Onion Services Explained: How Tor .onion Websites Work
Onion services are how many privacy-focused sites run on Tor. You may know them as .onion websites or Tor hidden services. Unlike a normal site that sits at a public IP and domain, an onion service is reached only through the Tor network — and both the visitor and the operator can keep their real network locations out of the path.
This guide is onion services explained in plain language: what they are, what a .onion site is, how onion sites work, how that ties to onion routing, and where the myths stop being useful.
This article describes the technology and its legitimate uses. It does not promote illegal activity.
What Are Onion Services?
An onion service is a website or application that lives inside the Tor network and uses an address ending in .onion. Visitors connect with Tor-compatible software (usually the Tor Browser). The service itself also connects through Tor, so the connection never needs to expose a public server IP the way a normal host does.
Both sides get privacy benefits:
- Visitors do not hand their real IP to the site
- Operators do not publish a conventional hosting location
- Traffic stays inside Tor’s routing model instead of a direct client–server path
That two-sided design is the main difference between Tor onion services and ordinary websites.
What Is a .onion Site?
A .onion site is simply a site whose address ends in .onion and is only usable on Tor. It does not use the usual .com / .org registration system in the same way. The address is derived from cryptographic keys that identify the service on the network.
So instead of something short like example.com, you see a long string of characters ending in .onion. The length is intentional: modern (v3) addresses are built from stronger crypto so the name itself helps authenticate the service. A modern (v3) onion address is a 56-character string ending in .onion.
Onion Services vs the Dark Web
People often treat these as the same thing. They overlap, but they are not identical.
| Term | Meaning |
|---|---|
| Tor network | Privacy network that routes traffic through relays |
| Tor Browser | Software used to connect to Tor |
| Onion service / .onion site | A site or app hosted inside Tor |
| Dark web | Hidden services that need special software to reach (onion sites are a major example) |
Onion services are a technology. The dark web is the broader label for hidden service environments. For the wider map of internet layers, see surface web, deep web, and dark web and our dark web explained guide.
How Onion Sites Work
On a normal site, your browser talks to a server that has a public address. On an onion service, both ends use Tor.
In simplified form:
- The operator runs software that joins the Tor network and creates cryptographic keys for the service.
- Information needed to find that service is published through Tor’s directory mechanisms — without advertising a public IP.
- You enter the .onion address in Tor Browser.
- Tor builds a path so you and the service meet inside the network.
- Neither side needs a direct, location-revealing connection to the other.
That is the practical answer to how onion sites work: rendezvous inside Tor, not a straight line from your ISP to a data center IP.
Onion Routing Explained (Why the Name)
Onion routing means traffic is wrapped in layers of encryption and peeled as it moves through relays — like layers of an onion. Each relay only learns what it needs for the next hop. No single relay is supposed to see both who you are and where you are going.
Onion services build on that idea for the server side as well. The site is not sitting on an open internet address waiting for direct connections; it is reached through the same layered network model. More depth is in our article on how Tor onion routing works.
Cryptography and Modern .onion Addresses
A .onion name is tied to keys the service controls. That helps visitors confirm they are talking to the intended service, not a random impostor who grabbed a similar-looking name on the open web.
Today’s standard is v3 onion addresses: longer, stronger crypto, better resistance to older attacks. Legacy v2 addresses were phased out because their security no longer met modern expectations.
Onion Services vs Normal HTTPS Sites
| Feature | Typical HTTPS site | Tor onion service |
|---|---|---|
| Encryption | Browser ↔ site | Inside the Tor network (end-to-end within Tor’s design) |
| Server location | Often discoverable via hosting | Not published as a normal public IP |
| Visitor IP | Usually visible to the site | Hidden by Tor routing |
| How you open it | Any major browser | Tor Browser (or other Tor-capable clients) |
They are complementary, not substitutes. Some organizations run both a normal site and an onion mirror for users who need the extra privacy path.
Why Onion Services Were Built
The goal was private communication and publishing — not a crime toolkit. Legitimate uses include:
- Anonymous or lower-risk publishing
- Whistleblower and source submission systems
- Access when the open web is censored or heavily monitored
- Privacy-conscious mirrors of public information
- Security research and defensive monitoring
The same properties can be abused. That dual use is familiar: encryption, private messaging, and anonymous mail all have the same pattern.
How People Access Onion Services
You need software that speaks Tor. The usual choice is the Tor Browser. Enter the full .onion address; the browser handles the network path. Standard Chrome, Safari, or Edge installs do not open onion sites by themselves.
Safe habits still apply: official Tor downloads, sensible security levels, caution with unknown links and files. See Tor Browser safety tips and the Tor privacy tools.
Common Myths
“All onion services are illegal.” No. Legality depends on content and behavior, not the .onion suffix.
“Onion services make me fully anonymous.” They provide strong location privacy on the network path. Logging into personal accounts, unique usernames, or malware can still identify you.
“Nothing on onion services can be investigated.” Harder is not the same as impossible. Operational mistakes and traditional investigation still matter.
More Than Just Hidden Marketplaces
Onion services often get a bad rap thanks to all the sensational stories about shady markets, but the truth is, this technology serves as a versatile privacy tool that many reputable organizations rely on. For instance, the BBC, the New York Times, and ProPublica all operate onion mirrors, allowing readers in restricted areas to access their content. Plus, SecureDrop, which is utilized by numerous newsrooms to securely gather information from sources, is entirely based on onion services. Even major platforms have adopted them to combat traffic analysis and censorship.
Onion Services vs VPNs
A VPN encrypts the path from your device to a provider and masks your IP from websites. An onion service is a way to host and reach a site entirely inside Tor’s multi-hop model. Different jobs. For the broader comparison, see Tor Browser vs VPN.
Frequently Asked Questions
What are onion services in simple terms?
Websites or apps that run on Tor, use .onion addresses, and are designed so neither the visitor’s nor the server’s real network location needs to be exposed in the usual way.
What is a .onion site?
A site whose address ends in .onion and is reachable only through Tor-compatible software.
How do onion sites work?
Both client and service use Tor. Connections are arranged inside the network using cryptographic identities, instead of a public IP and a direct browser-to-server path.
Are onion services illegal?
The technology is not. What people host or do on a service can be legal or illegal, just like on the open web.
Can normal browsers open .onion sites?
Not without Tor support. Tor Browser is the standard option for most people.
Why are onion addresses so long?
Modern addresses are generated from cryptographic keys. Length supports stronger security and authentication.
Conclusion
Onion services explained: they are Tor-hosted sites with .onion addresses, built so visitors and operators can communicate without the usual public location trail. Onion routing is the layered encryption model underneath. Tor onion services are one of the main ways hidden, privacy-focused services exist online — used for journalism, research, and censorship resistance, and sometimes misused for crime.
Knowing what a .onion site is, and how onion sites work, is enough to separate the technology from the headlines. More on Tor and privacy is on Torzle.