We never list markets. Check the first and last six characters of every address before you sign in.

The Hidden Wiki

Onion Directory

Open-Source Projects on Onion – Debian, Qubes, Whonix, OnionShare

By admin 14 min read
On this page
  1. Two separate jobs: proving the file, hiding the asker
  2. The four official onions
    1. Debian
    2. Qubes OS
    3. Whonix
    4. OnionShare
    5. How these compare with Tails
  3. Updating over Tor in practice
    1. Debian, with apt over onion
    2. Qubes OS
    3. Whonix
    4. Tails
    5. And Tor Browser itself
  4. OnionShare: the project that makes onions
    1. What it does
    2. What changed in 2026
    3. When to use it, and when not to
  5. Checking signatures on what you download
    1. Updates are usually checked for you
    2. Fresh downloads need checking by hand
    3. What the onion adds to this
  6. Where to go next
  7. Sources

People who think hard about privacy tend to focus on websites. Which pages they visit, which searches they run, who can see what they do. Fewer of them think about the software they download and the updates their computer fetches every day. Yet those requests can be just as revealing.

Think about what someone monitoring your connection can work out just from your downloads. That you’ve installed an encryption program. That you’ve just fetched Tor or a privacy-focused operating system. Which version of your system you run, and whether you’ve applied last week’s security patch or are still exposed to a known bug. For an ordinary person none of this matters much. For a journalist, an activist or anyone who might be a target, it’s a map. It shows an adversary what you’re protecting, what you’re using to protect it, and where the weaknesses are.

That is why four of the projects in our directory run official onion services. They are Debian, one of the oldest and most widely used Linux distributions, Qubes OS, an operating system built around isolating everything you do, Whonix, which routes an entire system through Tor, and OnionShare, a tool for sharing files over onion services that, fittingly, has an onion of its own.

This page looks at why downloading software over an onion is worth doing, what it adds on top of the signatures these projects already use, and how to actually do it, including updating a Debian system entirely over Tor.

Two separate jobs: proving the file, hiding the asker#

Open-source projects have used cryptographic signatures to protect their downloads for many years. Debian signs its package lists, Qubes and Whonix sign their images, and every reputable project publishes a key for checking what you’ve received. So it’s reasonable to ask what an onion adds.

The answer is that signatures and onions do two different jobs, and you need both.

A signature proves the file. It tells you that what reached your computer is exactly what the project published, signed with a key the project controls. If the file had been changed anywhere along the way, the check would fail. That is integrity, and it works no matter how you downloaded the file.

An onion hides the asker. It stops anyone on your network from seeing which project you’re downloading from, and stops the server from finding out who or where you are. That is privacy, and signatures don’t provide it at all.

Here’s how the two compare with ordinary HTTPS.

What could be learned or done Signatures alone Download over HTTPS Download over an onion
Someone alters the file on the way Caught by the signature check Hard to do, and caught by the signature check Hard to do, and caught by the signature check
Your network sees which project you’re downloading from Yes Yes, from the server name No, it sees only Tor
Your network sees which files or packages you fetch Yes, over plain HTTP Hidden, though file sizes can hint No
The server knows your IP address Yes Yes No
The server could treat you differently from everyone else Possible Possible Very hard, because it can’t tell who you are

That last row is the subtle one. A signature stops a server from sending you a modified file. It doesn’t stop the server, or someone who controls it, from quietly withholding a security update from one particular person, or from noting that a certain address has just downloaded a privacy tool. If the server can’t tell who you are, it can’t single you out. An onion takes that option away.

There’s also a very practical reason this matters for Debian in particular. Many Debian systems still fetch their packages over plain HTTP and rely on signatures to make sure nothing was changed. That’s entirely safe for integrity, but it means anyone on the network can see exactly which packages you install. Over an onion, they see nothing but Tor traffic.

None of this replaces checking signatures. An onion address proves you’ve reached the real service, but it can’t prove the project’s own servers weren’t compromised. Do both. We look at the signature side in more detail further down.

The four official onions#

All four addresses below passed at least 13 of the last 14 daily reachability checks as of October 11, 2026, and each is published by the project on its own website. They are the same four listed in our Official Onion Mirrors Directory.

Project Address Proof
Debian Onion Index jvgypgbnfyvfopg5msp6nwr2sl2fd6xmnguq35n7rfkw3yungjn2i4yd.onionVerifiedOpenListed in our directory as Debian onion index (Software). See the owner's proofjvgypgbnfyvfopg5msp6nwr2sl2fd6xmnguq35n7rfkw3yungjn2i4yd onion.debian.org
Qubes OS www.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onionVerifiedOpenListed in our directory as Qubes OS (Software).qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad qubes-os.org
Whonix dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onionVerifiedOpenListed in our directory as Whonix (Software).dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd whonix.org
OnionShare lldan5gahapx5k7iafb3s4ikijc4ni7gx5iywdflkba5y2ezyg6sjgyd.onionVerifiedOpenListed in our directory as OnionShare (Software).lldan5gahapx5k7iafb3s4ikijc4ni7gx5iywdflkba5y2ezyg6sjgyd onionshare.org

All four use plain http://. That’s normal for onions, and the connection is still encrypted end to end, because every onion connection is.

Debian#

Debian is one of the oldest community-run Linux distributions and the basis for several others, including Ubuntu and Tails. Its onion index, at onion.debian.org, lists about a hundred onion services run by the Debian project. Most are served from several machines at once using OnionBalance, the same approach the Tor Project uses.

The most important ones are the package archive and the security archive, because those are what your computer contacts every time it updates. Debian also runs onions for its main website, its package tracker, its manual pages and its OpenPGP key server. In the next section, we explain how to point your system at the archive onions.

Qubes OS#

Qubes OS is a desktop operating system that splits your computer into separate virtual machines, called qubes, so that a compromise in one, for example through a malicious attachment, doesn’t reach the others. It’s widely used by journalists and security researchers.

The current release is Qubes OS 4.3.0, published on December 21, 2025. It updated the default templates to Fedora 42, Debian 13 and Whonix 18. It also added a safeguard that stops Whonix workstation qubes from being switched to a non-Tor network connection by mistake, which could otherwise leak an IP address. Support for Qubes 4.2 ended on June 21, 2026, so if you’re still running it, now is the time to upgrade.

Whonix#

Whonix is an operating system designed so that everything you do goes through Tor. It does this by splitting the job in two. A gateway handles the Tor connection, and a separate workstation, where you actually work, can only reach the internet through that gateway. Even if software on the workstation is compromised, it has no way of discovering your real IP address.

Whonix can run inside virtual machines on an ordinary computer or, very commonly, inside Qubes, where the Whonix templates are built and supported by the Whonix project. The current Qubes release ships Whonix 18.

OnionShare#

OnionShare is different from the other three, because it isn’t just a project with an onion. It’s a tool for making onions. You’ll find it in its own section below.

How these compare with Tails#

When choosing between these systems, it helps to know where Tails fits. Tails is a live system that runs from a USB stick, sends everything through Tor and forgets everything when you shut it down. Whonix and Qubes, by contrast, are installed systems you keep using over time. They suit different situations, and we look at Tails in detail in Tails 7.14: The Amnesic OS That Routes Everything Through Tor.

Updating over Tor in practice#

It’s easy to visit a project’s website through its onion. You just open the address in Tor Browser. The more important step, and the one most people never take, is getting your system’s updates over Tor as well. Here’s how that works for each project.

Debian, with apt over onion#

Debian makes this simple. Its package manager, apt, can fetch packages over Tor once you install a small helper package called apt-transport-tor, which also needs the Tor service running on your computer. You then point your package sources at Debian’s onion archive, using addresses that begin with tor+http://.

Debian publishes the exact lines on onion.debian.org. The example there names Debian 12, bookworm. For the current stable release, Debian 13, trixie, the lines look like this.

deb  tor+http://2s4yqjx5ul6okpp3f2gaunr2syex5jgbfpfvhxxbbjwnrsvbk5v3qbid.onion/debian          trixie            main
deb  tor+http://2s4yqjx5ul6okpp3f2gaunr2syex5jgbfpfvhxxbbjwnrsvbk5v3qbid.onion/debian          trixie-updates    main
deb  tor+http://5ajw6aqf3ep7sijnscdzw77t7xq4xjpsy335yb2wiwgouo7yfxtjlmid.onion/debian-security trixie-security   main

The first address is Debian’s main package archive, and the second is its security archive. Both are copied from Debian’s own onion index, which is where you should check them. They aren’t part of our directory’s daily checks, so compare them with onion.debian.org before you use them.

A few practical notes.

  • Install the helper before you switch. Install apt-transport-tor and make sure Tor is running while you still have your normal sources, then change the sources and update.
  • Expect it to be slower. Big updates take longer over Tor. That’s the price of nobody on your network seeing what you install.
  • Signatures still apply. apt checks Debian’s signatures exactly as before. The onion adds privacy. It doesn’t replace verification.
  • Newer systems may use a different format. Recent Debian installs can store sources in a file called debian.sources rather than the one-line format above. The onion addresses are the same either way.

Qubes OS#

Qubes is designed with this in mind. During setup, it offers to route system and template updates through Whonix, so they travel over Tor rather than your regular connection. If you skipped that step when installing, the Qubes documentation explains how to change the update proxy later. Since each template fetches its own updates, sending them through Tor keeps an observer from working out which templates and software you use.

Whonix#

Whonix is designed so that all of its activity, including its own updates, goes through Tor. There’s nothing extra to switch on. That’s one reason it’s often recommended to people who want all of their system’s network activity to stay inside Tor, not just their browsing.

Tails#

Tails works the same way. Its automatic upgrades are downloaded over Tor, like everything else it does. If you need a system you can carry on a USB stick and that leaves nothing behind, see Tails 7.14.

And Tor Browser itself#

The same reasoning applies to the browser you’re using to read this. Tor Browser downloads its own updates over Tor, and the Tor Project runs its download site, distribution directory and signing key server as onions too. We cover those in Tor Project’s Official Onion Sites and How to Download and Install Tor Browser Safely. The latest release is covered in our Tor Browser 15.0.24 release notes.

OnionShare: the project that makes onions#

The other three projects use onions to distribute their software. OnionShare is software for creating onions. The onion address in our directory is simply the project’s own website, but the program turns your computer into a temporary onion service each time you use it.

What it does#

When you share something with OnionShare, it starts a small web server on your computer and publishes it as an onion service. You give the address to the person you’re sharing with, and they open it in Tor Browser. There’s no cloud company involved and no account to create. The file goes from your machine to theirs through Tor, and when you stop sharing, the address stops working.

OnionShare has several modes.

  • Share files. Send files to someone. By default, sharing stops after the first download, so if the address leaks it can’t be used again.
  • Receive files. Turn your computer into an anonymous drop box that people can upload to.
  • Host a website. Publish a simple static site as an onion, served from your own machine.
  • Chat. Run a temporary, private chat room that disappears when you close it.

Since your computer is the server, it has to stay on and connected for as long as you’re sharing. That’s the trade-off for not trusting anyone else with your files.

What changed in 2026#

OnionShare doesn’t release often, so a new version deserves attention. According to the project’s release notes, OnionShare 2.6.4, released on June 9, 2026, fixed two security flaws affecting both the desktop app and the command-line version.

  • Shared folders and symbolic links. In share and website modes, OnionShare followed symbolic links inside a shared folder and served whatever they pointed to. If a folder you shared contained a link you hadn’t created, someone with the address could read other files on your computer that OnionShare had access to.
  • Uploads in receive mode. With the option to disable uploading turned on, the restriction wasn’t actually enforced, so uploads could still get through.

A follow-up release, 2.6.5, came out on July 28, 2026 with no new features. If you use OnionShare, update to the latest version, and in the meantime only share folders whose contents you’ve checked yourself.

When to use it, and when not to#

OnionShare is ideal for sending a file to someone you’re already in touch with, or for receiving documents from people who need to stay anonymous. For a newsroom accepting tips from strangers, however, SecureDrop is the more complete system, since it was designed and is maintained for exactly that purpose, as we explain in News Onion Sites: BBC, DW, The Guardian and SecureDrop.

OnionShare’s website mode is also the quickest way to see an onion service of your own in action. But it isn’t meant for an organisation’s permanent website. If you want an official onion mirror of an existing website, with an Onion-Location header and a proof page so that directories like ours can list you, see How to Host Your Own Onion Service.

Checking signatures on what you download#

An onion gets you the file privately. A signature tells you it’s the right file. Here’s how the two work together for these projects.

Updates are usually checked for you#

When you update a system that’s already installed, the checking is built in. Debian’s apt automatically verifies the signatures on Debian’s package lists, using keys that came with your system, and won’t install anything that doesn’t match. Qubes, Whonix and Tails all check their updates in a similar way. You don’t need to do anything extra, as long as you don’t ignore the warnings. If your package manager ever complains about a bad or missing signature, stop and find out why before going any further.

Fresh downloads need checking by hand#

The moment that needs care is the first download, when you fetch an installer image, an ISO or the OnionShare app from a website. Each project publishes its own signatures and instructions, and the general method is the same.

  1. Download the file and its signature. Get both from the project’s own website, ideally over its onion.
  2. Get the project’s signing key. Fetch it from the project itself. Debian’s index, for example, lists an onion for its OpenPGP key server alongside the archive.
  3. Check the key’s fingerprint against more than one source. This is the step people skip, and it’s the one that matters most. An attacker who could replace the file might replace the key on the same page too. So compare the fingerprint from the onion with the one on the project’s normal HTTPS website, in its documentation, or in a printed or signed announcement. Qubes’s documentation is especially clear on this point and describes several independent ways to confirm its master signing key.
  4. Verify the signature. Use GnuPG or the tool the project recommends. A good signature from the key you’ve confirmed means the file is genuine.

We walk through the same process for Tor Browser, with the exact commands, in How to Download and Install Tor Browser Safely. The steps carry over almost word for word.

What the onion adds to this#

Fetching the file, the signature and the key all over onions keeps the whole process private. Nobody watching your network learns that you’re installing Qubes or Whonix. And because each onion address proves which service you’ve reached, it’s much harder for someone to slip you a fake download page along the way.

But check the address before you trust it. A lookalike onion for a privacy project is exactly what an attacker targeting privacy-conscious users would build. Compare all 56 characters with the project’s own website or our directory, as described in How to Verify an Onion Address Is Official, and see Onion Phishing: How Fake Mirrors Clone Real Addresses for what the fakes look like. Old link lists are a common source of them, as we explain in Why Most ‘Hidden Wiki’ Lists Are Full of Scams.

Where to go next#

Sources#

Leave a comment

Your email address will not be published. Required fields are marked *

Onion addresses posted here are checked against our directory automatically. Never trust an address from a comment until you have verified it.