Hidden Services (.onion)

Hidden services are the websites of the darknet. Unlike ordinary servers, a hidden service is designed so that no one — not the visitor, not the network, not law enforcement — can determine the server's real IP address. Visitors reach it through a cryptographic .onion address. This article explains how that works and why organizations from the BBC to the FBI have built them.

What a hidden service is

In normal web hosting, the server must announce its IP address for clients to reach it. A hidden service reverses the direction of connection: the service reaches out to the Tor network and registers itself, while keeping its true IP address secret. Clients then connect to the network, not to the server directly, and the network bridges the two sides anonymously.

The result is a website that:

• has no discoverable IP address or hosting location;
• is reachable only through the Tor Browser (or Tor-enabled clients);
• can be taken down only by seizing the physical device running it — which is exactly what law enforcement tries to do.

Anatomy of an .onion address

An .onion address is not a random string. It is a cryptographic identifier: a hash (fingerprint) of the service's public key. In the legacy v2 scheme, addresses were 16 characters; the modern v3 format uses 56 characters, for example:

3a2vz7x9c4q1w8e6r5t2y9u3i0o7p4s6d8f2g5h7j1k3l4...onion

The v3 format (introduced in 2021) uses stronger elliptic-curve cryptography, making it resistant to the "harvesting" attacks that hit v2 addresses. Because the address is derived from the key, it cannot be faked: whoever controls the private key controls the address — the same trust model as an HTTPS certificate, but without a central authority.

How the connection is made

Connecting to a hidden service uses a two-stage protocol with special Tor nodes:

1. Advertise. The service builds a circuit to several introduction points and publishes their addresses, together with its own public key, in a distributed descriptor database (the "hash ring"). No real IP address is ever published.
2. Introduce. Your client, also using Tor circuits, fetches the descriptor, picks an introduction point, and sends a message through it offering a secret one-time meeting code.
3. Rendezvous. Both sides build a separate circuit to the same random rendezvous point, which connects them using the meeting code. From that moment, traffic flows end-to-end between the two anonymous circuits, and neither side ever learns the other's identity.

The whole handshake happens in seconds, invisibly, inside the Tor Browser. Both the visitor and the service use Tor, which is why hidden services are immune to the classic "compromised exit node" attack: there is no exit node in the path.

Where hidden services live

Hidden services run on ordinary computers — often cheap dedicated servers, compromised machines, or "bulletproof" hosting providers that ignore abuse requests. Some services change servers frequently or use onion-hosting providers, which rent hardware that is already wired into Tor. The physical location is the secret law enforcement must discover, which is why market operators historically took extreme operational-security measures. (See how markets were finally taken down.)

Legitimate .onion services

The darknet is not only markets. Many respected organizations run hidden services specifically to protect their audiences:

• Newsrooms — The New York Times, BBC, ProPublica, Deutsche Welle and others publish .onion versions so readers in censored countries can access journalism safely.
• Whistleblowing platforms — SecureDrop instances used by hundreds of news organizations allow sources to leak documents anonymously.
• The CIA — The U.S. Central Intelligence Agency runs an official .onion site so that informants in hostile countries can reach it without being tracked.
• Privacy services — Proton Mail and others offer .onion access points.
• Facebook — Facebook has operated an official .onion site since 2014 for users behind restrictive firewalls.

The existence of these services is the single strongest counterargument to the claim that the darknet exists only for crime. Censorship resistance is a public good — one that criminals inevitably also benefit from.

Risks and takedowns

Hidden services are only as anonymous as their operators. Takedowns succeed through three routes:

Hidden services are also targets of their own communities: DDoS-for-hire campaigns routinely knock markets offline, and fake "clone" .onion sites phish for credentials. The technology hides where a service is — it does not hide the human errors of whoever runs it. (Learn how to stay safe.)