant can subpoena those logs, and the anonymity Tor provided for the network route becomes irrelevant because you identified yourself at the application layer.

The Congressional Research Service notes that some internet service providers can see that you are using Tor, though they cannot see the content[12]. If you log into a personal account over Tor and then access the same account from your home IP address, an observer with access to both the ISP logs and the service logs can link the two sessions. Tor hides your location during the Tor session; it does not erase the fact that the same account appeared in both places.

What this means for you: Create separate accounts for use over Tor, with usernames and email addresses that contain no personal information. Do not log into clearnet accounts when you need anonymity. If a service requires a phone number or government ID for registration, it is not compatible with anonymous use.

Onion sites do not protect you from malware or social engineering

Tor routes packets through three relays. It does not inspect the content of a downloaded file, scan for viruses, or block a phishing page that asks for your password. If you download an executable from an onion service and run it, any malware in that file will execute with the same privileges as any other program on your computer. If a phishing mirror convinces you to enter your credentials, the attacker captures them regardless of how many hops your traffic took to reach the fake site.

Tor Browser includes some defenses: it blocks JavaScript by default at higher security levels, disables plugins, and isolates each .onion domain in a separate circuit. These features reduce the attack surface, but they do not eliminate it. A carefully crafted exploit that targets a vulnerability in Firefox or in Tor Browser itself can compromise your system even if you never leave the Tor network.

What this means for you: Verify every onion address against an official clearnet source before you enter credentials or download files. Use a password manager to generate unique passwords for each onion service, so a compromised site cannot unlock your other accounts. Run untrusted downloads in a disposable virtual machine, and do not store sensitive data on the same system you use to browse onion sites. Tor hides your route; operational security is your responsibility.

Onion sites are a tool for privacy, not a guarantee of safety. You remain responsible for the information you share, the files you open, and the accounts you access. Understanding these limits lets you use Tor effectively without expecting protection it was never designed to provide.

Typical Mistakes and Misconceptions

Most guides to onion sites focus on where to find addresses. Few explain how to verify an address before you trust it, how to recognize a dead link, or what the legal picture actually looks like. These gaps lead to predictable mistakes.

Trusting a 56-character address without verifying it

People copy an onion address from a forum post, a search engine result, or a directory and assume it is genuine because it looks correct. An attacker can register a different onion service, publish a similar-looking address, and wait for users to arrive. If you enter credentials or send funds to that service, the operator receives them.

Compare all 56 characters against an official source before you connect. For a known organization, find the address on its clearnet website or in two independent directories. If the address appears only in one forum post, treat it as unverified.

Assuming all onion addresses are still valid

Many older guides list v2 onion addresses, which were 16 characters long. Tor deprecated v2 services because the underlying technologies are vulnerable to attacks and are no longer maintained[4]. As of an October 19, 2021 code change, Tor treats v2 addresses as bad hostnames that cannot be used on a SOCKS connection[5].

If you try to open a 16-character address in a current Tor Browser, the connection fails. The address is not temporarily down; it is structurally unsupported. Look for a 56-character v3 address instead, and verify it through the same channels you would use for any other service.

Believing that onion sites make you anonymous by default

Tor hides your IP address from the service you visit and from your ISP[12]. It does not hide information you volunteer. Logging in with a personal account, sending an email from an address that contains your name, or uploading a document with metadata exposes your identity to the recipient.

Create a separate account that is not linked to your real name, phone number, or payment method if you need anonymity. Strip metadata from files before you upload them. Treat every piece of information you provide as visible to the service, because it is.

Thinking that accessing the dark web is illegal

Using Tor and visiting onion sites is legal in the United States[7]. The Congressional Research Service notes that Tor was originally created by the U.S. Naval Research Laboratory as a tool for anonymous communication[12]. Government actors depend on the network; the CIA hosts an onion service[7].

What is illegal is the same as on the clearnet: purchasing controlled substances, accessing child abuse material, or committing fraud. Tor hides your IP address, not your legal liability. Law enforcement can and does investigate crimes that involve onion services[13].

Assuming a familiar name means a genuine service

A phishing mirror can copy the design, logo, and text of a legitimate onion service. The only reliable identifier is the full 56-character address. A single-character difference is enough to redirect you to an attacker-controlled server.

Check the address bar character by character before you enter credentials or send funds. Bookmark verified addresses so you do not need to search for them again. If a service claims to be operated by a known organization but the address does not match the one published on that organization's clearnet site, do not proceed.

Expecting onion sites to work without preparation

People download Tor Browser from a third-party site, skip signature verification, and connect to the first address they find. A modified browser can route your traffic through an attacker's infrastructure or log your activity. An unverified address can be a phishing mirror or a scam market.

Download Tor Browser only from the official Tor Project website, where the connection is secured with HTTPS[10]. Verify the download's OpenPGP signature before you run it[11]. Start with a low-risk target: a directory like Ahmia or a known organization's onion mirror, not a market or a service that asks for credentials.

Conclusions

• Check the full 56-character address against a clearnet source and a second directory before you trust any onion site[1].

• Download Tor Browser only from the official Tor Project page and verify its signature before you open it[10][11].

• Create a separate account and remove file metadata; Tor hides your route, not the details you type or upload[12].

• Treat legal risk separately from technical privacy: visiting onion sites is legal in the US, but illegal transactions remain prosecutable[7].

We suggest you open Ahmia inside Tor Browser and bookmark one verified directory from List of Onion Sites: Explore the Dark Web Safely.