Onion Links V3: Complete Directory and Technical Reference

V3 onion addresses represent the third generation of Tor hidden service identifiers. Introduced in 2019, they replaced v2 addresses due to cryptographic improvements. A v3 address is 56 characters long and uses base32 encoding, compared to v2's 16 characters. The longer format accommodates stronger elliptic-curve cryptography, specifically Ed25519 keys, which resist quantum computing threats better than the RSA keys used in v2. V3 addresses also include built-in version information and checksum validation, reducing the risk of typos leading to phishing clones. Every legitimate onion service now operates on v3 infrastructure, making them essential for anyone navigating the darknet securely.

When a hidden service operator starts an onion service, the Tor daemon generates a v3 address by creating a key pair and deriving the address from the public key. The address itself is a hash of the service's public key, meaning the same service always produces the same address. When you visit an onion link in Tor Browser, your client connects to Tor's distributed directory to locate introduction points for that service. Tor then builds a circuit through multiple relays and connects to the hidden service through rendezvous points, ensuring both the user and the service remain anonymous. This process happens transparently; you simply enter the address in your browser. The v3 protocol uses improved directory protocols and better protects against traffic analysis compared to v2.

An onion links database or finder tool helps users locate active services, but verification is critical. Legitimate onion links should be obtained from official sources: project websites, verified mirrors, or community documentation. When you find an onion link, check for these markers of authenticity: the address should be exactly 56 characters, the site should use HTTPS (shown as a lock icon in Tor Browser), and the content should match what you expect. Many projects publish PGP-signed announcements confirming their official onion address. Cross-reference any address across multiple independent sources before trusting it. Phishing clones often use similar-looking addresses with subtle character substitutions, so careful comparison is essential. Bookmarking verified addresses in Tor Browser prevents accidental visits to fraudulent mirrors.

Users often make errors that undermine the security v3 addresses provide. Clicking onion links from untrusted sources exposes you to phishing clones that harvest credentials or install malware. Disabling Tor Browser security settings to access certain sites removes protections against JavaScript attacks and fingerprinting. Mixing Tor and clearnet browsing in the same session can leak identifying information through browser history or cookies. Using the same username across multiple onion services allows correlation attacks that link your identities. Visiting onion sites without updating Tor Browser leaves you vulnerable to known exploits. Enabling plugins or extensions in Tor Browser increases attack surface. Always use Tor Browser in its default configuration, verify addresses before visiting, and treat each onion service as a separate identity.

Tor Browser is the only browser designed to safely access onion links. It routes all traffic through the Tor network, protects against fingerprinting, and includes security features specific to hidden services. Attempting to access onion links in Chrome, Firefox, or other standard browsers will fail because they lack Tor connectivity. Some users install Tor locally and configure a SOCKS proxy, but this approach requires careful setup and still lacks Tor Browser's protections. Browser extensions claiming to enable onion access in Chrome are unreliable and often malicious. The Tor Project officially recommends Tor Browser as the only safe method. Using alternative browsers exposes you to IP leaks, fingerprinting, and malware. Always download Tor Browser from the official Tor Project website, verify its signature, and keep it updated.

Phishing clones are fraudulent copies of legitimate onion sites designed to steal credentials or spread malware. They often use addresses with characters substituted to resemble the original (for example, replacing 'l' with '1'). To identify genuine mirrors: obtain the address from the official project source, not from third-party directories alone. Check the site's SSL certificate in Tor Browser by clicking the lock icon; legitimate services use valid certificates. Compare the site's content, layout, and functionality against the official version. Legitimate projects publish their official onion addresses prominently on their clearnet sites and in signed announcements. If a site asks for credentials immediately or displays unusual warnings, it is likely a clone. Never enter sensitive information without confirming the address matches official documentation. Bookmarking verified addresses prevents accidental visits to fraudulent sites.

Tor, VPN, and I2P are distinct anonymity networks with different strengths. Tor is designed for accessing hidden services and provides strong anonymity through a large, decentralized network of volunteer relays. It is the only network that natively supports onion links and v3 addresses. VPNs encrypt your traffic and route it through a commercial server, hiding your IP from websites but not providing the same level of anonymity as Tor; VPN providers can see your traffic and are subject to legal requests. I2P is optimized for peer-to-peer communication and internal network services, not for accessing external websites. To access onion links securely, Tor is the correct choice. Combining Tor with a VPN adds complexity and may reduce anonymity if misconfigured. Use Tor Browser for onion links, and understand that each network serves different purposes.