How to Access .onion Sites (Also Known as Tor Hidden Services)

Website addresses that end in “.onion” aren’t like normal domain names, and you can’t access them with a normal web browser. Addresses that end with “.onion” point to Tor hidden services on the deep web. Lots of deep web sites contain very nasty things, and many of them are likely scams or illegal. You should probably avoid freely browsing .onion sites—instead, use this only if you have a specific site you want to access for a good reason.

What Is a .onion Site?

Sites that use the .onion top-level domain are privacy-focused websites that are only accessible using the Tor network.

Tor—”short for the onion router”—is an anonymizing computer network. It’s partially funded by the US government, and is designed to help people in countries where Internet access may be censored or monitored. When you connect to Tor, your internet activity is sent through the Tor network, anonymizing your Internet activity so it can’t be snooped on, and so that you can access websites that may be blocked in your country.

So, when you access Google.com through Tor, your request bounces from Tor relay to Tor relay before it reaches an exit node. That exit node then contacts Google.com for you, and it sends you back the data Google responded with. Google sees this as the exit node’s IP address contacting it instead of your IP address.

But that means that “last mile” of traffic can be snooped on by an organization monitoring or even running the exit nodes—especially if your traffic is unencrypted. A .onion address points to a Tor hidden service, which is a server you can only access through Tor. This means that your browsing activity can’t be snooped on by someone watching the Tor exit nodes. It also means that someone hosting a website can hide that server using the Tor network, so no one can find it—in theory.

For example, Proton, a company famous for its privacy-focused cloud services, maintains an onion address at “https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion”.

Facebook maintains an official Tor hidden services address at “facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion”.

This allows you to access Facebook through Tor, and your connection doesn’t ever leave Tor where it can be snooped on. This may be useful in countries that block Facebook, for example.

You don’t necessarily want to use Tor all the time, as it’s noticeably slower than normal browsing, but it’s a useful tool for anonymizing your Internet activity and bypassing censorship.

How to Access .onion Sites with the Tor Browser

To access a .onion address, you’ll need to access it through the Tor Browser. It’s a modified version of Firefox that’s configured to connect to sites through the Tor network.

Related

10 Firefox Config Setting to Tweak for Improved Performance and Privacy

Firefox has a lot of customization options to make it truly yours.

Download the Tor Browser from the Tor project’s website to continue. It’s available for Windows, Mac, Linux, and Android.

The Tor project still offers no official Tor apps for iPhone or iPad, but some third-party apps are available in Apple’s App Store.

After launching the Tor browser, type the .onion address into its address bar. For example, to access Proton’s hidden service, you’d enter the following address:

https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion

Or, to access the DuckDuckGo search engine’s hidden service, you’d enter:

https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/

While using the Tor browser, you can click links to .onion addresses and they’ll load normally. But they’ll only work in the Tor browser, while connected to Tor.

Don’t Access .onion Sites Through Proxies

You can also access .onion sites without running Tor through proxies that connect to Tor for you. The proxy connects to Tor for you and then forwards you the traffic over the regular Internet.

This, however, is a very bad idea! You’re losing the anonymity you normally have when you connect to a .onion site through the Tor browser. That’s the whole point of a .onion address, after all. The website you access maintains its anonymity, but someone monitoring your connection can see which website you’re connecting to. The service provider can also see what you’re connecting to and try to snoop on any information you may provide.

Tor2web functions in this way, but you shouldn’t use it unless you know exactly what you’re doing. Many .onion sites will even give you a security warning if you try to access them using that sort of service.

Looking for lists of .onion sites? Search the web for lists of .onion sites and you’ll find some places to start. Many of the directories of .onion sites are themselves stored on .onion sites, though, which you can only access through Tor.

Again, beware: Lots of .onion sites contain very nasty things, and many of them are likely scams. We recommend staying away from them, if possible. Try to avoid randomly browsing through .onion sites using Tor, and instead connect directly to specific sites you need or want to access.