The dark web is one of the most misunderstood parts of the internet. Much of the confusion comes from not understanding the technology underneath it: the onion services that power .onion addresses on the Tor network. This article explains how these addresses actually work, why they look the way they do, and what that means for privacy and safety.
What an Onion Address Actually Is
A modern .onion address is not a marketing name or a random string chosen by a website owner. It is a cryptographic identity. When someone sets up an onion service, their software generates a public and private key pair. The 56-character address you see (ending in “.onion”) is derived directly from the service’s public key. This is why onion addresses look like unreadable strings of letters and numbers rather than memorable words.
This design has an important security property: the address itself proves you are talking to the correct server. Because the name is derived from the key, an attacker cannot simply register a look-alike domain and impersonate a service the way they can with ordinary websites. Version 3 onion addresses, the current standard, use strong elliptic-curve cryptography for this purpose.
Why Onion Addresses Are Hard to Verify
The strength of onion addresses is also a usability problem. Because the addresses are long and random, humans cannot easily tell a genuine address from a fake one. Two addresses can differ by a single character and lead to completely different servers. Scammers exploit this by publishing addresses that resemble a legitimate service, hoping users will not notice the difference.
For this reason, the safest way to obtain an onion address is directly from the organization that runs the service, over their verified clearnet website or an official signed source. Copying addresses from random directories or forum posts is risky, because there is no built-in way to confirm they are authentic.
How a Connection Is Established
Connecting to an onion service is different from visiting a normal website. There is no public IP address to look up. Instead, the service publishes information to a distributed directory within the Tor network, and the client and server each build encrypted circuits to a shared meeting point. Neither side learns the other’s real network location. This end-to-end design is what allows both the visitor and the operator to remain anonymous.
Legitimate Uses of Onion Services
Onion services are not only used for hidden or illicit activity. Many mainstream and public-interest organizations run them for privacy and censorship resistance:
- News organizations operate onion mirrors so readers in censored regions can reach reporting safely.
- SecureDrop, used by major newspapers, lets sources share documents with journalists more securely.
- Privacy tools and email providers offer onion access so users are not exposed at the network edge.
- Human-rights and anti-censorship groups rely on onion services to stay reachable when clearnet domains are blocked.
Staying Safe
Understanding the technology is the first step to using it responsibly. If you explore Tor, use the official Tor Browser, keep it updated, and treat any unverified address with suspicion. Never enter personal information on a site you cannot confirm, and remember that anonymity software does not make illegal activity legal. The goal of this resource is education: knowing how onion addresses work helps you recognise scams, protect your privacy, and think critically about the hidden web.