Onion Sites on GitHub: How to Find Verified .onion Directories

GitHub repositories dedicated to onion sites typically catalog working .onion addresses organized by category: search engines, forums, news outlets, privacy tools, and archived historical references. These repositories are maintained by volunteers and security researchers who test links and document their status. A well-maintained GitHub onion list will include the onion address, a brief description, the last verified date, and sometimes PGP fingerprints or checksums for additional verification.

The appeal of GitHub-hosted lists is transparency. You can see the commit history, who made changes, and when addresses were added or removed. Some repositories also include mirrors of the best onion sites list in multiple formats: plain text, JSON, or markdown. This makes it easier to import addresses into your Tor browser bookmarks or reference them offline. However, GitHub repositories are public, which means anyone can fork them and create convincing clones with malicious .onion addresses substituted in.

Never assume a GitHub repository is legitimate just because it ranks high in search results. Verify the repository owner's history, check when it was created, and look for signs of active maintenance. A repository with only one commit from a brand-new account is a red flag. Cross-reference addresses against multiple independent sources: the official Tor Project documentation, PGP-signed announcements from the service operator, and other established onion sites list repositories.

When you find an onion address on GitHub, follow these steps before using it:

1. Copy the .onion address exactly as listed
2. Check the repository's commit history for recent updates
3. Search for the service name plus "onion address" on the official Tor Project site or the service's clearnet domain
4. Compare the address against at least one other GitHub repository or trusted source
5. If the service publishes a PGP key, verify the fingerprint matches documentation you trust
6. Test the address in Tor Browser and confirm the site's content matches what you expect

This multi-step approach catches most phishing attempts. Attackers often create repositories with names that closely mimic legitimate ones, so attention to detail matters.

GitHub's role as a code repository makes it an obvious place for researchers to publish onion directories. The platform offers version control, which means the history of changes is preserved and visible. This transparency helps the security community spot when a repository has been compromised or when someone has forked it to inject malicious addresses. Developers also use GitHub to host tools that help users find and verify onion sites: Tor address validators, mirror checkers, and scripts that test whether a .onion link is responding.

From a legal and operational standpoint, GitHub is a neutral platform that does not curate the content of public repositories. This means researchers can publish lists of onion addresses without fear of censorship, though GitHub will remove repositories that facilitate illegal activity if reported. The platform's API also allows developers to build applications that automatically check GitHub-hosted lists and alert users to changes.

According to Tor Project documentation on onion service security, the primary risk with any public onion directory is that attackers can create convincing forks or mirrors with altered addresses. A repository named "onion-sites-list-github" that looks almost identical to the real one can trap users who do not verify the URL carefully. Many users bookmark the wrong repository or copy an address from a search result snippet without checking the source.

A second pitfall is outdated information. Onion services go offline, change addresses, or get seized. A GitHub list that has not been updated in six months may contain dead links or addresses that now point to phishing clones. Law enforcement actions also affect onion sites: when a marketplace or forum is shut down, its address becomes a liability rather than a resource. Repositories that do not document the verification date or status of each link leave users guessing whether an address is still safe to use.

Third, GitHub repositories can be forked by bad actors who then submit pull requests with malicious changes. If you are reading a repository that has many unmerged pull requests or a backlog of issues, it may indicate the maintainer is inactive or overwhelmed. This creates an opportunity for confusion about which version is authoritative. Always check the main branch and the repository owner's profile before trusting the content.

Start by searching GitHub directly for repositories related to onion sites and Tor. Look for repositories with multiple contributors, recent commits, and clear documentation. Repositories maintained by established security researchers or organizations tend to be more reliable than single-author projects. Check the README file for information about how the list is maintained, who verifies the addresses, and how often it is updated.

Some repositories focus on specific categories: onion sites reddit discussions might be documented in a repository that archives Reddit threads about Tor, while .onion sites link collections may be organized by service type. The best onion sites list repositories usually include a disclaimer that the maintainer cannot guarantee the safety of any address and that users should verify independently. This honesty is a sign of a responsible maintainer.

When evaluating a GitHub onion directory, ask yourself: Does the owner have a track record in security or privacy? Are there multiple independent forks that agree on the same addresses? Does the repository include instructions for verifying addresses using PGP or other cryptographic methods? Repositories that answer these questions positively are more likely to be trustworthy than those that do not.

Once you have identified a legitimate GitHub-hosted onion list, use it as a reference only, not as a direct bookmark source. Copy addresses one at a time and verify each one before adding it to your bookmarks. Open Tor Browser, paste the address into the address bar, and wait for the page to load. Legitimate onion sites display a Tor Browser security indicator and load without excessive redirects or warnings.

Keep a local copy of the GitHub repository or the raw text file for offline reference. This protects you if GitHub becomes inaccessible or if the repository is taken down. You can clone a repository using Git or download the raw files directly. Store this copy in an encrypted container or on a device that is not connected to the internet when you are not actively using it.

When you encounter an onion address from a GitHub list that does not work, do not assume the list is compromised. The service may simply be offline temporarily, or the address may have changed. Check the repository's issues section to see if other users have reported the same problem. If multiple addresses from the same repository are dead, that is a sign to find a different source.

Phishing clones of popular GitHub onion lists are common. An attacker will fork a legitimate repository, change some addresses to point to phishing sites, and then promote the clone through search results or social media. To spot a clone, compare the repository URL carefully: the owner name and repository name must match exactly. GitHub URLs follow the pattern github.com/username/repository-name. If the username is slightly different (for example, "onion-sites-github1" instead of "onion-sites-github"), it is likely a clone.

Check the repository's creation date and the owner's account age. A repository created yesterday by an account that is one week old is suspicious. Look at the commit history: does it show gradual development over months or years, or is it a sudden dump of content? Legitimate repositories have a natural history of changes and improvements. Clones often appear fully formed with no prior history.

Finally, compare the addresses in the repository against other sources. If a GitHub list contains onion addresses that no other source mentions, or if the addresses differ from what you find on the official Tor Project site, that is a red flag. Use the .onion sites reddit community or established onion sites 2026 directories as cross-references to validate what you find on GitHub.

The core takeaway is simple: GitHub-hosted onion lists are useful reference tools, but they are only as trustworthy as the person who maintains them and the diligence you apply when using them. Before visiting any .onion address from a GitHub repository, spend two minutes verifying it through at least one independent source. Check the repository's commit history, compare the address against other lists, and confirm that the site's content matches what you expect when you visit it in Tor Browser.

Start by visiting the Tor Project's official resources page to understand how to identify legitimate onion services. Then, search GitHub for onion site repositories that have been active for at least a year and have multiple contributors. Bookmark the repository itself, not the individual onion addresses it contains. This way, you can check for updates and verify addresses each time you use them. Taking these precautions now will save you from phishing attacks and wasted time chasing dead links.