How to Verify an Onion Address Is Official

Here are two onion addresses. One belongs to DuckDuckGo. Now imagine the other was created by someone who wants to see your searches.

Both addresses are the correct length. Both begin with the company’s name. Both end in the letter d, as every valid modern onion address does. If you came across either one on its own, in a list of links or a forum post, nothing in the string would tell you which was real. (The first is DuckDuckGo’s. The second was made up for this example and won’t open.)

The uncomfortable truth at the heart of onion verification is that an onion address only proves itself after you’ve chosen it. Once you connect, nobody else can answer at that address. But it can’t tell you beforehand whether you picked the right one. We explain why in What Is an Onion Service? .onion Addresses Explained.

So verification isn’t really about the address at all. It’s about provenance, meaning where the address came from and how much that source deserves your trust. A string copied straight from the organisation’s own website is worth a great deal. The same string copied from a forum post is worth almost nothing, even if it happens to be correct.

This guide is built around that idea. It starts with the quick checks you can do on the string itself and explains why they aren’t enough. Then it ranks the common sources of onion addresses from the most reliable to the worthless, shows how to compare addresses properly, and walks through real examples. It’s the same approach we use for every entry in our Official Onion Mirrors Directory.

Quick checks on the string itself#

Before you look into where an address came from, there are a few checks you can make on the address alone. They take seconds, and they catch mistakes and the laziest fakes.

1. Count it. A modern onion address has exactly 56 characters before .onion. If it has 16, it’s an old version 2 address, and those stopped working in 2021. Anything else is invalid.
2. Check the alphabet. Onion addresses use only the letters a to z and the digits 2 to 7. If an address contains a 0, 1, 8 or 9, it isn’t a real onion address.
3. Check the last letter. Every valid version 3 address ends in d, because the last character encodes the version number. If it ends in anything else, something is wrong.
4. Let Tor Browser check the rest. The address has a built-in checksum. If a character has been mistyped or changed, Tor Browser refuses to connect and shows an error instead of taking you somewhere else.

Why these aren’t enough#

Every one of those checks catches accidents. None of them catches a deliberate fake. A scammer’s address is a perfectly valid address. It has 56 characters, the right alphabet, the letter d at the end and a correct checksum, because it was generated the same way as the real one.

Worse, scammers can choose how their address begins. By generating keys over and over until the first few characters spell something, they can copy the opening of a genuine address. Matching eight characters takes hours to days on ordinary hardware. That’s exactly how organisations end up with readable prefixes such as duckduckgo or bbcweb3, and exactly how clones copy them. What nobody can do is match all 56 characters, because that would mean recreating the organisation’s private key.

So the string checks are a filter, not a verdict. They tell you an address is properly formed. To find out whose it is, you need evidence from outside the string. Our guide Onion Phishing: How Fake Mirrors Clone Real Addresses shows how convincing those well-formed fakes can be.

The evidence ladder#

Once you accept that the string can’t vouch for itself, the question becomes which sources can. Here they are, ranked from the strongest evidence to none at all.

Rank	Source	Why it’s this strong
1	The organisation’s own website, reached by typing its domain yourself	The organisation is speaking for itself, on a domain you already trust
2	The purple “.onion available” button on the organisation’s own site	The site tells Tor Browser its onion directly, but it depends on the same website
3	A TLS certificate issued to the onion address	A certificate authority checked control of the onion before issuing it
4	An announcement on an account the organisation controls	Its own blog or verified account, as long as you reach it directly
5	Independent trackers and directories that show their proof	A useful cross-check, but never the final word
6	News articles, encyclopedias and older guides	Often correct when written, often out of date now
7	Search results, forums, chats, emails and link lists	No evidence at all, however confident they sound

The top of the ladder#

The organisation’s own website is the gold standard. Many organisations publish their onion on a help page, in a press release or on a page devoted to Tor. Some go further and keep a full index. The Tor Project lists every onion it runs at onion.torproject.org, Debian does the same at onion.debian.org, and Proton has a Tor page at proton.me/tor. What matters is that you type the domain yourself rather than clicking a link, and check that you’re on HTTPS.

The purple button is the simplest check of all. Many organisations add a small instruction to their normal website, called Onion-Location, that tells Tor Browser where their onion lives. When you visit the site in Tor Browser, a purple “.onion available” button appears in the address bar. Click it and you’re taken to the official onion. The feature arrived in Tor Browser 9.5, and Tor Browser can even be set to switch to the onion automatically when a site offers one. Just remember what it’s built on. The Tor Project’s own research notes on onion discovery point out that Onion-Location isn’t self-authenticating. It’s only as trustworthy as the website that sends it, which is why it ranks just below that website.

A certificate on the onion is the hardest proof to fake. Several organisations, including DuckDuckGo, Brave, the BBC, Proton and Cloudflare, serve their onions over HTTPS with a certificate issued to the onion name. A certificate authority only issues one after the operator proves control of that exact address, so a clone can copy the look of a site but not its certificate. Click the padlock in Tor Browser’s address bar to see the certificate details. If Tor Browser shows a certificate warning on one of these sites, don’t continue.

The middle of the ladder#

Official announcements on the organisation’s blog or verified accounts are good evidence, as long as you reach them directly and they’re recent. Organisations do change their onion addresses, and an announcement from years ago can point to something that no longer exists.

Independent trackers and directories are useful for cross-checking, and for finding out which organisations have onions at all. The community-maintained Real-World Onion Sites list on GitHub is one. Our own directory is another. The better ones show where each address came from, so you can climb back up the ladder yourself. Treat them as pointers rather than proof, and that includes us.

The bottom of the ladder#

News coverage and encyclopedias are often right when they’re written and wrong a few years later. When the BBC launched its onion in 2019, articles at the time quoted its address, a short version 2 address that stopped working in 2021. Those articles are still online.

Everything else, meaning search results, forum posts, chat messages, comments, emails and the long link lists that call themselves hidden wikis, is not evidence. It might be right. It might be a copy with a few characters changed. You can’t tell from the outside, and that’s exactly why scammers use these channels. We explain how those lists go wrong in Why Most ‘Hidden Wiki’ Lists Are Full of Scams.

Two sources are better than one#

For anything important, make sure two independent sources near the top of the ladder agree. For example, the organisation’s website and the certificate, or the purple button and the organisation’s help page. If they match, you can be very confident. If they don’t, stop and find out why before you type anything into the site.

Comparing addresses properly#

Even when you have an address from a reliable source, you still need to make sure the one in front of you is the same. Human eyes are bad at this. We read the start of a long string, glance at the end and fill in the middle with what we expect. Clones are designed to take advantage of exactly that habit.

Here’s how to compare properly.

1. Let the computer do it. Paste the address from the reliable source and the one you want to check into any text editor, one above the other. Then use the editor’s search to look for one inside the other. If the search finds it, they’re identical. If it doesn’t, they’re not, however similar they look.
2. If you must do it by eye, use chunks. Split the 56 characters into groups of four or eight and compare each group, including the middle. The middle is where clones usually differ, because it’s the part nobody checks.
3. Ignore what doesn’t matter. A prefix such as www. or search. is just a subdomain of the same onion, and http:// versus https:// doesn’t change which service you reach. The 56 characters before .onion are what identify it.
4. Never retype an address. Copy and paste it instead. A typo will usually just fail, but it tempts people to go looking for the correct address somewhere less reliable.
5. Watch the address bar’s suggestions. Tor Browser forgets your history when you close it, but within a session, the address bar can suggest an address you visited earlier. If you once landed on a clone, its address can be the first suggestion when you start typing.
6. Bookmark it once it checks out. After that, always use the bookmark. Bookmarks don’t change, can’t be swapped by a search engine and don’t depend on your memory.

One extra tip for anyone who uses several onions regularly. Keep a short private note of the addresses you’ve verified and where you verified them. If a site ever starts behaving oddly, you can check that you’re still on the address you trusted, and where that trust came from.

Worked examples#

The method is easier to understand in action. Here are four real situations, from the simplest to the one where verification isn’t possible at all.

Example one: DuckDuckGo#

If you want DuckDuckGo’s onion, start at the top of the ladder.

• The Tor Project’s support page. Its page on Tor Browser’s default search engine links to DuckDuckGo’s onion, and inside Tor Browser, DuckDuckGo also offers an Onionize option that takes you there.
• The certificate. DuckDuckGo’s onion is served over HTTPS with a certificate issued to the onion address. If that certificate is valid, it’s a second, independent piece of evidence.
• The cross-check. The address matches the one in our directory and in the Real-World Onion Sites list.

That’s three sources near the top of the ladder agreeing. The address is duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onionVerifiedCopyOpenCheckListed in our directory as DuckDuckGo (Search).duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad. Bookmark it and you’re done. Our page on search engines with official onion sites covers it in more detail.

Example two: Debian#

You want to install Debian packages over Tor, and Debian makes it easy by keeping an index of every onion it runs.

• Type onion.debian.org into your browser and check that you’re on HTTPS. The page lists around a hundred Debian onions, including the package archive and the security archive.
• Copy the address you need straight from that page, not from a forum guide that might be years out of date.
• Notice that the index has its own onion. The onion.debian.org page is available at jvgypgbnfyvfopg5msp6nwr2sl2fd6xmnguq35n7rfkw3yungjn2i4yd.onionVerifiedCopyOpenCheckListed in our directory as Debian onion index (Software). See the owner's proofjvgypgbnfyvfopg5msp6nwr2sl2fd6xmnguq35n7rfkw3yungjn2i4yd, which is the address in our directory. Bookmark it, and next time you can check Debian’s addresses without touching the open web.

The Tor Project works the same way with onion.torproject.org, as we explain in Tor Project’s Official Onion Sites. An organisation that publishes a complete index like this is making verification as easy as it can be. Our page on open-source projects on onion shows how to use Debian’s archive onions.

Example three: a newsroom whose onion isn’t working#

Say you want The New York Times’ onion. It’s genuine and official, but it’s on hold in our directory because it failed all of our recent reachability checks, probably because of a certificate problem, so we don’t list the address.

This is exactly when people get caught. The official address isn’t working, so they search for another one, and the first result is a clone. Don’t. Instead, go back to the top of the ladder. Type the newspaper’s domain yourself, look for its own help page about Tor or the purple button, and use the address it gives you. If the official onion is down, it’s down. A working address from a stranger isn’t a substitute. Our page on news onion sites keeps track of which newsroom onions are working.

Example four: an onion with no other identity#

Some onion services exist only as onions. There’s no ordinary website, no company and no published proof, just an address someone gave you. Since there’s nobody to check against, you can’t verify who runs it.

What you can verify is continuity. If you got the address from someone you trust, through a channel you trust, the onion’s cryptography guarantees that you’ll reach the same service every time you use that exact address. So the moment that matters is the first handover. Get the address directly from the person, check it carefully once, bookmark it, and never accept a “new” address for the same service from anywhere else without checking with them first. In the meantime, browse it at the Safest security level, as we explain in Tor Browser Security Levels: Standard vs Safer vs Safest.

Red flags, and what to do if you’ve been fooled#

Signs you might be on a clone#

None of these proves a site is fake on its own. Any one of them is a reason to stop and check the address against a source near the top of the ladder.

• “Our address has changed.” A banner or message telling you to switch to a new onion is one of the most common tricks. Real organisations do change addresses, but they announce it on their own website, not only inside the onion.
• A missing certificate where there should be one. If a service you know uses HTTPS on its onion suddenly appears over plain http://, or Tor Browser shows a certificate warning, something is wrong.
• Pressure to log in, pay or download. Clones exist to collect something. An unexpected login prompt, a request for a deposit or a “security update” offered from inside the site are all warning signs.
• A list of mirrors. Official services rarely offer a rotating selection of alternative onions. Sites that list several “working mirrors” are often the scams themselves.
• The address came from the bottom of the ladder. If you can’t say where an address first came from, you don’t know whose it is.

If you think you’ve been fooled#

Act quickly, and in this order.

1. Stop and close the tab. Then use New Identity in Tor Browser to clear the session.
2. Change your password on the real service. Reach it through a source you trust, either the address on the organisation’s own website or its normal clearnet site, never the address that fooled you. If you used that password anywhere else, change it there too.
3. Turn on two-factor authentication if the service offers it, and check the account’s recent activity or linked devices.
4. Don’t run anything you downloaded. Delete it. If you’ve already run it, treat your computer as compromised, and consider reinstalling from a verified source or using Tails until you can.
5. Accept that payments are usually gone. Cryptocurrency sent to a scammer almost never comes back. Report it to any service you paid from, and to your local authorities if you can safely do so.
6. Tell others. If the clone appeared on a list, warn the people who run that list. If it was posing as a service in our directory, report it to us with the full address so we can warn other readers.

Being caught by a good clone doesn’t mean you were careless. These clones are built to fool people who are paying attention. The fix is a habit, not vigilance. Get addresses from the top of the ladder, let the computer compare them, and bookmark them once. For a closer look at how clones are made and what they do once you’ve landed on one, see Onion Phishing: How Fake Mirrors Clone Real Addresses. App stores have their own version of this problem, which we cover in Fake ‘Dark Web’ Apps in 2026.

What’s changing#

Everything above comes down to a single gap. Onion addresses are secure but meaningless to people, while ordinary domain names are meaningful but depend on a chain of other parties. Much of the work happening around onion services right now is aimed at closing that gap. Here’s where things stand, according to the Tor Project’s own onion services research pages.

Already working#

• Onion-Location. The purple button described above. It’s implemented and officially supported in Tor Browser, and it’s the most practical tool most people have today.
• Alt-Svc. Some large websites, notably those using Cloudflare, can quietly route Tor Browser users to an onion in the background using a standard web header called Alt-Svc, as Cloudflare describes in its own write-up. It’s completely transparent, which is convenient but also means you may not notice it happening.

Getting closer#

• Free onion certificates. In June 2025, RFC 9799 standardised how the automated certificate system behind services like Let’s Encrypt can issue certificates for onion addresses. However, the Tor Project’s certificates page, last updated in April 2026, still lists it as needing adoption by certificate authorities, and no major free authority issues them yet. Once one does, many more organisations are likely to put HTTPS on their onions, and the certificate rung of the ladder will cover far more sites.

Still research#

• DNS-based discovery. Publishing an organisation’s onion address in its normal DNS records, so a browser could look it up from the domain name. The Tor Project lists this as research.
• Sauteed Onions. A proposal to link domain names to onions using the public logs that record every certificate issued on the web. Because browsers already depend on those logs, they would be hard for a censor to block. The Tor Project lists this as research too.
• Onion names. Ideas for human-friendly names that point to onions while keeping their ability to authenticate themselves. This is still at the research stage.

None of this changes the advice for now. Until these features arrive and are widely used, verification still depends on where an address came from. Our explainer What Is an Onion Service? .onion Addresses Explained goes further into certificates and why onion addresses look the way they do, and our guide How to Host Your Own Onion Service shows organisations how to add Onion-Location and publish a proof page today.

Where to go next#

• Want addresses that have already been checked? Start with the Official Onion Mirrors Directory, where every entry shows its proof, and the Tor Project’s official onion sites.
• Want to see how clones are built? Read Onion Phishing: How Fake Mirrors Clone Real Addresses.
• Want to understand why the address works the way it does? See What Is an Onion Service? .onion Addresses Explained.
• Logging in to anything over Tor? Our guide to Secure Email Over Tor covers account habits that protect you even if you do land on a fake.
• New to Tor? Begin with How to Download and Install Tor Browser Safely, the first place where verification matters. On a phone, see Using Tor on Android and iPhone.
• Want to know how we work? See About thehidden.wiki.

Sources#

• Onion Association, Tor Project onion services research, read October 13, 2026
• Certificates for Onion Services, Tor Project, updated April 13, 2026
• Onion-Location, Tor Project community documentation
• Why is DuckDuckGo the default search engine in Tor Browser?, Tor Project support
• onion.torproject.org and onion.debian.org, official onion indexes
• Access all Proton services with the Tor anonymity network, Proton
• RFC 9799: ACME Extensions for “.onion” Special-Use Domain Names, IETF, June 2025
• Introducing the Cloudflare Onion Service, Cloudflare blog
• Sauteed Onions, project page
• Real-World Onion Sites, daily status checks to October 11, 2026