.onion

Special-use top-level internet domain January 2020 the top-level internet domain the bulbous vegetable onion .onion Tor-logo-2011-flat.svg 2004 Host suffix Not in root, but used by Tor clients, servers, and proxies Tor To designate an onion service reachable via Tor Used by Tor users for services in which both the provider and the user are anonymous and difficult to trace Addresses are "registered" automatically by Tor client when an onion service is set up Names are opaque strings generated from public keys RFC 7686 Tor design document Special Hostnames in Tor specification N/A .onion is a special-use top-level domain name designating an anonymous onion service, which was formerly known as a "hidden service",Winter Philipp How Do Tor Users Interact With Onion Services? https://nymity.ch/onion-services/pdf/sec18-onion-services.pdf 27 December 2018 reachable via the Tor network. Such addresses are not actual DNS names, and the .onion TLD is not in the Internet DNS root, but with the appropriate proxy software installed, Internet programs such as web browsers can access sites with .onion addresses by sending the request through the Tor network. The "onion" name refers to onion routing, the technique used by Tor to achieve a degree of anonymity. The purpose of using such a system is to make both the information provider and the person accessing the information more difficult to trace, whether by one another, by an intermediate network host, or by an outsider. Sites that offer dedicated .onion addresses may provide an additional layer of identity assurance via EV HTTPS Certificates or Domain-validated HTTPS certificates.Tor Project HTTPS for your Onion Service https://community.torproject.org/onion-services/advanced/https/ 2026-02-22 community.torproject.org Provision of an onion site also helps mitigate SSL stripping attacks by malicious exit nodes on the Tor network upon users who would otherwise access traditional HTTPS clearnet sites over Tor.Tor Project How do Onion Services work? https://community.torproject.org/onion-services/overview/ https://web.archive.org/web/20260204193505/https://community.torproject.org/onion-services/overview/ 2026-02-04 2026-02-22 community.torproject.org Onion service traffic is encrypted from the client to the onion host. This is like getting strong SSL/HTTPS for free. Because connections to onion services do not use exit relays, they are not subject to exit node tampering.Tor Project HTTPS for your Onion Service https://community.torproject.org/onion-services/advanced/https/ https://web.archive.org/web/20260219135311/https://community.torproject.org/onion-services/advanced/https/ 2026-02-19 2026-02-22 community.torproject.org When visiting a site over the Onion Services protocol, the Tor protocol prevents data in transit from being read or manipulated by man in the middle attacks, and the Onion Service protocol validates that the user is connected to the domain name in the browser address bar. No certificate authority is required for this proof, because the name of the service is the actual public key used to authenticate the underlying connection. Format Addresses in the onion TLD are generally opaque, non-mnemonic, alpha-numerical strings which are automatically generated based on a public key when an onion service is configured. These strings can be made up of any letter of the alphabet, and decimal digits from 2 to 7, representing in base32 either an 80-bit hash ("version 2", or 16-character) or a 256-bit ed25519 public key along with a version number and a checksum of the key and version number ("version 3", "next gen", or 56-character). As a result, in the past all combinations of sixteen base32 characters could potentially be valid version 2 addresses (though as the output of a cryptographic hash, a randomly selected string of this form having a corresponding onion service should be extremely unlikely), while in the current version 3 only combinations of 56 base32 characters that correctly encoded an ed25519 public key, a checksum, and a version number (i.e., 3) are valid addresses.https://spec.torproject.org/rend-spec/encoding-onion-addresses.html Encoding onion addresses [ONIONADDRESS] spec.torproject.org 15 August 2026 It is possible to set up a partially human-readable .onion URL (e.g. starting with an organization name) by generating massive numbers of key pairs (a computational process that can be parallelized) until a sufficiently desirable URL is found.https://github.com/lachesis/scallion Scallion GitHub 2 November 2024https://archives.seul.org/tor/talk/Oct-2014/msg00433.html Re: Facebook brute forcing hidden services Simple End-User Linux tor-talk 31 October 2014 2 November 2014 Muffett, Alec Beginning in October 2021, stable releases of Tor software no longer support V2 (16 character) addresses.V2 Onion Services Deprecation https://support.torproject.org/onionservices/v2-deprecation/ Tor Project | Support 7 July 2024 WWW to .onion gateways Proxies into the Tor network like Tor2web allow access to onion services from non-Tor browsers and for search engines that are not Tor-aware. By using a gateway, users give up their own anonymity and trust the gateway to deliver the correct content. Both the gateway and the onion service can fingerprint the browser, and access user IP address data. Some proxies use caching techniques that claim to provide better page-loadinghttps://onion.cab/?a=why https://web.archive.org/web/20140521220306/https://onion.cab/?a=why dead 21 May 2014 Onion.cab: Advantages of this TOR2WEB-Proxy 21 May 2014 than the official Tor Browser. .exit (defunct pseudo-top-level domain) .exit was a pseudo-top-level domain used by Tor users to indicate on the fly to the Tor software the preferred exit node that should be used while connecting to a service such as a web server, without having to edit the configuration file for Tor (torrc). The syntax used with this domain was hostname + .exitnode + .exit, so that a user wanting to connect to http://www.torproject.org/ through node tor26 would have to enter the URL http://www.torproject.org.tor26.exit. Example uses for this would include accessing a site available only to addresses of a certain country or checking if a certain node is working. Users could also type exitnode.exit alone to access the IP address of exitnode. The .exit notation was deprecated as of version 0.2.9.8.https://gitweb.torproject.org/tor.git/tree/ReleaseNotes Tor Release Notes 4 October 2017 It is disabled by default as of version 0.2.2.1-alpha due to potential application-level attacks,https://gitweb.torproject.org/torspec.git/tree/address-spec.txt Special Hostnames in Tor 30 June 2012 and with the release of 0.3-series Tor as "stable"Tor 0.3.2.9 is released: We have a new stable series! https://blog.torproject.org/tor-0329-released-we-have-new-stable-series The Tor Project 7 May 2018 may now be considered defunct. Official designation The domain was formerly a pseudo-top-level domain host suffix, similar in concept to such endings as .bitnet and .uucp used in earlier times. On 9 September 2015 ICANN, IANA and the IETF designated .onion as a 'special use domain', giving the domain an official status following a proposal from Jacob Appelbaum of the Tor Project and Facebook security engineer Alec Muffett.Willis Nathan 10 September 2015 Tor's .onion domain approved by IETF/IANA https://lwn.net/Articles/657056/ LWN.netFranceschi-Bicchierai Lorenzo Internet Regulators Just Legitimized The Dark Web https://www.vice.com/en/article/internet-regulators-just-legitimized-the-dark-web/ 10 September 2015 10 September 2015Special-Use Domain Names https://www.iana.org/assignments/special-use-domain-names/special-use-domain-names.xhtml 10 September 2015 HTTPS support Prior to the adoption of CA/Browser Forum Ballot 144, an HTTPS certificate for a .onion name could only be acquired by treating .onion as an Internal Server Name.CA/Browser Forum Ballot 144 – Validation rules for .onion names 18 February 2015 https://cabforum.org/2015/02/18/ballot-144-validation-rules-dot-onion-names/ 13 September 2015 Per the CA/Browser Forum's Baseline Requirements, these certificates could be issued, but were required to expire before 1 November 2015.Baseline Requirements for the Issuance and Management Publicly-Trusted Certificates, v1.0 https://cabforum.org/wp-content/uploads/Baseline_Requirements_V1.pdf 13 September 2015 14 January 2016 https://web.archive.org/web/20160114183223/https://www.cabforum.org/wp-content/uploads/Baseline_Requirements_V1.pdf dead Despite these restrictions, DuckDuckGo launched an onion site with a self-signed certificate in July 2013;We've updated our Tor hidden service to work over SSL. No solution for the cert. warning, yet! https://www.reddit.com/r/duckduckgo/comments/1hdqs6/weve_updated_our_tor_hidden_service_to_work_over/ Reddit r/duckduckgo _zekiel 1 July 2013 20 December 2016 https://web.archive.org/web/20150428033600/https://www.reddit.com/r/duckduckgo/comments/1hdqs6/weve_updated_our_tor_hidden_service_to_work_over/ 28 April 2015 live Facebook obtained the first SSL Onion certificate to be issued by a Certificate authority in October 2014,Muffett Alec Making Connections to Facebook more Secure https://www.facebook.com/notes/protect-the-graph/making-connections-to-facebook-more-secure/1526085754298237 11 September 2015 31 October 2014 https://web.archive.org/web/20141031130553/https://www.facebook.com/notes/protect-the-graph/making-connections-to-facebook-more-secure/1526085754298237 31 October 2014 dead Protect the Graph Facebook Blockchain.info in December 2014,Alyson Improved Security for Tor Users https://blog.blockchain.com/2014/12/03/improved-security-for-tor-users/ 11 September 2015 3 December 2014 https://web.archive.org/web/20141220203411/https://blog.blockchain.com/2014/12/03/improved-security-for-tor-users/ 20 December 2014 dead Blockchain.info blog and The Intercept in April 2015.Lee Micah Our SecureDrop System for Leaks Now Uses HTTPS https://theintercept.com/2015/04/08/securedrop-tor-hidden-service-now-uses-https/ 10 September 2015 8 April 2015 https://web.archive.org/web/20151225060727/https://theintercept.com/2015/04/08/securedrop-tor-hidden-service-now-uses-https/ 25 December 2015 live The Intercept The New York Times later joined in October 2017, but discontinued the site in April 2025. https://open.nytimes.com/https-open-nytimes-com-the-new-york-times-as-a-tor-onion-service-e0d0b67b7482 The New York Times is Now Available as a Tor Onion Service Runa Sandvik Sandvik Runa 4 March 2025 27 October 2017 NYT Open blog 26 April 2026 https://web.archive.org/web/20260426004507/https://open.nytimes.com/https-open-nytimes-com-the-new-york-times-as-a-tor-onion-service-e0d0b67b7482?gi=3fe55bdc6c90 26 April 2026 live Following the adoption of CA/Browser Forum Ballot 144 and the designation of the domain as 'special use' in September 2015, .onion meets the criteria for RFC 6761.Arkko Jari .onion https://www.ietf.org/blog/2015/09/onion/ 13 September 2015 10 September 2015 Certificate authorities may issue SSL certificates for HTTPS .onion sites per the process documented in the CA/Browser Forum's Baseline Requirements,Baseline Requirements Documents 4 September 2013 https://cabforum.org/baseline-requirements-documents/ 13 September 2015 introduced in Ballot 144. As of August 2016, 13 onion domains are https signed across 7 different organisations via DigiCert.Jamie Lewis Sarah OnionScan Report: July 2016 – HTTPS Somewhere Sometimes https://mascherari.press/onionscan-report-july-2016-https-somewhere-sometimes/ 15 August 2016 7 August 2016 See also .tor .i2p .bit Darknet Dark web GlobaLeaks List of Tor onion services Onion routing References 30em External links https://www.torproject.org/projects/torbrowser.html.en Tor Browser Anonymous browsing via Tor, used to access .onion sites Tor Project https://www.torproject.org/docs/tor-onion-service.html Tor: Onion Service Configuration Instructions Tor Project https://gitweb.torproject.org/torspec.git?a=blob_plain;hb=HEAD;f=rend-spec.txt Tor Rendezvous Specification Tor Project 8 March 2011 15 May 2017 https://web.archive.org/web/20170515211621/https://gitweb.torproject.org/torspec.git?a=blob_plain;hb=HEAD;f=rend-spec.txt dead Alex Biryukov Ivan Pustogarov Ralf-Philipp Weinmann 2013 IEEE Symposium on Security and Privacy https://www.ieee-security.org/TC/SP2013/papers/4977a080.pdf Trawling for Tor Hidden Services: Detection, Measurement, Deanonymization https://cabforum.org/2015/02/18/ballot-144-validation-rules-dot-onion-names/ Ballot 144 CA/Browser Forum 18 February 2015 Category:Dark web Category:Internet properties established in 2004 Category:Top-level domains Category:Tor (anonymity network) sv:Toppdomän#Generiska toppdomäner