Onion Sites 2026: Finding and Verifying .onion Addresses Safely

An .onion site is a hidden service hosted on the Tor network, accessible only through the Tor browser. The .onion domain is not a real top-level domain; it's a special-use top-level domain that resolves only within Tor, using a cryptographic address derived from the site's public key. When you visit an .onion address, your traffic is routed through multiple Tor relays, and the server's location is hidden from you and from network observers.

Onion sites come in two versions: v2 addresses (16 characters, deprecated since 2021) and v3 addresses (56 characters, the current standard). V3 addresses use stronger cryptography and are resistant to certain attacks that affected v2. The Tor Project maintains the technical standards; site operators generate their own .onion addresses and maintain them independently. This means there is no central registry of legitimate onion sites, and no authority can verify an address for you. Verification is your responsibility.

Because .onion addresses are long, random strings with no human-readable meaning, users cannot easily distinguish a real address from a fake one by looking at it. A scammer can create a new .onion address in seconds and host a pixel-perfect copy of a popular marketplace or forum. Users who mistype an address, click a malicious link, or rely on search results often land on the clone instead of the real site.

Phishing clones typically steal login credentials, cryptocurrency, or personal information. They may also distribute malware. The attacker profits immediately and disappears. Real onion site operators combat this by publishing their official .onion address on PGP-signed announcements, on their clearnet mirrors (if they maintain one), or on trusted community channels. However, many users skip this verification step because it requires extra effort. The result is that phishing losses on onion sites are common and often irreversible.

Verification requires multiple steps and should be done before you enter any credentials or send any funds:

1. Find the official .onion address from the site operator's PGP-signed announcement, not from a search engine or forum post.
2. Check the PGP signature using the operator's public key (available on their clearnet site or from a trusted key server).
3. Compare the .onion address character-by-character with the one in the signed message; do not rely on visual similarity.
4. Visit the address only through the Tor browser, never through a clearnet proxy or VPN.
5. Check for HTTPS and a valid certificate (Tor browser will warn you if the certificate is self-signed or invalid).
6. Look for the site operator's official security notices or status page, which should be linked from the homepage.

If you cannot find a PGP-signed announcement or the signature does not verify, do not proceed. A legitimate site will always publish its address through a verifiable channel. If a site claims to be a marketplace or forum but offers no way to verify its address, treat it as a phishing clone.

The Tor browser is the only recommended way to access .onion sites. It is a modified version of Firefox that routes all traffic through the Tor network and includes security hardening. Download it only from the official Tor Project website, never from a mirror or third-party source.

When using the Tor browser to visit onion sites, follow these practices: disable JavaScript in the security settings (high security level) to reduce attack surface; do not maximize your browser window (fingerprinting prevention); do not open multiple tabs to the same site (reduces correlation); do not install plugins or extensions; do not change your Tor browser settings unless you understand the consequences. Each time you close and reopen the Tor browser, you receive a new Tor circuit, which is a security feature. Do not disable this behavior. If a site requires you to disable security features or install software, it is likely a scam.

The Tor Project's documentation confirms that .onion sites are not inherently safer than clearnet sites; they are simply hidden. Anonymity does not equal trustworthiness. Law-enforcement agencies have successfully seized onion marketplaces and forums by identifying operators through operational security failures, not by breaking Tor encryption. Court records from high-profile cases show that site operators often made mistakes such as reusing usernames, logging in from clearnet IP addresses, or failing to use cryptocurrency mixers, which led to identification and prosecution.

Security-vendor incident reports consistently show that phishing clones and exit scams are the most common ways users lose money on onion sites, not Tor browser vulnerabilities. This matters because it means your security depends on your own verification habits, not on Tor's technical strength. The Tor network itself is robust, but the human layer is fragile. Additionally, many onion sites that appear in search results or community recommendations are inactive, abandoned, or honeypots (sites run by law enforcement to collect evidence). Visiting an old address may connect you to a completely different operator than the one who originally ran the site.

Several onion sites catalog and index services exist, but none are authoritative. The Hidden Wiki is a community-maintained directory of onion links, but entries are not verified and may be outdated or malicious. Ahmia and Torch are onion search engines that index publicly available .onion sites, but their results include phishing clones and abandoned sites alongside legitimate ones. Reddit communities such as r/onions discuss onion sites, but posts are not moderated for accuracy and often contain phishing links.

The best approach is to find the specific site you are looking for through its official clearnet mirror or PGP-signed announcement, rather than browsing a general directory. If you must use a search engine or directory, cross-reference the address with multiple sources and verify the PGP signature before visiting. Treat any .onion address you find in a search result as unverified until you confirm it through an official channel. This is slower than clicking a link, but it is the only reliable way to avoid phishing.

The most common mistake is assuming that using Tor automatically makes you anonymous and safe. Tor protects your IP address from the site you visit, but it does not protect you from malware, phishing, or your own mistakes. If you log into a personal account (email, social media, cryptocurrency wallet) over Tor, you reveal your identity to that service. If you download a file and open it without checking it, you may execute malware. If you visit an onion site and enter credentials, you are trusting that site's operator not to steal them.

Other mistakes include: visiting onion sites from a shared computer (other users may see your history); using the same username or email across multiple onion sites (correlation); enabling plugins or extensions in the Tor browser (attack surface); connecting to Tor from a network that logs traffic (your ISP or employer may see that you are using Tor, even if they cannot see what you do); and assuming that a site is safe because it has been around for a long time (longevity does not equal legitimacy). Before visiting any onion site, ask yourself: why do I need to visit this site over Tor, and what could go wrong if I enter my information here. If you cannot answer both questions clearly, do not proceed.

The core takeaway is this: an .onion address is just a string of characters, and anyone can create one. The only thing that separates a real site from a phishing clone is verification. Before you visit any onion site, find its official address through a PGP-signed announcement or official clearnet mirror, verify the signature, and compare the address character-by-character with what you are about to visit. This takes five minutes and prevents the vast majority of phishing losses.

Start today by identifying one onion site you want to visit. Search for its official PGP-signed announcement using your clearnet browser. If you cannot find one, the site may not be legitimate or may no longer be operating. If you do find a signed announcement, download the operator's public key, verify the signature, and only then open the Tor browser and visit the address. This single habit will protect you far more than any other security measure.