RapTor
Onion Services: Why a .onion Address Is a Key, Not a Name
Every verification instruction on every market page across this site — check the signed list, compare the full fingerprint, never trust a one-character difference — reduces to a single fact about onion services: a `.onion` address isn't a name someone registered, the way a domain name is. It's a public key, encoded directly into the address itself, which is what makes the address and the thing it points to mathematically inseparable. This page covers how onion addresses work and why that mechanism matters, for a reader opening onion sites over Tor Browser rather than running them — hosting your own onion service is a different job with its own guides, and this page concedes that half of the topic deliberately.
What a .onion address actually is
A modern onion address — 56 characters before the `.onion` suffix — is a base32 encoding of an ed25519 public key, not an arbitrary string someone chose and registered with an authority.Tor Project Tor Project's own description is direct about why this looks the way it does: "This looks weird and random because it's the identity public key of the Onion Service. That's one of the reasons we can achieve the security properties above."Tor Project There is no registrar, no central authority, and no possibility of a name dispute the way there is with a domain — the address is generated directly from a cryptographic key pair the service's operator creates, and it is that key pair, not any registration record anywhere, that makes the address theirs.
Why the address and the identity can't be separated
Because the address encodes the actual public key, verifying you're talking to the genuine service and verifying you've typed the correct address are the same act, not two separate steps the way they are on the ordinary web — there's no DNS layer in between that a certificate authority or a registrar could compromise, spoof, or be pressured to redirect. This is what Tor Project calls end-to-end authentication: "When a user visits a particular onion, they know that the content they are seeing can only come from that particular onion. No impersonation is possible" in the way a DNS-based attack can silently reroute an ordinary web visitor to an impostor server.Tor Project The address isn't a label pointing at an identity maintained somewhere else — the address is cryptographically the identity, which is precisely the property every market page's verification section on this site depends on.
Why one wrong character is a different site, not a typo
Because the address is a public key rather than a human-chosen name, there is no "close enough." A domain name can be typo-squatted — arnazon.com reads as a plausible near-miss of a real brand to a hurried eye — precisely because domain names are arbitrary strings a registrar will sell to anyone. An onion address has no such flexibility: changing even a single character produces an address derived from an entirely different key, controlled by whoever generated that key, with no relationship whatsoever to the original service. A convincing phishing clone of a darknet market, covered repeatedly across RapTor's market reviews, isn't a near-miss of the real address — it's a completely unrelated key that happens to produce a visually similar string, which is exactly why every verification section on this site insists on checking the full address and its signature rather than eyeballing whether it "looks right."
Why a mirror is a different key, and a different identity
A market publishing several mirror addresses — TorZon's sixteen, Nexus's three or four — is publishing several completely distinct keys, each one its own separate identity as far as the cryptography is concerned, unified only by the fact that the same operator chose to run a service behind each one and vouches for the set together. That's the reason a signed announcement listing which addresses are currently genuine is the only thing that actually connects those separate keys back into "the same market" in any checkable sense — nothing about the addresses themselves declares a relationship between them. A phishing operator can generate as many convincing-looking mirror addresses as they want; what they cannot do is produce a signature over that list that verifies against a signing key you've independently confirmed belongs to the real operator, which is the entire mechanism PGP on the dark web walks through in practical, step-by-step form.
How the connection actually gets made
An onion service first contacts a handful of relays and asks them to serve as its introduction points, reaching them through its own anonymized three-hop circuit so the introduction points never learn where the service is actually running.Tor Project The service then assembles a descriptor — a document listing those introduction points — and signs it with its own identity private key, the same key pair the address is derived from, before uploading it to a distributed hash table that functions as the network's lookup system.Tor Project When you visit the address, your client fetches that signed descriptor and verifies its signature using the public key encoded directly in the address you typed — proving the descriptor could only have been produced by whoever holds the matching private key — then uses the listed introduction points to arrange a meeting at a separate rendezvous point, a relay neither side has told the other about in advance.Tor Project The completed connection routes through six relays total — three chosen by you, three chosen by the service — so neither party learns the other's location at any point in the process.Tor Project
End-to-end encryption, and why there's no exit relay
Unlike an ordinary Tor circuit reaching the open internet, an onion service connection never needs an exit relay at all, because both ends of the conversation are on the Tor network the entire time — there's no point where traffic has to leave Tor's own encryption to reach an ordinary web server, which is exactly what an exit relay's job is on the clearnet side of things, covered on how Tor works. That means onion traffic is encrypted end to end between you and the service by construction, without depending on the destination separately supporting HTTPS the way a clearnet site does. The onion icon Tor Browser shows in the URL bar when you're on a genuine onion service reflects exactly this: a connection that is both routed anonymously and encrypted all the way to the actual service, not merely to some intermediary.Tor Project
More than markets
Onion services exist for reasons that have nothing to do with darknet markets, and it's worth knowing the category is broader than this site's own focus on it — Tor Project names anonymous publishing, metadata-free chat and file sharing, and safer contact between journalists and sources through tools like SecureDrop as core, legitimate uses of the same underlying mechanism, alongside some mainstream sites offering an onion address as a more secure path for privacy-conscious visitors.Tor Project The verification principle on this page applies identically regardless of what's behind the address — the cryptography doesn't know or care whether the service on the other end is a newsroom's tip line or a marketplace, and the reader's job of confirming the key before trusting it is exactly the same either way.
What this page doesn't cover, on purpose
Running your own onion service — configuring HiddenServiceDir permissions, managing client authorization keys, backing up the identity key that the address itself depends on — is a real and well-documented topic, and it's a different job from opening onion sites as a reader, which is this site's actual audience. If you're setting one up rather than visiting one, Tor Project's own hosting documentation covers that path directly; this page concedes that half of the subject deliberately rather than diluting either job by trying to cover both at once.
The practical, step-by-step version of checking a signature against a key — the thing this whole page exists to justify — lives on PGP on the dark web, and every review on RapTor's market directory applies it to a specific market's address.