.onion

.onion is a special-use top-level domain name designating an anonymous onion service, which was formerly known as a "hidden service", reachable via the Tor network. Such addresses are not actual DNS names, and the .onion TLD is not in the Internet DNS root, but with the appropriate proxy software installed, Internet programs such as web browsers can access sites with .onion addresses by sending the request through the Tor network.

The "onion" name refers to onion routing, the technique used by Tor to achieve a degree of anonymity.

The purpose of using such a system is to make both the information provider and the person accessing the information more difficult to trace, whether by one another, by an intermediate network host, or by an outsider. Sites that offer dedicated .onion addresses may provide an additional layer of identity assurance via EV HTTPS Certificates or Domain-validated HTTPS certificates. Provision of an onion site also helps mitigate SSL stripping attacks by malicious exit nodes on the Tor network upon users who would otherwise access traditional HTTPS clearnet sites over Tor. Because connections to onion services do not use exit relays, they are not subject to exit node tampering.

Format

Addresses in the onion TLD are generally opaque, non-mnemonic, alpha-numerical strings which are automatically generated based on a public key when an onion service is configured. These strings can be made up of any letter of the alphabet, and decimal digits from 2 to 7, representing in base32 either an 80-bit hash ("version 2", or 16-character) or a 256-bit ed25519 public key along with a version number and a checksum of the key and version number ("version 3", "next gen", or 56-character). As a result, in the past all combinations of sixteen base32 characters could potentially be valid version 2 addresses (though as the output of a cryptographic hash, a randomly selected string of this form having a corresponding onion service should be extremely unlikely), while in the current version 3 only combinations of 56 base32 characters that correctly encoded an ed25519 public key, a checksum, and a version number (i.e., 3) are valid addresses.