Site URI Dark Web Explained: Verifying Onion Addresses

A site URI (Uniform Resource Identifier) on the dark web is the address you type into Tor Browser to reach an onion service. These addresses are not assigned by a central authority like ICANN; instead, they are generated cryptographically from the service's public key. A v3 onion address, the current standard, consists of 56 characters followed by .onion.

The address itself is deterministic, meaning the same service always produces the same URI. This is different from the surface web, where a domain name is purchased and registered. On the dark web, the operator generates the address and controls it through a private key. If you see two identical .onion addresses, they point to the same service; if they differ by even one character, they are completely different sites.

When someone sets up an onion service using Tor, the software generates a public-private key pair. The public key is hashed and encoded to create the .onion address. This process is one-way: you cannot reverse-engineer the private key from the address, and you cannot predict what address a service will have before it is created.

The address itself reveals nothing about the service's content, operator or location. A 56-character v3 address looks random because it is derived from cryptographic material, not from a human-readable name. This is why phishing is a real risk on the dark web: an attacker can create a new onion service with a completely different address and clone the appearance of a legitimate site. The only way to know you are visiting the real service is to verify the address through a trusted channel, such as a PGP-signed announcement or a link from the official site of a news organization.

Older onion services used v2 addresses, which were 16 characters long and based on weaker cryptography. The Tor Project deprecated v2 addresses around 2020 because the shorter format made them vulnerable to brute-force attacks and because the underlying cryptographic algorithm had aged. A v2 address looked like this: 3g2upl4pq6kufc4m.onion (the address of a well-known search engine, now offline).

V3 addresses are 56 characters and use modern elliptic-curve cryptography, making them far more resistant to attack. If you encounter a 16-character .onion address today, it is either a historical reference or potentially a scam using outdated infrastructure. Most legitimate dark web sites of news organizations, forums and services have migrated to v3 addresses. When you visit a dark web site, check whether the address bar shows a v3 address (56 characters) rather than a shorter one.

Verifying an onion address is critical because phishing clones are common on the dark web. Here are the steps to confirm you are visiting a legitimate site:

1. Find the official address through multiple independent sources, such as a PGP-signed announcement on the service's official clearnet site or a trusted news outlet.
2. Copy the address directly from the source rather than clicking a link from an unknown site.
3. Paste it into Tor Browser's address bar and check that the address in the browser matches exactly, character for character.
4. Look for any security indicators Tor Browser provides, such as a green lock icon or a confirmation that the site is using HTTPS.
5. If the site has a PGP key listed, verify the site's announcements using that key to confirm authenticity.

A single character difference means you are on a completely different site. Attackers register new onion addresses and copy the layout of popular sites, hoping users will not notice the address change. Always verify before entering any credentials or sensitive information.

According to Tor Project documentation and security-vendor incident reports, phishing is the most common attack vector on onion services. An attacker creates a new onion service with a cloned interface and waits for users to mistype the address or follow a link from a compromised forum post. Because onion addresses are random and unmemorable, users often rely on bookmarks or links, making them vulnerable to redirection attacks.

Law-enforcement agencies have also seized onion services and replaced them with phishing pages designed to harvest credentials or malware. This matters to you because even if you find an address through what seems like a trusted source, you cannot assume it is legitimate without verifying the cryptographic signature or checking multiple independent sources. The decentralized nature of the dark web means there is no central authority to revoke a fraudulent address, so vigilance is your only defense.

A v3 onion address consists of three parts: the 56-character hash, a dot, and the .onion suffix. The hash is the only variable part; the .onion suffix is always the same. The 56 characters are base32-encoded, meaning they use only the letters a-z and the numbers 2-7. This encoding makes the address easier to type and copy than raw hexadecimal.

When you see an address like vww6ybal4bd7szmf.onion, you are looking at a v2 address (16 characters). A modern v3 address looks like thehiddenwiki7cvk2pq6sd7yqt7wqhvh6sxea47xtiytolonimlid.onion (56 characters). The length alone tells you which version you are dealing with. Some services still operate on v2 addresses for historical reasons, but new services should use v3. If you are unsure whether an address is legitimate, the length and format are a first sanity check, but they do not guarantee authenticity.

Once you have verified an onion address, store it safely so you do not have to search for it again. Here is how to do this securely:

1. Use Tor Browser's bookmark feature to save the address after you have confirmed it is correct.
2. Store the address in a password manager or encrypted note-taking app if you need to access it from multiple devices.
3. Never share an onion address in plain text over unencrypted channels; if you need to share it, use PGP encryption or a secure messaging app.
4. Periodically re-verify the address by checking the official source again, especially if you have not visited the site in a long time.
5. If a site you regularly visit changes its address, verify the new address through the same trusted channels you used before.

Bookmarking prevents you from accidentally typing the address wrong or following a malicious link. It also reduces the number of times you need to search for the address, which lowers your exposure to phishing sites that rank high in dark web search results.

The core lesson is simple: a site URI on the dark web is only as trustworthy as your ability to verify it. Because onion addresses are cryptographically generated and not human-readable, attackers exploit this by creating convincing clones with different addresses. Your defense is to treat every address as unverified until you have confirmed it through an independent, trusted source.

Start by identifying one or two dark web resources you actually want to access, then find their official addresses through the clearnet sites of news organizations or the official announcements of the services themselves. Verify the address matches exactly, bookmark it, and use that bookmark every time. This single habit eliminates most phishing risk. If you are unsure whether an address is real, visit the Useful Resources page of this site to find links to PGP-signed announcements and official verification methods.