How to verify an .onion address properly before you trust it
An onion address looks like a domain, but it behaves like nothing else on the web. A v3 address is the base32 encoding of the service's public key - the string itself is cryptographic proof of identity, as the Tor Project's own documentation explains. There is no registry to consult, no certificate authority, no support desk.
That design is excellent for privacy and unforgiving in practice: change one character and you land on an entirely different server run by an entirely different person. Researchers at the eCrime conference documented thousands of cloned onion sites built on exactly this confusion. Verification is not optional etiquette. It is the whole security model.An address is a key, not a name
On the regular web you type a memorable name and TLS certificates vouch for the destination. Tor inverts this model completely. As the Tor Project Support documentation puts it, the .onion URL itself lets the browser ensure it is connecting to the right service. The practical consequence is that verification happens before you connect, not after. If the string did not come from a source you control or trust, no browser indicator will rescue you. The address either arrived through a trustworthy channel or it did not.Get addresses from primary sources only
Legitimate organisations publish their onion address themselves - usually on their clearnet site over HTTPS, linked from the footer or a dedicated mirror page. This pattern holds across news outlets, exchanges and privacy services alike. The primary source is the website the organisation actually controls. Directories and forums are secondary evidence at best. Academic work on onion services has repeatedly shown that link lists get poisoned: attackers swap authentic addresses for lookalikes, and users inherit the substitution unknowingly. If two sources disagree, the primary source wins every time. Never take an .onion address from a forwarded message. That single rule would have prevented most of the phishing incidents documented since 2018.The gold standard: PGP-signed announcements
The strongest verification available today is a signature you can check yourself. In 2019, dark.fail introduced the Onion Mirror Guidelines, which require operators to host a PGP-signed mirrors.txt listing their official addresses, alongside the signing keys at pgp.txt. Sites that comply prove ongoing control of both their URLs and their keys. The scheme also mandates a warrant-canary style canary.txt refreshed every fourteen days, giving users evidence the operator still holds the key. The site's PGP verification tool page notes that some researchers estimate more than five bitcoin per day was being stolen from users who skipped this step. Our PGP verify tool walks through the process if signatures are new to you.Compare character by character
For anything involving money or credentials, eyeballing is not enough. A widely cited USENIX study by Winter et al. found that most Tor users verify only a fraction of an address's characters - well within what attackers can brute-force with vanity-generation tools like Shallot. Human brains are simply poor at telling apart fifty-six random characters. The reliable method is mechanical:- Copy-paste the address instead of retyping it
- Diff the two versions character by character, not by eye
- Check first and last four characters with extra care - clones often mimic prefixes
- Bookmark the verified address once, then only use that bookmark
A green badge is not trust
Status lists like ours answer exactly one question: did a server respond at this address just now? An online badge means reachable. Nothing more.Reachability and trustworthiness are different questions. Never let a green light answer both.A scammer running a phishing clone keeps it online as diligently as any legitimate operator. The badge tells you the lights are on. It cannot tell you who is home.