A service reached through Tor
An onion service is a website or other network service made reachable through the Tor network. Instead of using a conventional public domain resolved through the ordinary Domain Name System, it uses a special address derived from cryptographic keys.
Tor Browser recognizes that address type and builds a Tor connection to the service. The visitor and the service meet through the network without requiring either side to expose a direct connection to the other.
The Tor Project’s overview of onion services explains the protocol through introduction points, signed service descriptors, and a rendezvous point.
What the address represents
A current onion-service hostname is long because it contains information tied to the service’s public key. The hostname is therefore part of the service’s identity.
That has two important consequences:
- A correctly entered address provides strong assurance that the connection reached the holder of the corresponding private key.
- A single changed character normally produces a different or invalid address.
The cryptographic property does not tell you whether the operator is honest. It tells you that the service controlling that address is the service you reached.
How the connection differs from ordinary browsing
For a conventional website, a browser usually asks DNS for an IP address and then connects to a server. Onion services do not expose a conventional public destination in the same way. Both the visitor and the service create Tor circuits, and the connection is joined within the Tor network.
According to the Tor Project, traffic between a Tor user and an onion service is end-to-end encrypted and authenticated by the onion-service identity. See Tor Browser’s onion-service feature guide.
Why organizations operate onion counterparts
Legitimate uses include:
- reaching information during censorship;
- providing an authenticated alternative route to a publication;
- accepting confidential submissions;
- reducing exposure of a service’s network location;
- offering privacy-conscious access to an established organization;
- publishing software or documentation through a separate authenticated channel.
SecureDrop is a well-known example of a system that media and civil-society organizations can operate for confidential source communication. Its public directory explains the verification and maintenance status of participating instances.
What onion services do not guarantee
An onion service does not automatically provide:
- truthful content;
- legal compliance;
- safe downloads;
- competent security;
- honest commerce;
- anonymity after a user identifies themselves;
- protection from every browser or endpoint vulnerability.
The address authenticates the destination, not the destination’s claims.
Access method
Use Tor Browser obtained through the Tor Project’s official channels. Ordinary browsers do not natively resolve onion-service addresses. Public Tor2web-style gateways remove important privacy and authentication benefits and should not be used for credentials, payments, uploads, or sensitive activity.
The Tor Project’s glossary explicitly notes that Tor2web does not provide the protections a client receives through Tor Browser: Tor Project glossary.
A simple mental model
Think of an onion address as a cryptographic door label. Tor Browser can find the door without requiring a public street address. Reaching the correct door does not tell you what happens inside, so verification and ordinary judgment remain essential.