onion address validator
v3 checksumevery tor v3 address embeds a cryptographic checksum of its own public key. paste an address below: if the checksum fails, that string cannot be a real v3 service - someone mistyped it or a scammer invented it. with javascript enabled everything is computed in your browser.
two ways this runs: with javascript on you get instant feedback as you type - nothing leaves your browser. with javascript blocked the form posts to our server instead, where the checksum runs once in memory and is never stored or logged - but the pasted address does cross the network.
how a v3 address is built
- the 56 characters
- a v3 address is base32 of exactly 35 bytes: a 32-byte ed25519 public key, then a 2-byte checksum, then one version byte. 35 bytes = exactly 56 base32 characters.
- the checksum
- it is the first two bytes of sha3-256 over the string ".onion checksum", the public key and the version byte. change one letter anywhere in the address and the checksum falls apart.
- 16-character addresses
- those are ancient v2 services - deprecated since 2021 and no longer reachable in current tor versions. treat any site still handing out v2 links as abandoned or fake.
- valid checksum but shady content?
- totally possible. anyone can generate a valid address; the checksum only rules out typos and lazy fakes. verify addresses against official announcements, ideally via pgp-signed messages (verify tool).