The long goodbye of v2 onion addresses: how Tor retired a 16-character era
On October 15, 2021, the Tor Project shipped new stable releases that quietly switched off an entire addressing system. Overnight, millions of bookmarks pointing at 16-character v2 onions stopped resolving. The retirement had been announced more than a year earlier, yet the migration still caught much of the ecosystem flat-footed.
Built on borrowed crypto
Version 2 onion services dated from an era when their cryptography seemed adequate. Addresses were the truncated SHA-1 hash of an RSA-1024 key, and connections relied on the TAP handshake, code that had already been stripped from the rest of Tor. Only v2 services kept it alive. When researchers at CWI Amsterdam and Google produced the first practical SHA-1 collision in February 2017, the writing was on the wall. The so-called SHAttered attack required roughly 6,500 CPU-years, but it proved that collisions were no longer theoretical, and cryptanalyst Marc Stevens noted that industry deprecation of SHA-1 had simply been too slow (CWI Amsterdam).Proposal 224 builds the successor
The replacement had been in design for years before the collision landed. Proposal 224, the next-generation onion service specification, swapped RSA-1024 and SHA-1 for ed25519, curve25519, and SHA3, while redesigning the directory protocol to leak far less metadata to HSDir relays. Tor 0.3.2 shipped the first experimental implementation in late 2017, and the changelog was blunt about what changed: better crypto, better address security against impersonation, and a cleaner codebase (tor-commits). The price was cosmetic but visible. Addresses grew from 16 characters to 56, because they now contained a full ed25519 public key rather than a hash of one. Adoption followed a steady drumbeat. V3 became the default in Tor 0.3.5, reached feature parity with v2, gained OnionBalance support, and by early 2020 the entire network could carry v3 traffic.The 2019-2020 announcement and its timeline
In June 2020, Tor developer David Goulet laid out the case for retirement on the tor-dev mailing list, summarizing it in one word: safety. He cited the RSA-1024 keys, the truncated 80-bit SHA-1 addresses, the long-gone TAP handshake, and enumeration attacks that gave HSDir relays too much power (tor-dev list). The formal blog post followed on July 2.We will release new Tor client stable versions for all supported series that will disable v2. This effectively means that from today, the Internet has around 16 months to migrate from onion services v2 to v3 once and for all.The timeline published by the Tor Project set three dates: warnings starting September 15, 2020; support removed from the codebase in Tor 0.4.6 on July 15, 2021; and full disabling across stable releases on October 15, 2021 (Tor Project blog). Crucially, there was no cross-certification mechanism linking an old address to a new one. Every operator had to publish both and hope users made the switch.
The July 2021 cutoff
July 15, 2021 was the point of no return for developers. Tor 0.4.6 blocked the creation of new v2 services entirely, and Tor Browser began showing fullscreen warnings on every visit to a legacy address. The warning campaign worked faster than many expected. DarkOwl recorded a surge of nearly 3,000 newly registered v3 addresses in the last two weeks of July alone, as operators scrambled ahead of the final cutoff (DarkOwl). Some administrators misread the change, assuming v2 was already dead, and disabled their old addresses prematurely.Ecosystem reaction: laggards, losses, and lockout
By November 2021, monitoring data suggested the migration was incomplete despite everything. DarkOwl estimated that 62 percent of known onion services were still v2 addresses, a figure The Record reported as evidence that a third of the dark web had moved while the rest lagged (The Record). When Tor Browser 11 arrived, v2 addresses returned an "Invalid Onion Site Address" error, and the project told confused users the problem lay with the site, not the browser (Tor Project blog). Because removal happened per relay version, some v2 sites remained reachable through outdated clients and nodes for a while, creating a slow-motion fade rather than a clean break. The costs were unevenly distributed. Services that ran dual addresses lost little; those that ignored the deadline lost their audience overnight. Skeptics pointed to January 2021 outages that briefly took every v3 service offline when consensus health checks failed under DDoS traffic between darknet markets.What the transition left behind
Looking back, the v2 deprecation stands as a rare example of a graceful, multi-year cryptographic migration executed in an anonymous, untrusted network with no central registrar. There were no certificates to revoke and no DNS records to update, just keys, warnings, and deadlines.- V2 addresses were 16 characters derived from a truncated SHA-1 hash of an RSA-1024 key.
- V3 addresses are 56 characters encoding a full ed25519 public key.
- The formal deprecation timeline ran roughly 16 months, from mid-2020 to October 2021.