# .onion

**.onion** is a special-use top-level domain name that identifies anonymous services (onion services, historically called hidden services) reachable only through the Tor network. Instead of being resolved through the [Domain Name System](https://www.edgepedia.org/domain-name-system), the label before the suffix is derived from the service's own cryptographic key, so the name simultaneously locates and authenticates the service.<sup>[1](https://www.rfc-editor.org/info/rfc7686/)</sup> Regular browsers cannot open .onion sites because they are not part of the standard DNS.<sup>[2](https://www.techradar.com/how-to/how-to-get-started-with-tor-browser)</sup>

| Key fact | Detail |
|---|---|
| Status | Registered as a special-use domain name by RFC 7686 (October 2015), authored by J. Appelbaum (The Tor Project) and A. Muffett (Facebook)<sup>[1](https://www.rfc-editor.org/info/rfc7686/)</sup> |
| Resolution | Not resolved via DNS; the name functionally corresponds to the service's identity, combining location and authentication<sup>[1](https://www.rfc-editor.org/info/rfc7686/)</sup> |
| v3 address format | base32 of a 32-byte Ed25519 public key, a 2-byte checksum, and a version byte (0x03), giving 56 characters before the suffix<sup>[3](https://tpo.pages.torproject.net/core/torspec/rend-spec/encoding-onion-addresses.html)</sup> |
| Ownership | Names cannot be registered, assigned, transferred or revoked; ownership derives solely from control of the corresponding private key<sup>[1](https://www.rfc-editor.org/info/rfc7686/)</sup> |
| Connection path | Six Tor relays: three chosen by the client (the third being the rendezvous point) and three chosen by the service<sup>[4](https://community.torproject.org/onion-services/overview/)</sup> |
| Version history | v2 addresses (16 characters) became unreachable after September 2021; v3 was specified in 2017 and released with Tor 0.3.2.9 on 2018-01-09<sup>[5](https://support.torproject.org/ka/onionservices/v2-deprecation/)</sup><sup> • </sup><sup>[6](https://onionservices.torproject.org/technology/timeline/)</sup> |
| Scale | Approximately 886,000 v3 onion services were reported by Tor Project metrics material in 2022<sup>[7](https://community.torproject.org/static/files/intro-onion-service-2022.pdf)</sup> |

## The special-use domain name

RFC 7686, published in October 2015, registered ".onion" in the IANA registry of special-use domain names under RFC 6761.<sup>[1](https://www.rfc-editor.org/info/rfc7686/)</sup> The document states that .onion names provide access to end-to-end encrypted, anonymized services in which the server's identity and location are obscured from the client and the client's location is obscured from the server; the client's identity may or may not be disclosed through an optional cryptographic authentication process.<sup>[1](https://www.rfc-editor.org/info/rfc7686/)</sup>

Because the Tor network has no central authority for routing or service publication, .onion names cannot be registered, assigned, transferred, or revoked. Ownership of a name comes only from control of the public/private key pair from which the name is algorithmically derived.<sup>[1](https://www.rfc-editor.org/info/rfc7686/)</sup> The names are self-authenticating: the cryptographic label is derived from the server's keys in a client-verifiable manner during connection establishment, and the label is not intended to be human-meaningful.<sup>[1](https://www.rfc-editor.org/info/rfc7686/)</sup> Like ordinary top-level domains, .onion names may carry arbitrary subdomain components, which are meaningless to the Tor protocol but usable by application protocols such as HTTP.<sup>[1](https://www.rfc-editor.org/info/rfc7686/)</sup>

The RFC also imposes handling requirements on DNS software: recursive resolvers not adapted to interoperate with Tor should not look up records for .onion names and must generate NXDOMAIN for such queries, and authoritative DNS servers must respond to .onion queries with NXDOMAIN.<sup>[1](https://www.rfc-editor.org/info/rfc7686/)</sup>

## Address format

A version 3 (v3) onion address encodes the service's identity public key, a version field, and a checksum:<sup>[3](https://tpo.pages.torproject.net/core/torspec/rend-spec/encoding-onion-addresses.html)</sup>

\[ \text{onion\_address} = \text{base32}(\text{PUBKEY} \mid \text{CHECKSUM} \mid \text{VERSION}) + \text{".onion"} \]

\[ \text{CHECKSUM} = H(\text{".onion checksum"} \mid \text{PUBKEY} \mid \text{VERSION})[:2] \]

Here PUBKEY is the 32-byte Ed25519 master public key of the service, VERSION is a one-byte field with default value 0x03, and the checksum is truncated to two bytes. The result is a 56-character base32 domain name.<sup>[3](https://tpo.pages.torproject.net/core/torspec/rend-spec/encoding-onion-addresses.html)</sup> The address looks random because it is the service's identity public key.<sup>[4](https://community.torproject.org/onion-services/overview/)</sup>

The length increase from v2 to v3 was deliberate. V2 addresses were 16 characters because they contained only the hash of a public key; v3 addresses contain a full Ed25519 public key, which both strengthens the cryptography and enlarges the address space enough to eliminate the brute-force prefix attacks that were practical against v2.<sup>[8](https://blog.torproject.org/v3-onion-services-usage/)</sup><sup> • </sup><sup>[9](https://onionpedia.org/v3-onion-service-specification)</sup> The change also meant every user had to learn or save a new address when v2 services became unreachable after September 2021.<sup>[5](https://support.torproject.org/ka/onionservices/v2-deprecation/)</sup><sup> • </sup><sup>[8](https://blog.torproject.org/v3-onion-services-usage/)</sup>

## How a connection is made

The Tor Rendezvous Specification defines the protocol.<sup>[10](https://onionservices.torproject.org/technology/)</sup> When a client wants to connect, it first chooses a Tor node at random to act as its rendezvous point and builds a circuit to that node. If it lacks an up-to-date descriptor for the service, it contacts an appropriate hidden service directory (HSDir) relay to fetch one. The client then builds an anonymous circuit to one of the service's introduction points listed in the descriptor and passes an introduction request containing the rendezvous point and the first part of a cryptographic handshake. The service, on receiving the request, builds its own anonymous circuit to the rendezvous point and completes the handshake, which gives the two parties a shared key and proves to the client that it is talking to the holder of the service's key.<sup>[11](https://spec.torproject.org/rend-spec/protocol-overview.html)</sup>

The complete connection consists of six relays: three picked by the client, with the third serving as the rendezvous point, and three picked by the service. The rendezvous point relays end-to-end encrypted messages between the two sides.<sup>[4](https://community.torproject.org/onion-services/overview/)</sup>

**Directory privacy in v3.** The hidden service directory is a distributed hash table formed by relays carrying the HSDir flag, providing the information needed to connect to a given address much as DNS does for ordinary domains. In v2, descriptors were uploaded in plain text, so HSDir relays could learn the onion addresses of many services. V3 encrypts this data and derives a daily-rotated identifier, the blinded public key, from the onion address and the current date, so a directory relay cannot simply enumerate services.<sup>[8](https://blog.torproject.org/v3-onion-services-usage/)</sup>

**Practical properties.** Because onion services establish only outgoing connections, they punch through NAT and need no open firewall ports, which matters on university, office, and other filtered networks.<sup>[4](https://community.torproject.org/onion-services/overview/)</sup>

## History

[The Tor Project](https://www.edgepedia.org/the-tor-project)'s timeline counts the onion services concept from a draft specification in 2003, marking a 20th anniversary in 2023 (and again in 2024, counting from the initial implementation). Proposal 224 for a "Next Generation of Onion Services" appeared in 2013, the v3 specification in 2017, and the v3 release in Tor 0.3.2.9 on 9 January 2018. RFC 7686 reserved the .onion name with the IETF in 2015, and CA/Browser Forum ballots in 2015, 2017, and 2020 addressed validation rules and certificates for .onion names.<sup>[6](https://onionservices.torproject.org/technology/timeline/)</sup> Applications built on onion services include GlobaLeaks and Ricochet (2010), SecureDrop (2013), OnionShare (2014), Onionbalance (2015), Briar (2017), and Ricochet-Refresh (2021).<sup>[6](https://onionservices.torproject.org/technology/timeline/)</sup>

## Denial-of-service defense

Because onion services hide IP addresses by design, traditional IP-based rate limiting cannot protect them from denial-of-service attacks. In August 2023, with the release of Tor 0.4.8, the Tor Project introduced a proof-of-work defense: normally dormant, it activates under stress and requires incoming clients to solve successively harder computational puzzles, then prioritizes connections by the effort demonstrated. Initial solve times ranged from about 5 milliseconds on faster computers to 30 milliseconds on slower hardware, rising to roughly one minute of work under heavy attack.<sup>[12](https://blog.torproject.org/introducing-proof-of-work-defense-for-onion-services/)</sup> The mechanism prioritizes verified effort rather than verifying users, raising the cost of large-scale flooding while leaving legitimate users a path in.<sup>[13](https://onionservices.torproject.org/technology/pow/)</sup>

## Usage and misuse

Onion services are used for censorship circumvention and to publish information while hiding a server's location; the [Electronic Frontier Foundation](https://www.edgepedia.org/electronic-frontier-foundation) notes they serve journalists protecting sources, people in countries with censored internet access, and others who benefit from anonymity.<sup>[14](https://www.eff.org/files/2025/08/19/tor_myths_and_facts.pdf)</sup> Major organizations including [DuckDuckGo](https://www.edgepedia.org/duckduckgo) and The New York Times operate official .onion mirrors of their sites.<sup>[2](https://www.techradar.com/how-to/how-to-get-started-with-tor-browser)</sup><sup> • </sup><sup>[15](https://community.torproject.org/static/files/tor-slides-full-deck-2019.pdf)</sup> A widely cited empirical analysis by Gareth Owen and Nick Savage (2016) estimated that illegal sites represented only about 2 percent of sites reachable via Tor.<sup>[16](https://www.lemonde.fr/idees/article/2021/11/12/le-dark-net-sert-aussi-a-communiquer-sans-etre-repere_6101852_3232.html)</sup>

## References

1. [RFC 7686: The ".onion" Special-Use Domain Name (Appelbaum & Muffett, October 2015), RFC Editor](https://www.rfc-editor.org/info/rfc7686/)
2. [How to get started with Tor Browser, TechRadar](https://www.techradar.com/how-to/how-to-get-started-with-tor-browser)
3. [Encoding onion addresses [ONIONADDRESS], Tor Specifications](https://tpo.pages.torproject.net/core/torspec/rend-spec/encoding-onion-addresses.html)
4. [How do Onion Services work?, Tor Project Community](https://community.torproject.org/onion-services/overview/)
5. [V2 Onion Services Deprecation, Tor Project Support](https://support.torproject.org/ka/onionservices/v2-deprecation/)
6. [Onion Services Timeline, The Onion Services Ecosystem](https://onionservices.torproject.org/technology/timeline/)
7. [Introduction to Tor & Onion Services (slide deck, 2022), Tor Project](https://community.torproject.org/static/files/intro-onion-service-2022.pdf)
8. [V3 onion services usage (Tobias Höller, September 21, 2021), Tor Project Blog](https://blog.torproject.org/v3-onion-services-usage/)
9. [V3 Onion Service Specification, The Onion Encyclopedia](https://onionpedia.org/v3-onion-service-specification)
10. [Intro, The Onion Services Ecosystem](https://onionservices.torproject.org/technology/)
11. [Protocol overview, Tor Rendezvous Specification](https://spec.torproject.org/rend-spec/protocol-overview.html)
12. [Introducing Proof-of-Work Defense for Onion Services (August 23, 2023), Tor Project Blog](https://blog.torproject.org/introducing-proof-of-work-defense-for-onion-services/)
13. [Proof Of Work, The Onion Services Ecosystem](https://onionservices.torproject.org/technology/pow/)
14. [TOR: Myths and Facts, Electronic Frontier Foundation](https://www.eff.org/files/2025/08/19/tor_myths_and_facts.pdf)
15. [Onion services (slide deck, 2019), Tor Project](https://community.torproject.org/static/files/tor-slides-full-deck-2019.pdf)
16. [« Le dark Net sert aussi à communiquer sans être repéré », Le Monde (November 12, 2021)](https://www.lemonde.fr/idees/article/2021/11/12/le-dark-net-sert-aussi-a-communiquer-sans-etre-repere_6101852_3232.html)

---
*Topic: Encyclopedia › Technology and the built world › Computing and digital systems › Networks and security › Networking fundamentals and architecture › Routing and addressing › Name addressing and DNS*

*Initially written Sep 17, 2026 · Reviewed: Sep 17, 2026; Oct 15, 2026 · Edited: Oct 15, 2026 · Last review: Oct 15, 2026*

*Copyright 2026 EdgeChat AI, a subsidiary of Biostate AI.*

License: Edgepedia Community License 1.0, https://www.edgepedia.org/edgepedia/license