Onion Services

When browsing an Onion Service, Tor Browser displays different onion icons in the address bar indicating the security of the current webpage.

Image of an onion An onion means:

  • The Onion Service is served over HTTP, or HTTPS with a CA-Issued certificate.
  • The Onion Service is served over HTTPS with a Self-Signed certificate.

Image of an onion with a red slash An onion with a red slash means:

  • The Onion Service is served with a script from an insecure URL.

Image of an onion with a caution sign An onion with caution sign means:

  • The Onion Service is served over HTTPS with an expired Certificate
  • The Onion Service is served over HTTPS with a wrong Domain
  • The Onion Service is served with a mixed form over an insecure URL

If you cannot reach the onion service you desire, make sure that you have entered the 16-character or, the newest format, 56-character onion address correctly: even a small mistake will stop Tor Browser from being able to reach the site. If you are still unable to connect to the onion service, please try again later. There may be a temporary connection issue, or the site operators may have allowed it to go offline without warning.

You can also ensure that you're able to access other onion services by connecting to DuckDuckGo's onion service.

Onion services allow people to browse but also to publish anonymously, including publishing anonymous websites.

Onion services are also relied on for metadata-free chat and file sharing, safer interaction between journalists and their sources like with SecureDrop or OnionShare, safer software updates, and more secure ways to reach popular websites like Facebook.

These services use the special-use top level domain (TLD) .onion (instead of .com, .net, .org, etc..) and are only accessible through the Tor network.

When accessing a website that uses an onion service, Tor Browser will show at the URL bar an icon of an onion displaying the state of your connection: secure and using an onion service.

Onion icon

Websites that are only accessible over Tor are called "onions" and end in the TLD .onion. For example, the DuckDuckGo onion is https://3g2upl4pq6kufc4m.onion. You can access these websites by using Tor Browser. The addresses must be shared with you by the website host, as onions are not indexed in search engines in the typical way that vanilla websites are.

Onion-Location is a new HTTP header that web sites can use to advertise their onion counterpart. If the web site that you're visiting has an onion site available, a purple suggestion pill will prompt at the URL bar saying ".onion available". When you click on ".onion available", the web site will be reloaded and redirected to its onion counterpart. At the moment, Onion-Location is available for Tor Browser desktop (Windows, macOS and GNU/Linux). You can learn more about Onion-Location in the Tor Browser Manual. If you're an onion service operator, learn how to configure Onion-Location in your onion site.

An authenticated onion service is an onion service that requires you to provide an authentication token (in this case, a private key) before accessing the service. The private key is not transmitted to the service, and it's only used to decrypt its descriptor locally. You can get the access credentials from the onion service operator. Reach out to the operator and request access. Learn more about how to use onion authentication in Tor Browser. If you want to create an onion service with client authentication, please see the Client Authorization in the Community portal.