Working Onion Sites: How to Find and Verify Them

Onion sites are web services hosted on the Tor network and accessed via .onion addresses. These addresses are generated from cryptographic keys and appear as random alphanumeric strings followed by .onion. Unlike regular websites, onion sites have no central hosting provider; they run on volunteer nodes and the operator's own infrastructure. Sites go offline for several reasons: operators shut them down voluntarily, server hardware fails, the host loses internet connectivity, or law enforcement takes action. Some sites are intentionally temporary. Others migrate to new addresses to avoid tracking or phishing. A working onion site remains responsive to connection requests and serves content without timeout errors. Uptime varies widely—some sites are stable for years, while others disappear within weeks.

Phishing clones are fake copies of legitimate onion sites designed to steal credentials, private keys, or funds. They often use similar names or slightly altered addresses to deceive users. To verify a genuine onion site: (1) Check the official PGP-signed announcement or documentation from the site operator—legitimate projects publish their v3 address on multiple channels; (2) Compare the full .onion address character-by-character with the official source; (3) Look for HTTPS certificates issued for the .onion domain (Tor Browser displays a green lock for valid certs); (4) Verify PGP signatures on any downloadable files using the operator's public key; (5) Cross-reference the site address in multiple independent directories or community forums. Never assume a site is legitimate based on appearance alone. Scammers replicate interfaces, logos, and layouts convincingly. Always start from an official announcement or trusted source, not from a search result or random link.

v3 onion addresses are 56-character .onion URLs introduced in 2017 to replace the older v2 format (16 characters). v3 addresses use stronger cryptography (Ed25519 keys instead of RSA) and are resistant to brute-force attacks and address harvesting. The longer format makes them harder to remember but significantly more secure. A v3 address encodes the public key directly into the address, so the site operator cannot forge or spoof it without changing the entire address. This means if you bookmark a v3 address or receive it from an official source, you can trust that connection goes to the intended operator's server. v2 addresses are deprecated and no longer supported by modern Tor Browser versions. When evaluating onion sites, prefer v3 addresses. If a site still uses v2 or claims to be a mirror of a v3 site but uses a different address format, treat it as suspicious.

When you connect to an onion site through Tor Browser, your traffic is routed through at least three randomly selected relays before reaching the destination. The site operator sees only the exit node's IP address, not your real location or identity. Onion sites themselves are hidden: they do not advertise their IP address publicly. Instead, they use introduction points—Tor relays that receive connection requests on behalf of the hidden service. Your Tor client builds a rendezvous circuit to meet the onion site's introduction points, and the two circuits connect through a rendezvous point. This architecture means neither you nor the site operator can easily identify each other without additional mistakes. The Tor network does not log traffic by design, though individual relays may keep temporary records. Using Tor Browser's default security settings provides strong protection against traffic analysis and IP leakage. However, security depends on correct configuration—disabling JavaScript, using full-screen mode, and avoiding plugins are essential.

Even on Tor, user behavior can leak identity. Common mistakes include: (1) Maximizing your browser window—this reveals screen resolution, which can fingerprint you; (2) Enabling plugins or extensions—they may bypass Tor or execute code that reveals your IP; (3) Typing personal information into forms—usernames, email addresses, or real names link your activity to your identity; (4) Disabling JavaScript protection in Tor Browser settings—malicious sites can exploit JavaScript to discover your real IP; (5) Using the same username across multiple onion sites—this creates a trackable identity; (6) Torrenting files through Tor—BitTorrent clients often leak your real IP regardless of Tor; (7) Adjusting Tor Browser's window size or zoom level—these settings are unique identifiers; (8) Visiting onion sites while also using your regular browser logged into personal accounts—this creates a timing correlation. Treat each onion site visit as a separate session. Clear Tor Browser cache between visits if handling sensitive material. Use a dedicated device or virtual machine for high-risk activities.

Tor, VPN, and I2P are three different anonymity tools, each with distinct trade-offs. Tor routes traffic through multiple volunteer-run relays and is designed for anonymity against network-level surveillance; it is the only tool that can access .onion sites natively. VPN services encrypt traffic to a single provider's server, which then forwards it to the destination; they are faster than Tor but require trusting the VPN operator with your traffic. I2P is a decentralized network similar to Tor but optimized for internal communication and file-sharing; it does not support .onion addresses and is less suitable for general web browsing. For accessing onion sites, Tor Browser is the standard and most secure choice. Using a VPN in addition to Tor (VPN before Tor or Tor before VPN) adds complexity and may reduce anonymity if misconfigured. I2P cannot access .onion sites at all. If your goal is to reach onion sites safely, use Tor Browser alone with default settings. If you want additional privacy from your ISP, use Tor; a VPN adds a layer of trust that may not be necessary.

Uptime verification requires direct connection attempts or aggregated monitoring data. Torsites.biz maintains a directory of onion sites with periodic uptime checks—each entry shows the last confirmed connection status and response time. To manually verify if an onion site is working: (1) Open Tor Browser; (2) Paste the .onion address into the address bar; (3) Wait for the connection attempt to complete (usually 10–30 seconds); (4) If the page loads, the site is currently online; (5) If you see a connection timeout or error, the site is offline or unreachable. Note that temporary network issues or Tor relay congestion can cause false negatives. Try again after a few minutes. Some sites intentionally go offline periodically for maintenance. Check the site's official social media or announcement channels for status updates. Never assume a site is permanently dead after a single failed connection. Directories like this one aggregate multiple uptime checks over time, giving a more reliable picture than a single attempt. Always cross-reference multiple sources before concluding a site is defunct.