If you enter “hidden wiki” into a search engine, you’ll see numerous sites claiming to be the Hidden Wiki. Some call themselves the original, others the real one, the uncensored one, the updated one or the official one. They look alike, they share many of the same links, and all of them suggest the same idea, that this is the reliable guide to the onion world.
There is no official Hidden Wiki, and there hasn’t been one for more than ten years. All that remains is a name, and since no one owns the name, anybody can use it. That’s the heart of the issue, and it explains far more than the standard warning that “these lists contain scams”.
Consider what a link list really is. It’s a page that tells people where to go, read by people who can’t easily check whether it’s accurate. That makes it one of the most valuable pieces of real estate on the onion network, and valuable real estate attracts buyers. With most Hidden Wiki lists, the buyers are scammers, and in many cases the list owner and the scammer are the same person.
We’ll break the problem down into four parts. First, where the name came from and how it turned into a free-for-all. Then who pays for a link list, and how. Then why even honest lists eventually go bad. Finally, how to check any list yourself in about ten minutes. To finish, we’ll take on an uncomfortable question, which is why a website that warns against Hidden Wiki lists is called thehidden.wiki.
From a real wiki to a brand#
The Hidden Wiki began as exactly what its name says. It was a wiki, built on the same MediaWiki software as Wikipedia, and run as an onion service. People could sign up and edit it, and its main page worked as a directory of links to other onion sites. Pieced together from Wikipedia’s account and reports from the time, its history runs roughly like this.
- 2007. The first known reference to a Hidden Wiki, at an old-style 16-character onion address.
- 2011. A widely known version of the wiki becomes infamous. Because it was mostly unmoderated, it linked to child abuse sites alongside everything else, and that led the hacking group Anonymous to attack its hosting provider.
- Before August 2013. The wiki is hosted on Freedom Hosting, then the largest hosting service on Tor. In early August 2013, the sites hosted there are taken offline in a law enforcement operation.
- 2014. The wiki is reported hacked in March, and its old address is reported seized in November.
- October 2021. The Tor Project permanently retires the old 16-character onion addresses, and every address from the wiki’s early days stops working. We explain the difference between old and new addresses in What Is an Onion Service?
At each of those breaks, the same thing happened. Someone made a copy. Some copies were set up because the main wiki kept going offline. Others were set up to remove the abuse links. Others were set up for less innocent reasons. By the mid-2010s, as Wikipedia puts it, there was no longer a single official Hidden Wiki, just a family of mirrors and forks with no head of the family.
What changed when the original disappeared#
Once the original was gone, two things happened, and both still shape every Hidden Wiki list that exists today.
The editing stopped. The original’s value, good or bad, came from being a wiki that many people edited. Most of the copies aren’t wikis at all. They’re static pages, or wikis with registration closed, controlled by one anonymous person. The name still suggests a resource maintained by a community. What you actually get is one stranger’s list, with no way of finding out who they are or whether they’re being paid.
The name became an asset. “The Hidden Wiki” has been mentioned in newspapers, on Reddit and in YouTube videos for more than ten years. New Tor users search for it by name. Anyone who puts the name on a page gets that traffic for free. And since there’s no trademark, no owner and no original left to compare against, nobody can stop anyone from doing so, on an onion address or on an ordinary website. That’s the opening scammers walked through.
Who pays a link list, and how#
Running a list takes some time and a small amount of money. Most lists are run anonymously, have no donation button anyone can trust, and yet stay online for years. So someone is paying. Trace the money and you’ll find a small number of arrangements, most of which put the reader last.
| Who pays | What they get | What the reader sees |
|---|---|---|
| Sellers who buy placement | A top spot, a “featured” badge or a “verified” tick | A tidy list where the first entries in each category look the most trusted |
| The list owner’s own scams | A steady flow of new victims | Shops and services that look independent but share one owner |
| Phishing operators | Their clone listed instead of the real service | The right name next to the wrong address |
| Advertisers on ordinary websites | Clicks from people searching “hidden wiki” | Pages heavy with ads and affiliate offers, whose links may not even work |
The self-selection problem#
The first row is the key one, and it works even when nobody is lying. Many lists sell placement openly, with an “advertise here” link and a price in cryptocurrency. Now consider who is most willing to pay for that spot.
A genuine service that has to deliver something to every customer has real costs, and only a small budget for advertising. A fraudulent shop that takes payment and sends nothing has no costs at all. Every coin it receives is profit, so it can always outbid an honest seller. Sites selling card details that don’t work, counterfeit money that never arrives, “hackers for hire” and worse aren’t a few bad cases that slipped onto these lists. On paid lists, they’re the best customers.
That’s why so many Hidden Wiki lists have the same structure. A few genuine, well-known services sit at the top to borrow their credibility. Below them come category after category of shops and services nobody has heard of, each promising the same impossible things. The academic research on this backs it up. A study of the financial “services” advertised through lists such as the Hidden Wiki found the market was likely to harbour scams aimed at buyers, including fake escrow offered as extra reassurance that was itself part of the scam.
When the owner is the scammer#
The simplest setup is one where the list owner doesn’t need to sell anything to anyone, because they run the scams themselves. The list is the front door. It attracts visitors with the famous name, then sends that traffic to shops and clones the same person controls.
Research suggests this kind of operation is common. A 2019 study at KAIST examined nearly 29,000 onion services and confirmed 901 phishing domains. A 2020 study by Barr-Smith and Wright grouped onion phishing into campaigns run by networks of related sites, rather than by lone operators. A list is the obvious place for a network like that to advertise its own work.
Swapped links#
The phishing operator doesn’t need to own a list, only to get one link changed. Replacing the address of a genuine service with a lookalike clone is cheap, quiet and very hard for a reader to spot. In our guide Onion Phishing: How Fake Mirrors Clone Real Addresses, we explain how those clones are built, step by step.
This even happens to lists people trust. According to the security firm Flare, between April 29 and May 5, 2021, attackers took control of the two most widely used directories of market links by faking a German court order to get the directories’ domain names transferred to them. For about a week, every visitor was shown phishing links. If the most trusted lists in that world can be hijacked, an anonymous copy of the Hidden Wiki has no protection at all.
The ordinary-web versions#
Many so-called “hidden wiki” sites aren’t onion services at all. They’re ordinary websites built to appear in search results for the name. Their business is the visit itself. They make money from advertising and affiliate links, often for VPN services, and their income doesn’t depend on whether the onion addresses on the page are right, wrong or long dead. A list that gets paid whether or not its links work has no reason to check them.
Copies of copies#
Even if a list is run by someone honest, who takes no money and means well, it will still go wrong, for reasons that have nothing to do with intent.
Lists are built from other lists#
Almost no list owner finds onion addresses on their own. They copy them from other lists, which copied them from older lists. It’s a chain of copying, passing along 56-character strings that nobody can read. If a single address on a well-known list is swapped for a clone, that clone spreads to every list that copies from it, and then to every list that copies from those. Within a few weeks it can appear on dozens of pages, and the fact that it shows up everywhere starts to look like proof that it’s genuine. Repetition isn’t verification. Ten lists giving the same address usually means one list was copied nine times.
Addresses die, and the gaps get filled#
Onion services do move. They change addresses after an attack, after a key is compromised, after an upgrade, or when they shut down. The biggest move of all came with the retirement of the old 16-character addresses. The Tor Project published a timetable in June 2020, giving operators about fifteen months’ notice, and from October 2021 those addresses stopped working everywhere. Since Tor Browser 11, trying to open one shows an “Invalid Onionsite Address” error.
A list that hasn’t been updated since then isn’t just out of date. It’s dangerous, because dead entries leave gaps, and gaps get filled. A reader who finds the real address no longer works goes looking for a replacement, and the first “new address” they come across is often a clone. Researchers have seen this pattern at work. When the major link site DeepDotWeb was shut down in 2019, the 2020 study mentioned above found phishing operators moving in to take advantage of the uncertainty. Our onion phishing guide shows the same thing happening when a real site is temporarily down.
Green dots and fresh dates#
Many lists try to look up to date with uptime indicators, the small green dots that say a site is “online”, and with a year in the title, such as “Updated 2026”. Neither proves much.
- A green dot only means the address responded. It doesn’t tell you whether that address belongs to the service named next to it. A phishing clone has excellent uptime, and its operator makes sure of that.
- A date in the title costs nothing. Changing “2025” to “2026” takes one edit. It doesn’t mean a single address on the page was checked.
The only freshness that matters is per entry. When was this particular address last checked, against which source, and by whom? Almost no Hidden Wiki list will tell you.
Auditing a list in ten minutes#
You don’t need to accept our view of any list, including ours. You can check one yourself, without clicking a single link you’re unsure of. Work through these eight checks. The first two are the quickest and catch the most.
- Check the famous entries against their real sources. Pick three well-known services with official onion addresses you can confirm elsewhere, such as the Tor Project, DuckDuckGo and the BBC. Compare the full address, all 56 characters, with the one published on the service’s own website or in the Tor Project’s onion index. Our guide on how to verify an onion address explains where each service publishes its address. If any famous entry is wrong, close the list. Someone either swapped it or never checked it, and you can’t tell which.
- Look for short addresses. Any onion address with only 16 characters before “.onion” has been dead since October 2021. A list that still shows them hasn’t been properly maintained for years.
- Look for the person behind it. Is there a named editor, or at least a consistent pseudonym, a way to get in touch, and a way to report a bad link? A list without an owner has no one to correct it.
- Look for evidence on each entry. Does each address come with a link to where it was found, or the date it was last checked? “Verified” without saying how is just a word.
- Look for anything for sale. “Advertise here”, “featured”, “sponsored”, “premium listing” or a price list for placement means the order of the list was bought. Remember who has the most money to buy it.
- Read the categories, not just the entries. What a list includes shows you who’s funding it. Scams cluster around stolen cards, counterfeit money, “hacking services”, hitmen and “escrow”. A list built around them is a shop window for fraud.
- Notice what it asks of you. A list should only ever give you addresses. If it asks you to register, deposit money, install anything or contact someone on a messaging app, leave.
- Distrust the word “official”. Any site calling itself the official, original or genuine Hidden Wiki is making a claim that can’t be true. There’s no original left.
A list that fails either of the first two checks, or the last one, isn’t worth the other six. And even a list that passes all eight is only as good as its most recent check. Treat it as a pointer to where the real address might be, then confirm it at the source.
The faster route#
For anything important, skip lists entirely. Most organisations that run an onion service publish its address on their own website, and many sites show a purple “.onion available” button in Tor Browser that takes you straight there. We explain how that button works in our verification guide. Start from the organisation rather than from a list, and there’s nothing in between to poison. If you want a shortcut for the services we track, our Official Onion Mirrors Directory links every address to the page where its owner publishes it.
So why is this site called thehidden.wiki?#
It’s a fair question, and we’d rather answer it than hope nobody asks.
We picked the name for the same reason scammers do. It’s what people type. Every day, people new to Tor search for “hidden wiki” because a video, a news article or a friend told them that’s where to begin. The site they land on shapes their understanding of the onion network and what they come to trust. So we wanted at least one of the results to tell them the truth, which is that the famous list is mostly a trap, and that the real onion network is full of newspapers, privacy tools, software projects and services they already know.
That only works if we hold ourselves to the audit above. So here’s how we score on it.
| Check | How we handle it |
|---|---|
| Famous entries match their sources | Every address in our directory links to the page where its owner publishes it, so you can check it in one click |
| No dead addresses | Listed addresses are checked regularly, and failing ones move to a public on-hold list instead of quietly staying up |
| A person behind it | The editor is named on our About page, with a way to contact us |
| Evidence on each entry | Each entry shows its proof source and the date it was last verified |
| Nothing for sale | We don’t sell placement, “featured” spots or badges |
| Categories | We list news, privacy, software and other legitimate services. No markets, no shops, no “services” |
| Nothing asked of you | We never ask you to register, pay or install anything to use the directory |
| “Official” | We don’t claim to be the official Hidden Wiki, because there isn’t one |
The full rules, including how something gets listed and what happens when an address fails a check, are in About thehidden.wiki. If you ever find one of our entries that doesn’t match its source, that’s exactly the failure this article describes, and we want to hear about it. Report it here.
And please treat us the way you’d treat anyone else. Don’t trust an address just because it’s on our page. Use our page to find the owner’s own announcement, and trust that.
Where to go next#
- Want to see how a clone is built? Read Onion Phishing: How Fake Mirrors Clone Real Addresses.
- Want to check an address yourself? Follow How to Verify an Onion Address Is Official.
- Want addresses you can trust? Start with the Official Onion Mirrors Directory, or go straight to the Tor Project’s own onion sites.
- Found a list inside an app? Read Fake ‘Dark Web’ Apps in 2026: What to Avoid.
- Looking for real news sites on onion? See News Onion Sites: BBC, DW, The Guardian and SecureDrop.
- Want private search over Tor? See Search Engines With Official Onion Sites.
- New to all this? Start with What Is an Onion Service? and Is Tor Legal? Using Onion Services Responsibly.
Sources#
- The Hidden Wiki, Wikipedia, for the history and the absence of an official version
- Freedom Hosting, Wikipedia, for the 2013 shutdown
- Doppelgängers on the Dark Web: A Large-scale Assessment on Phishing Hidden Web Services, Yoon et al., KAIST, The Web Conference 2019
- Phishing With A Darknet: Imitation of Onion Services, Barr-Smith and Wright, 2020
- Dynamics of Dark Web Financial Marketplaces: An Exploratory Study of Underground Fraud and Scam Business, CrimRxiv
- Major Hack Jeopardizes Future of Dark Web Marketplaces, Flare, May 2021
- Onion Service v2 Deprecation Timeline, Tor Project, tor-dev mailing list, June 2020
- Tor Browser 11 removes v2 onion URL support, BleepingComputer, 2021
- Tor Project onion services index