What Are Tor Sites and How Do They Work?
Tor sites rely on onion routing, a technique developed in late 1990s US Department of Defense research to protect sensitive communications through layered encryption2. When you request a .onion address, your connection passes through at least three randomly selected Tor nodes—entry, middle, and exit—each decrypting one layer of encryption before forwarding the data. No single node sees both your real IP address and the destination site, which is how anonymity is achieved for users2.
How .onion Addresses Differ from Regular URLs
A standard URL like '' resolves through DNS servers that link domain names to server IP addresses, exposing both your location and the server's. A .onion address—such as 'ciadotgov4sjwlzihbbgxnqg3xiyrg7so2r2o3lt5wz5ypk4sxyjstad.onion'1—is a cryptographic hash derived from the site operator's public key. This hash cannot be resolved outside the Tor network, so the server's physical location remains hidden and the site operator's identity is protected alongside the visitor's.
Anonymity for Both Sides
Onion services hide the server's IP address by creating a connection that never leaves the Tor network. The site operator publishes a descriptor to Tor directory servers, and visitors establish a rendezvous point within Tor to exchange encrypted data. Neither party learns the other's real-world address. This mutual anonymity distinguishes Tor sites from regular websites accessed through Tor, where only the user's identity is obscured and the exit node can still see the destination server's IP.
For a broader context on how Tor sites fit into the hidden web ecosystem, see What is the Dark Web? A Comprehensive Overview.
Setting Up for Safe Tor Site Navigation
Accessing .onion sites requires the Tor Browser, a modified version of Firefox that routes all traffic through the Tor network by default2. Regular browsers—Chrome, Safari, Edge—cannot resolve .onion addresses and will return an error if you attempt to visit one. Using only the official Tor Browser ensures that your connection is properly anonymized and that you avoid malicious copies bundled with tracking scripts or malware.
Downloading and Installing Tor Browser
Visit the Tor Project's official website at 'https://www.torproject.org' and navigate to the download page. Select the version for your operating system—Windows, macOS, Linux, or Android—and verify the file's cryptographic signature after download to confirm it has not been tampered with. The Tor Project publishes these signatures alongside each release, and the verification process is documented on the same download page.
Once installed, launch Tor Browser and wait for it to establish a connection to the Tor network. The initial connection can take 10–30 seconds as the browser selects entry, middle, and exit nodes. When the connection is complete, you will see a confirmation screen and can begin browsing. Do not install additional browser extensions or change security settings unless you understand the anonymity trade-offs; many add-ons can leak identifying information or create a unique browser fingerprint.
When to Consider a VPN with Tor
A VPN encrypts your internet traffic before it reaches your internet service provider, which can be useful if you live in a jurisdiction where accessing the Tor network itself attracts scrutiny3. In countries with censorship—China, Iran, Russia, North Korea—ISPs and authorities monitor connections to known Tor entry nodes, and the mere act of using Tor can trigger investigation3. A VPN hides the fact that you are connecting to Tor, though it does not improve anonymity within the Tor network itself.
If you choose to use a VPN, connect to the VPN first, then launch Tor Browser. This configuration is known as 'VPN over Tor' and prevents your ISP from seeing Tor traffic. Do not configure 'Tor over VPN' (Tor first, then VPN), as this exposes your exit traffic to the VPN provider and undermines the anonymity Tor provides. Note that combining Tor with a VPN introduces a new party—the VPN provider—who can log your real IP address, so select a provider with a documented no-logs policy and jurisdiction outside your own country.
For a comparison of browser options and their security features, see Best Dark Web Browser: A Comparison.
Finding and Accessing Tor Sites
Discovering .onion addresses is harder than finding regular websites because Tor sites are not indexed by Google or other mainstream search engines2. You cannot type a topic into a standard search bar and expect a list of onion services to appear. Instead, you rely on specialized directories, Tor-specific search engines, and word-of-mouth recommendations from trusted communities.
Directories and Search Engines for Onion Services
Reputable directories curate lists of active .onion sites, often organized by category—news, forums, marketplaces, privacy tools. Examples include The Hidden Wiki and Daniel's Hosting, though these directories are maintained by individuals and can list outdated or malicious links alongside legitimate ones. Cross-reference any address you find with multiple sources before visiting, and treat directories as starting points rather than guarantees of safety.
Ahmia is a Tor search engine that indexes onion services and filters out illegal content such as child abuse material. You can access Ahmia through the clearnet at 'https://ahmia.fi' or via its .onion address within Tor Browser. Ahmia's index is smaller than Google's—typically a few thousand sites—but it provides a safer entry point than unvetted directories. DuckDuckGo also operates an onion service at 'duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion', offering private search without tracking, though its results focus on clearnet content rather than hidden services.
Understanding .onion Addresses
A .onion URL is a long, alphanumeric string—often 56 characters for version 3 addresses—derived from the site operator's public key1. The CIA's onion service, for instance, is 'ciadotgov4sjwlzihbbgxnqg3xiyrg7so2r2o3lt5wz5ypk4sxyjstad.onion'1. These addresses are not human-readable by design; the cryptographic hash ensures that only the holder of the corresponding private key can operate the site at that address, preventing impersonation.
Because .onion addresses are difficult to remember, phishing is common. An attacker can register a similar-looking address—changing one character or adding extra letters—and host a fake login page to steal credentials. Always bookmark verified addresses and compare them character-by-character before entering sensitive information.
Verifying Site Legitimacy
Legitimate organizations often publish their .onion addresses on their official clearnet websites or through verified social media accounts. The New York Times, ProPublica, and the BBC all list their onion services on their main domains, allowing you to confirm the address before visiting. If you find an .onion link in a directory or forum, search for the organization's clearnet site and check whether they officially endorse that address.
For sites without a clearnet presence, look for consistent mentions across multiple trusted sources and check community forums for reports of scams or takedowns. Treat any site asking for payment, personal details, or login credentials with heightened skepticism, and never reuse passwords across onion services and clearnet accounts.
Best Practices for Security and Privacy on Tor Sites
Tor Browser provides anonymity by default, but visiting .onion sites safely requires deliberate choices about what you share, download, and enable. The network hides your IP address from the sites you visit, yet your behaviour—reusing usernames, enabling scripts, or downloading files—can still expose your identity or compromise your device.
Avoid Sharing Personal Information
Never enter real names, email addresses, phone numbers, or payment details linked to your identity on Tor sites. If a service requires registration, create credentials used nowhere else and consider a disposable email address generated within Tor. Reusing a username from clearnet accounts allows correlation: an attacker or law enforcement agency can link your Tor activity to your real identity by matching handles across platforms. Even metadata—time zones in timestamps, language preferences, or writing style—can narrow down who you are.
Disable Scripts and Adjust Security Settings
Tor Browser includes NoScript, an extension that blocks JavaScript by default on all sites. JavaScript can fingerprint your browser, exploit vulnerabilities to reveal your IP address, or deliver malware. The browser's security level—accessible via the shield icon in the address bar—offers three presets: Standard (some scripts allowed), Safer (JavaScript disabled on non-HTTPS sites), and Safest (all scripts and media blocked). We recommend Safer or Safest for .onion sites, accepting that some features—interactive forms, embedded video—will not work.
Before visiting any .onion address, check your security level and confirm that NoScript is active. A 2019–2021 German law enforcement operation used a timing attack to correlate Tor users with their real IP addresses, though the Tor Project clarified that regular Tor Browser users were not affected; the attack exploited an operational security mistake in an old version of the Ricochet instant messaging service [9, 10]. The Tor Project has since expanded its network of nodes and improved detection of malicious relays4, yet the incident illustrates that software vulnerabilities and user errors remain exploitable.
Do Not Download Files from Untrusted Sources
Files downloaded through Tor can contain malware or tracking beacons that phone home when opened outside the browser. PDFs, for instance, may embed scripts that trigger network requests revealing your real IP address. If you must download a file, open it only within a virtual machine or an isolated environment disconnected from the internet. The FBI has used malware to track visitors to Tor-based child pornography sites, in one case infecting users before they had demonstrated intent to access illegal content. In 2013, the FBI seized Freedom Hosting servers, which hosted many such sites, and deployed malware to identify visitors.
Understand Exit Node Risks
When you visit a clearnet website through Tor—rather than a .onion service—your traffic exits the Tor network through an exit node operated by a volunteer. That operator can see unencrypted traffic, including passwords sent over HTTP or unencrypted email. Always verify that clearnet sites use HTTPS before entering credentials, and prefer .onion versions of services when available. Exit nodes cannot see traffic to .onion sites, as these connections remain entirely within the Tor network.
Legal Context: Is It Legal to Use Tor?
Accessing the Tor network and visiting .onion sites is legal in most jurisdictions, including the United Kingdom and United States3. Tor itself is a tool; legality depends on what you do with it. Participating in illegal activities—buying controlled substances, distributing copyrighted material, accessing child abuse content—remains a crime regardless of the anonymity technology used3. In countries with censorship, such as China, Iran, Russia, or North Korea, merely connecting to Tor can attract scrutiny from authorities3.
Limitations of Tor's Anonymity
Tor protects against traffic analysis by obscuring your IP address and encrypting data through multiple relays, but it does not make you invincible. Timing attacks—correlating when data enters and exits the network—can deanonymize users if an adversary controls enough nodes or monitors both your ISP and the destination4. Browser fingerprinting, operational security mistakes (reusing identities, logging in to personal accounts), and malware can all bypass Tor's protections. Treat Tor as a strong layer of defence, not a guarantee.
For context on the broader legal landscape, see Is the Dark Web Illegal? Myths and Facts Explained.
Example: Checking Security Settings Before Visiting a Site
Suppose you want to visit a news .onion service to read uncensored reporting. Before entering the address, click the shield icon in Tor Browser's address bar and confirm the security level is set to Safer or Safest. Check that NoScript shows 'Scripts Globally Forbidden' in its toolbar icon. Type or paste the verified .onion address—do not follow a link from an untrusted source—and wait for the page to load. If the site requests you enable JavaScript, evaluate whether the content justifies the risk; for static news articles, scripts are unnecessary. Do not log in with credentials used elsewhere, and do not download attachments unless you can verify their origin and open them in isolation.
Common Misconceptions and Risks of Tor Sites
Many users conflate Tor with the 'dark web' itself, but Tor is the underlying technology—a network of volunteer-operated relays that anonymizes traffic through onion routing2. The dark web is a collection of hidden .onion sites accessible only via Tor Browser and not indexed by search engines2. Tor is a tool; the dark web is content hosted on that tool. You can use Tor to browse regular clearnet websites anonymously, and not all .onion sites host illegal material—news organizations, privacy-focused email providers, and whistleblower platforms operate onion services to protect sources.
Is Tor 100% Untraceable?
No. Tor obscures your IP address from the sites you visit and encrypts data through multiple relays, but it does not guarantee absolute anonymity. Timing attacks—where an adversary monitors both your internet connection and the destination—can correlate when data enters and exits the network, potentially linking your real IP to a .onion visit4. German law enforcement used such a timing attack between 2019 and 2021 to deanonymize the administrator of a dark web child sexual abuse material forum, though the Tor Project clarified that regular Tor Browser users were unaffected; the attack exploited an operational security mistake in an old version of the Ricochet messaging service [9, 10]. The Tor Project has since expanded its network and improved detection of malicious relays4, yet the incident demonstrates that vulnerabilities—software bugs, user errors, or insufficient network diversity—remain exploitable.
Can the FBI Track Tor Users?
Yes, under certain conditions. Law enforcement agencies have used malware to identify Tor users, particularly in child exploitation cases. In 2013, the FBI seized Freedom Hosting servers, which hosted many child pornography sites, and deployed malware to visitors. In one instance, the FBI's malware infected users before they had logged in or demonstrated intent to access illegal content, exceeding the scope of its warrant. These operations rely on exploiting browser vulnerabilities or tricking users into downloading malicious files, not breaking Tor's encryption directly. Tor provides anonymity from network observers, not immunity from consequences for illegal actions3.
Potential Dangers on Tor Sites
Scams are widespread: fake marketplaces that take payment without delivering goods, phishing sites that mimic legitimate services to steal credentials, and ransomware distributed through infected downloads. Because .onion addresses are long and unreadable, attackers register similar-looking URLs—changing one character—to impersonate trusted sites. Always verify addresses against official sources and never reuse passwords across Tor and clearnet accounts.
Malware is another risk. Files downloaded from .onion sites can contain tracking beacons or exploits that reveal your real IP address when opened outside Tor Browser. PDFs, for instance, may embed scripts that trigger network requests. Open downloaded files only in a virtual machine or isolated environment disconnected from the internet.
Illegal content—child abuse material, weapons sales, stolen data—exists on some .onion sites. Accessing such content is a crime in most jurisdictions, including the United Kingdom3. In countries with censorship, such as China, Iran, Russia, or North Korea, merely connecting to Tor can attract scrutiny from authorities3. Tor does not make illegal activity legal; it only makes tracing harder.
For a broader discussion of legality and common myths, see Is the Dark Web Illegal? Myths and Facts Explained.
Troubleshooting and Maintaining Tor Browser
Tor Browser occasionally fails to connect, loads pages slowly, or displays error messages. Most issues stem from outdated software, misconfigured settings, or network interference—problems you can resolve without technical expertise.
Connection Problems
If Tor Browser cannot establish a connection, first check whether your internet connection works by opening a regular browser. If clearnet sites load but Tor does not, your ISP or network administrator may block Tor traffic. Click 'Configure Connection' on Tor Browser's startup screen and enable the bridge option, which routes your initial connection through unlisted relays that censors cannot easily identify. Select 'obfs4' from the built-in bridge list; this transport disguises Tor traffic as ordinary HTTPS.
If the browser connects but .onion sites fail to load, verify you are connected to the Tor network: click the onion icon in the address bar and confirm it displays 'Connected to the Tor network'. A broken circuit—where one relay in your path goes offline—can interrupt access; click 'New Circuit for this Site' to route through different relays. If a specific .onion address never loads, the site itself may be offline or the URL incorrect. Onion services have no uptime guarantee, and many disappear without notice.
Slow Speeds
Tor routes traffic through three volunteer-operated relays, adding latency. Expect slower page loads than clearnet browsing—often 5 to 10 seconds for text-heavy sites, longer for media. If speeds become unusable, check your security level: Safest mode blocks images and scripts, reducing data transferred and often improving performance. Avoid downloading large files through Tor; the network is designed for anonymity, not bandwidth.
Connecting through a VPN before launching Tor Browser can sometimes worsen speeds, as you add another encryption layer. If you use a VPN, choose a server geographically close to you and disable any 'turbo' or compression features that interfere with Tor's encryption.
Regular Updates for Security
Tor Browser receives frequent updates to patch vulnerabilities that could deanonymize users or compromise devices. The browser checks for updates automatically on startup; when a new version is available, a notification appears in the menu. Download updates only from the official Tor Project website or through the browser's built-in updater—never from third-party mirrors. Running outdated software exposes you to exploits that attackers and law enforcement have used to identify Tor users [7, 9].
To manually check for updates, open the menu (three horizontal lines in the top-right corner), select 'Help', then 'About Tor Browser'. The browser will query the update server and prompt you to install any available version. Restart the browser to complete the update.
Verifying Tor Browser's Integrity
Before installing Tor Browser, verify the downloaded file matches the official release to ensure it has not been tampered with. The Tor Project publishes cryptographic signatures for each version; compare the SHA-256 hash of your downloaded file against the hash listed on the project's website. On Windows, open Command Prompt, navigate to the download folder, and run certutil -hashfile torbrowser-install-win64-[version].exe SHA256. On macOS or Linux, use shasum -a 256 torbrowser-install-[version].dmg or the equivalent for your package. If the hashes match, the file is authentic.
Example: Checking If Tor Browser Is Connected
Suppose Tor Browser launches but you want to confirm it routes traffic through the Tor network before visiting a .onion site. Click the onion icon to the left of the address bar; a pop-up displays 'Connected to the Tor network' and lists the three relays in your current circuit—entry guard, middle relay, and exit node (or final relay for .onion connections). If the pop-up shows 'Not connected', close and restart the browser, or click 'Configure Connection' to troubleshoot. Visit a test site such as check.torproject.org (a clearnet address) to see a confirmation message: 'Congratulations. This browser is configured to use Tor'. Do not rely on third-party 'IP check' sites, as they may log your visit or serve malicious content.
For guidance on choosing and configuring Tor Browser, see Free Dark Web Browser: Your Options Explained.
Common Misconceptions and Risks of Tor Sites
Believing Tor Provides Absolute Anonymity
Many users assume Tor makes them completely untraceable, but this is a dangerous oversimplification. While Tor encrypts your traffic and routes it through multiple relays to obscure your IP address from destination sites, it does not guarantee absolute anonymity against all adversaries. Timing attacks, where an attacker monitors both your network connection and the Tor network, can sometimes correlate traffic patterns to deanonymize users4. The Tor Project has improved its network to mitigate such attacks, but user operational security mistakes or software vulnerabilities can still expose identities [9, 11].
Assuming All .onion Sites Are Illegal
A common misconception is that all .onion sites host illicit content. In reality, the Tor network was initially developed for anonymized communication for US spies2, and it continues to host legitimate services. News organizations, secure email providers, and platforms for whistleblowers use .onion services to protect their users' privacy and bypass censorship. While the dark web, a collection of hidden .onion sites, does contain illegal content2, the presence of such material does not define the entire network.
Downloading Files Without Caution
Users often download files from .onion sites without considering the risks, treating them like downloads from the regular internet. Files obtained from the dark web can contain malware, tracking beacons, or exploits designed to reveal your real IP address or compromise your device. For instance, PDFs might embed scripts that trigger network requests outside the Tor environment. We advise opening any downloaded files only within a virtual machine or an isolated, internet-disconnected environment to prevent potential deanonymization or infection.
Reusing Passwords Across Tor and Clearnet
It is a critical mistake to use the same login credentials for .onion sites as you do for your regular clearnet accounts. Many dark web sites are operated by malicious actors who may harvest these credentials for phishing attacks or to access your other online services. If a .onion site is compromised, your reused password could expose your accounts on banking, email, or social media platforms. Always use unique, strong passwords for any service accessed via Tor, and consider using a password manager specifically for your Tor activities.
Ignoring Tor Browser Updates
Some users neglect to update their Tor Browser, unaware that outdated software poses significant security risks. The Tor Project regularly releases updates to patch vulnerabilities that could lead to deanonymization or device compromise. For example, law enforcement has leveraged exploits in older software versions to identify users [7, 9]. Running an outdated browser leaves you exposed to known exploits that could compromise your anonymity or security. We always recommend downloading updates only from the official Tor Project website or through the browser's built-in updater.
Believing Tor Makes Illegal Activities Legal
A dangerous misconception is that using Tor somehow legalizes illicit activities. Accessing the dark web is not illegal in itself3, but engaging in illegal activities, such as buying or selling illicit goods, remains a crime regardless of how you access the internet. Tor provides anonymity from network observers, but it does not grant immunity from legal consequences for criminal actions3. In certain countries with strict censorship, even the act of accessing the dark web can draw unwanted attention from authorities3.
Key Takeaways
Navigating Tor sites requires a clear understanding of its capabilities and limitations. We’ve explored the technical aspects, common pitfalls, and best practices for safer browsing.
Tor provides anonymity, not immunity: While Tor obscures your IP address, it doesn't make illegal activities legal or guarantee absolute untraceability against all threats.
Exercise caution with downloads: Files from .onion sites can contain malware or tracking elements. Use isolated environments like virtual machines for opening downloaded content.
Update Tor Browser regularly: Outdated software leaves you vulnerable to exploits that can compromise your anonymity. Always update from official sources.
Use unique credentials: Never reuse passwords from your clearnet accounts on .onion sites to prevent credential harvesting.
Verify site authenticity: Many .onion sites are unreliable or malicious. Confirm URLs and be skeptical of unverified sources.
To begin your journey safely, we advise you to first understand the fundamental concepts of how the network operates by reading Tor Web: Understanding the Basics.
Bibliography
Explore More on the Dark Web
Discover additional resources to enhance your understanding.
Visit Our Resources