Live Onion Links: Current Directory of Active .onion Addresses

Live onion links refer to .onion addresses that are actively running and reachable at any given moment. Unlike static lists, live links require regular verification because onion services frequently go offline due to server maintenance, law enforcement takedowns, or voluntary shutdowns. The Tor network's decentralized nature means no central authority maintains a master list of working addresses. Users must rely on community-maintained directories, mirrors, and direct testing to confirm uptime. Stale or outdated links waste time and expose users to phishing clones—fraudulent mirrors designed to steal credentials or inject malware. Verification involves checking SSL certificates, PGP signatures, and comparing multiple sources to confirm authenticity.

Onion addresses are 56-character alphanumeric strings (v3 format) that route traffic through multiple Tor relays before reaching the hidden service. When you connect to a .onion address, your Tor browser establishes a circuit through at least three relays, encrypting data at each layer. The final relay never learns your real IP address; the hidden service never learns your location. Tor uses onion routing, a technique where each relay removes one layer of encryption, revealing only the next hop. V3 addresses replaced v2 addresses in 2021 and offer stronger cryptography. The .onion domain is reserved by IANA specifically for use with Tor. This architecture makes onion services resistant to censorship and surveillance, but also means addresses can change if the service relocates or regenerates its key.

Phishing clones are fraudulent copies of legitimate onion sites designed to harvest login credentials, cryptocurrency, or personal data. Several verification methods reduce this risk. First, check the official project documentation or social media channels for the correct .onion address and any PGP-signed announcements. Second, compare the site's SSL certificate fingerprint against known sources; legitimate mirrors publish these publicly. Third, examine the site's content for spelling errors, outdated information, or unusual design changes—clones often contain subtle inconsistencies. Fourth, use multiple independent directories to cross-reference addresses; if only one source lists an address, treat it with suspicion. Fifth, verify PGP signatures on any security notices or updates. Never assume a .onion address is legitimate based on appearance alone. Test functionality with non-sensitive data before logging in or submitting information.

Verification begins with obtaining the official .onion address from the project's primary website or official social media account, not from third-party directories alone. Many projects publish PGP-signed announcements confirming their correct address and warning against clones. To verify a signature, import the project's public key into your PGP client, then decrypt the signed message. If the signature is valid, the message has not been tampered with. Check the key fingerprint against multiple independent sources to confirm you have the correct key. For sites without PGP signatures, cross-reference the address across at least three separate, well-maintained directories. Document the address and its verification date. If a site changes its address, official channels will announce this with signed messages. Treat any address change with skepticism unless confirmed through multiple trusted sources and signed documentation.

Users often undermine their own anonymity through preventable errors. Running plugins or extensions in the Tor browser can leak your real IP or fingerprint your browser; disable all non-essential add-ons. Maximizing your browser window reveals your screen resolution, which can be used to identify you across sites; keep it at default size. Visiting onion sites over an unencrypted connection (http instead of https) exposes traffic to exit node operators; always verify SSL certificates. Mixing Tor and non-Tor traffic in the same session creates timing correlations that can deanonymize you; use separate browsers or virtual machines. Logging into accounts with identifying information (real names, email addresses) defeats anonymity; use unique, anonymous credentials per site. Torrenting over Tor leaks your real IP because BitTorrent bypasses the Tor browser; never torrent through Tor. Assuming Tor alone provides security without proper OpSec is dangerous; combine Tor with other practices like using a dedicated virtual machine or operating system.

Tor, VPN, and I2P are distinct technologies with different strengths. Tor routes traffic through volunteer-operated relays and is designed specifically for anonymity and accessing .onion services; it is slower but offers strong privacy guarantees. VPNs encrypt traffic to a single provider's server, offering privacy from your ISP but requiring trust in the VPN operator; they are faster than Tor but do not access .onion addresses natively. I2P is a decentralized network similar to Tor but optimized for internal communication rather than accessing external internet; it offers strong anonymity for I2P-to-I2P communication but limited integration with standard web browsing. For accessing live onion links, Tor is the only practical choice because .onion addresses are routed exclusively through the Tor network. VPNs can complement Tor by hiding your Tor usage from your ISP, but they cannot replace Tor for onion access. I2P cannot access .onion addresses directly.

Operational security (OpSec) means minimizing information leakage through deliberate practices. Use the Tor browser exclusively for onion access; do not mix it with regular browsing. Keep your operating system and all software fully patched; unpatched vulnerabilities can be exploited to reveal your IP. Use a dedicated virtual machine or operating system for sensitive onion activity, isolating it from your main system. Disable JavaScript in the Tor browser settings to prevent scripts from bypassing Tor. Cover your webcam and disable microphone access. Never maximize your browser window or change default settings that could fingerprint you. Use strong, unique passwords for each onion service account. Assume any onion site could be operated by law enforcement or malicious actors; never upload identifying documents or real personal information. If you encounter illegal content or suspect a site is a honeypot, disconnect immediately and do not return. Regular backups of your Tor browser configuration help you recover from compromise.