Onion Site Directory

Anatomy of an Onion URL and Resolution Mechanism

A v3 onion address has a specific structure. It consists of a 56-character base32-encoded string. This string contains a 32-byte Ed25519 public master key, a checksum, and a version byte (3). Modern Tor onion services use this v3 protocol architecture, which replaced the legacy 16-character v2 addresses in 2021 due to their weaker cryptographic standards (3).

Public key cryptography plays a crucial role in the security of .onion addresses. Each address is derived from the public master key, ensuring that only the corresponding private key can sign messages or establish secure connections. This mechanism enhances the anonymity and integrity of communications within the Tor network.

The resolution of .onion addresses employs a Distributed Hash Table (DHT) mechanism. When a client requests a connection to a hidden service, it uses the DHT to locate the service's public key and routing information. This process involves the use of a Rendezvous point, where the client and the hidden service meet to establish a secure communication channel.

Applications that do not implement the Tor protocol must treat .onion names as special-use. This means they will generate an NXDOMAIN error without attempting public DNS lookups (4). This design prevents accidental exposure of .onion addresses to the standard DNS system.

Tor circuits are constructed dynamically using a three-hop path: a guard node, a middle node, and an exit node. Each hop wraps data in layers of encryption, providing circuit isolation and stream isolation (5). This multi-layered approach ensures that no single node has complete information about the data being transmitted.

For operational security, misconfigurations such as leaking physical server IP addresses through error headers or logs can compromise anonymity (6). To enhance resilience against Denial-of-Service (DoS) attacks, modern onion service configurations support Proof-of-Work (PoW) mechanisms, which prioritize client connections during heavy loads (3).

Understanding these technical specifications is vital for anyone managing or utilizing .onion services effectively.

Verified Onion Site Directory Index

This section provides a structured index of verified .onion services, focusing on infrastructure stability and protocol compliance. The following categories include significant services that can enhance your experience within the Tor network.

Tor Project Mirrors

These mirrors provide access to the official Tor Project resources. They ensure that users can download the Tor Browser and other essential tools securely.

• onion.torproject.org: The official directory of verified operational onion services maintained by the Tor Project (2).

• torproject.org: Access to documentation, FAQs, and support resources.

Documentation Portals

Documentation portals provide critical information about using .onion services and the Tor network.

• torlibrary.com: Offers extensive documentation on Tor services, including security practices and protocol details.

• rfc-editor.org: Contains specifications regarding the handling of .onion addresses and their unique characteristics (4).

Cryptographic Tools

Tools that enhance cryptographic security are vital for maintaining anonymity on the Tor network.

• Onion balance tools: These tools allow for multi-backend server deployments, effectively scaling onion services by distributing incoming client connections (2).

• Encrypted messaging services: Various .onion services provide secure messaging options, ensuring privacy for users.

Security and Configuration Resources

Proper configuration is essential for maintaining the security of .onion services.

• Misconfiguration guides: Resources that detail common security misconfigurations, such as leaking physical server IP addresses through logs or headers (6).

• DoS mitigation techniques: Information on modern onion service configurations that support Proof-of-Work (PoW) mechanisms for prioritizing client connections (3).

Accessing the Directory

To access these services, use the Tor Browser, which is the only officially supported application for navigating .onion links without leaking metadata (1). Remember that all services listed here comply with the v3 protocol, ensuring robust cryptographic standards (3).

This index aims to help you efficiently navigate verified .onion services while ensuring that you adhere to best practices for security and privacy.

Directory Verification and Integrity Checks

Verifying the authenticity of .onion sites is crucial for maintaining security and privacy. There are several methods you can use to ensure that the onion services you access are genuine and not phishing attempts or man-in-the-middle (MITM) attacks.

Cryptographic Signing of Directory Lists

The Tor Project maintains an official directory of verified operational onion services at onion.torproject.org (2). This directory is cryptographically signed, allowing users to verify the integrity of the service list. Each v3 onion address includes a 32-byte Ed25519 public master key, which is part of the address itself (3). You should always compare the public keys of the services you access against those listed in the official directory to confirm authenticity.

Detecting MITM Attacks and Phishing Mirrors

To detect potential MITM attacks or phishing mirrors, consider the following practices:

• Check the Address Structure: Ensure that the onion address is a valid v3 address, which is a 56-character base32-encoded string. If the address is not structured correctly, it may be a phishing attempt (3).

• Use the Tor Browser: Access .onion sites exclusively through the Tor Browser. This browser is designed to handle .onion links securely and does not leak connection metadata (1).

• Verify Connection Security: When connecting to a hidden service, ensure that the connection is established through a proper Rendezvous point. This process prevents interception by unauthorized parties.

Regular Integrity Checks

Perform regular integrity checks on the directory lists you use. If you are relying on third-party directories, verify that they are updated and signed by trusted sources. Utilize tools that can automatically check for the latest updates from verified directories.

Conclusion

By implementing these verification methods and regularly checking the integrity of the directories you use, you can enhance your safety while navigating the Tor network. Always remain vigilant against potential threats associated with onion services.

Network Routing and Circuit Isolation Protocols

The Tor client establishes secure connections to directory listings through a process involving rendezvous points and three-hop circuits. This multi-layered approach enhances anonymity and protects user data.

When a user wants to connect to a hidden service, the Tor client first generates a three-hop circuit. This circuit consists of three nodes: a guard node, a middle node, and an exit node. Each node in the circuit wraps the data in layers of encryption, a method known as onion routing. The first layer is decrypted at the guard node, the second at the middle node, and the final layer at the exit node, ensuring that no single node can access the complete data being transmitted (5).

The rendezvous point plays a crucial role in this process. It acts as a temporary meeting location for the client and the hidden service. The hidden service publishes its location in the Distributed Hash Table (DHT), allowing the client to discover it. Upon connection, the client and the hidden service create a secure channel through the rendezvous point, further isolating their identities from each other.

Key Protocol Features

• Three-Hop Circuit: Ensures that data passes through three separate nodes, enhancing anonymity.

• Rendezvous Point: Facilitates secure connections without revealing the client’s or service’s IP address.

• Encryption Layers: Each hop encrypts data, preventing any node from having complete visibility of the transmitted information.

To maintain the integrity of the communication, the Tor network uses the v3 onion service protocol. This protocol, which fully replaced the v2 addresses in 2021, employs stronger cryptographic standards, such as Ed25519 public key cryptography, which is essential for securing .onion addresses (3).

When configuring your Torrc file, ensure that circuit isolation settings are correctly applied. This configuration helps maintain separate circuits for different tasks, preventing cross-contamination of data streams and enhancing overall security.

By understanding these routing and isolation protocols, you can better navigate the complexities of the Tor network and access directory listings securely.

Security Hardening for Directory Access

To secure access to .onion directories, it is essential to configure your Tor daemon (torrc) settings appropriately. Implementing these guidelines can help prevent DNS/IP leaks and ensure a safer browsing experience.

Torrc Configuration Guidelines

1. Stream Isolation: Enable stream isolation to keep different streams separate. This can be achieved by setting IsolateDestAddr and IsolateDestPort in your torrc file. This ensures that different connections do not share the same circuit, enhancing privacy.

2. Disable Non-Essential Features: Turn off features that are not required for directory access. For example, disabling the UseEntryGuards option can reduce exposure to potential vulnerabilities. Also, consider disabling AllowNonTorPorts to prevent connections to non-Tor services.

3. Periodic Restart: Regularly restart your Tor daemon to refresh circuits and improve anonymity. This practice can help mitigate risks from long-lived circuits that may be compromised over time.

4. Set Up a Firewall: Use a firewall to restrict outgoing connections to known .onion services. This reduces the risk of leaking your real IP address through misconfigured applications.

Preventing DNS/IP Leaks

To prevent DNS and IP leaks while browsing directories, follow these recommendations:

• Use the Tor Browser: The Tor Browser is designed to handle .onion links securely without leaking connection metadata (1). Always access .onion sites exclusively through this browser.

• Check for Leaks: Utilize tools that can monitor your connections for leaks. These tools can help identify if your real IP address is being exposed during directory browsing.

• Disable DNS Resolution: Ensure that your system does not perform DNS lookups for .onion addresses. Configure your local resolver to treat these addresses as special-use, generating an NXDOMAIN error if queried (4).

Stream Isolation and Circuit Management

Implementing circuit isolation is crucial. This process keeps different types of traffic on separate circuits, preventing data correlation. For example, if you are accessing multiple directories, each should utilize its own circuit. To achieve this, set CircuitBuildTimeout in your torrc file to a lower value, which prompts the Tor client to build new circuits more frequently.

By following these security hardening techniques, you can significantly enhance your privacy and security when accessing .onion directories. Proper configuration and diligent monitoring are key to maintaining a secure browsing environment within the Tor network.

Automated Scraping and API Access for Onion Directories

You can maintain local onion directories using secure offline scripts instead of dynamic web scraping. This approach minimizes vulnerabilities associated with scraping, such as IP leaks and data exposure.

Programmatic Approaches

Utilize programming languages like Python or Go, which offer libraries for handling secure connections. Use the following methods to parse and manage onion directories:

1. Direct API Access: Some onion services offer APIs for programmatic access. For example, if you find a service with an API, you can use it to retrieve directory data securely. Ensure that the API adheres to the v3 protocol's security standards.

2. Static File Downloads: Regularly download static files from trusted onion directories, such as onion.torproject.org. This directory is maintained by the Tor Project and contains verified operational onion services (2). Automate the download process using scripts that run at scheduled intervals.

3. Local Parsing: After downloading directory data, use scripts to parse the content. Focus on extracting valid v3 onion addresses, which are 56-character base32-encoded strings (3). Ensure your scripts validate the format to prevent processing of invalid addresses.

Security Considerations

While implementing scraping or data retrieval methods, consider the following:

• Avoid Dynamic Scraping: Dynamic web scraping can expose your IP address and may lead to Denial-of-Service (DoS) risks. Use static data instead (3).

• Error Handling: Implement robust error handling in your scripts to avoid leaking sensitive information through application-level errors or misconfigured logs (6).

• Connection Metadata: Use the Tor Browser for any interaction with .onion services. This browser is the only officially supported application that ensures no connection metadata is leaked (1).

Example Workflow

1. Schedule a script to download the latest directory data from a trusted source.

2. Use a parsing script to extract valid .onion addresses.

3. Store these addresses in a local database for offline access.

4. Regularly verify the integrity of the stored addresses against the official directory.

By following these programmatic approaches, you can effectively manage local onion directories while maintaining security and privacy on the Tor network.

Summary and Final Recommendations

• Keep your torrc configuration updated and verify that stream isolation parameters remain active during every session.

• Run regular offline checks on your local index files to catch outdated or malformed v3 addresses early.

• Rely exclusively on official directory sources like onion.torproject.org to maintain operational security (2).

• Automate your static data retrieval routines to minimize direct exposure and avoid dynamic scraping risks (3).

To begin your safe exploration of verified onion services, review the Tor Site Links guide for step-by-step instructions.