How to Find and Verify Links on Tor

A Tor link, or onion address, is a special URL ending in .onion that routes through the Tor network and points to a hidden service. Unlike regular websites, onion addresses are cryptographically generated and extremely long, typically 56 characters in the modern v3 format. This design makes them resistant to censorship and DNS hijacking, but it also makes them hard to remember and easy to spoof. When you visit a .onion address, your traffic is encrypted and routed through multiple Tor nodes, masking your IP address and location. The address itself does not reveal the server's physical location. However, the length and randomness of onion addresses mean that users often rely on directories, bookmarks, or third-party lists to find them. This dependency creates a vulnerability: if you get a link from an unverified source, you may be visiting a clone or phishing site instead of the real service.

The Tor Project maintains official documentation and does not publish a centralized directory of onion sites, because doing so would create a single point of attack. Instead, legitimate services publish their own onion addresses on their official clearnet websites, usually with PGP signatures to prove authenticity. For example, a news organization or privacy tool will announce its onion address on its main site, often with a cryptographic signature that you can verify using the organization's public key. The Useful Resources page on this site aggregates links to verified onion services and explains how to check PGP signatures. When searching for links for Tor browser, start by checking the official clearnet presence of the service you want to access. Look for a dedicated onion address announcement, not a link buried in a forum post or Reddit thread. If a service has an official onion mirror, it will be prominently displayed alongside instructions on how to verify it.

Phishing clones are fake onion sites designed to look identical to legitimate services. They exist to harvest usernames, passwords, cryptocurrency wallets, or personal data. Because onion addresses are random and unreadable, attackers rely on users mistyping the address or trusting an unverified link. A common tactic is to register a similar-looking address and host a pixel-perfect copy of the real site. When you log in, your credentials go straight to the attacker. To avoid this, always verify the onion address before entering any sensitive information. Bookmark the correct address from an official source the first time you visit. Use the Tor browser's built-in address bar to double-check the full URL before submitting any form. If you found the link on Reddit, in a Discord server, or on a third-party directory, cross-reference it with the official clearnet site or a PGP-signed announcement. Never assume a link is real just because it appears in multiple places; clones can be promoted widely.

PGP signatures are the gold standard for verifying that an onion address is legitimate. When an organization publishes its onion address, it often includes a cryptographic signature created with its private key. You can verify this signature using the organization's public key, which is publicly available. If the signature is valid, you know the address came from that organization and has not been tampered with. To verify a PGP signature, you need a PGP tool such as GnuPG installed on your computer. The process involves importing the organization's public key, then checking the signature against the signed message. Most organizations provide step-by-step instructions on their websites. If you are new to PGP, this may feel technical, but it is the most reliable way to confirm you have the correct onion address. Alternatively, look for onion addresses published on the organization's official clearnet site with HTTPS and a valid SSL certificate, which provides a baseline of authenticity. The Useful Resources page on this site includes links to verified onion services with instructions on how to verify each one.

The onion space is fragmented and constantly shifting. Services go offline, move to new addresses, or are seized by law enforcement. Directories become outdated within weeks. According to Tor Project documentation on onion service stability, many hidden services are experimental or temporary, and users should expect links to break. Public law-enforcement press releases on darknet operations show that when a major service is shut down, users often encounter clones or scams claiming to be the successor. Academic research on onion service security has found that phishing and credential theft are the most common attacks against onion users, more common than malware or network-level attacks. This matters because it means your biggest risk is not your Tor connection being compromised, but you visiting the wrong address and handing over your data voluntarily. Always assume that any link you find, even on a reputable forum or directory, could be outdated or fake. Verify before you trust.

Communities on Reddit, Discord, and specialized forums discuss Tor links and onion services. These sources can be useful for discovering new services or learning about recent changes, but they are also prime targets for scammers and infiltrators. When you see a link shared on best Tor links Reddit threads or in a Discord server, treat it as a starting point, not a confirmation. Check the source: is the person posting a known contributor with a history of accurate information, or a new account with no credibility. Look for multiple independent mentions of the same address across different communities. If only one person is promoting a link, be skeptical. Cross-reference with official sources before using the link. Some communities maintain curated lists of verified onion addresses with verification steps included. These are more reliable than random posts, but they still require you to do the final verification yourself. Never assume that because a link appears in a community discussion, it is safe or current.

Before visiting any onion address, take basic security precautions. Run the Tor browser in a virtual machine or use a dedicated device if you are accessing sensitive services. Disable JavaScript in the Tor browser settings to reduce the attack surface. Keep your operating system and all software up to date. Do not maximize your browser window, as this can reveal your screen resolution and help attackers fingerprint you. Do not open files downloaded from onion sites unless you have scanned them with antivirus software and understand what they do. Use strong, unique passwords for each onion service you access, and consider using a password manager. If a service asks for personal information, assume that information could be compromised. Never assume that using Tor makes you invisible to the service itself; the server can still log your behavior and correlate your activity. The Tor browser protects your IP address and location, but it does not protect you from your own mistakes. Treat onion sites with the same caution you would use on any untrusted website, and assume that many are honeypots or data-harvesting operations.

The most reliable way to manage Tor links is to build a personal collection of verified addresses and store them securely. Start by identifying the onion services you actually need: news outlets, privacy tools, communication platforms, or research resources. For each one, find the official clearnet announcement and verify the onion address using PGP or by checking the official website directly. Bookmark the address in your Tor browser, or store it in an encrypted note-taking app. Create a simple checklist for each link: source of the address, date verified, PGP signature status, and last confirmed working date. Update this list periodically by revisiting the official sources to check for address changes. When you discover a new link through a community source, add it to your collection only after you have verified it. This approach takes time upfront but saves you from the constant risk of phishing. Over time, you will develop a curated set of links that you trust and can rely on. Share your verified collection with trusted contacts, but always encourage them to verify the addresses themselves rather than trusting your list blindly.