How to Backup Tor Hidden Service Private Keys

Backing up the private keys of a Tor hidden service (Onion service) is critical for preserving your .onion address and ensuring service continuity during server migration or disaster recovery. This guide covers locating the essential cryptographic keys, creating encrypted backups using standard command-line tools, and safely storing them using cold storage practices to prevent unauthorized access.

1. Locate the Hidden Service Directory

Tor stores hidden service keys in a restricted directory defined in your torrc configuration file.

By default on most Linux distributions, this directory is located at:

/var/lib/tor/your_hidden_service_name/

Inside this directory, modern v3 Onion services contain three key files: * hs_ed25519_secret_key: The master private key (the most critical file). * hs_ed25519_public_key: The public key derived from the private key. * hostname: The text file containing your .onion address.

2. Prepare the Keys for Export

Before backing up, temporarily stop the Tor service to prevent data corruption or access conflicts:

sudo systemctl stop tor

Ensure strict file permissions remain intact so unauthorized system users cannot read the keys.

3. Create an Encrypted Archive

Never store or transfer raw, unencrypted private keys. Use symmetric encryption with GnuPG (GPG) to create a password-protected archive.

Create an encrypted .tar.gz archive of the hidden service directory:

sudo tar -czf - -C /var/lib/tor/ your_hidden_service_name | gpg --symmetric --cipher-algo AES256 -o onion_backup.tar.gz.gpg

Enter a strong, high-entropy passphrase when prompted.

4. Transfer and Secure the Backup

Move the encrypted backup file off the server immediately:

Offline Storage (Recommended): Transfer the .gpg file to an air-gapped, encrypted USB drive (e.g., formatted with LUKS).
Hardware Security: Store the storage media in a secure physical location (such as a fireproof safe).
Paper Backup: For critical infrastructure, consider exporting the raw base64 or hex format of the 64-byte hs_ed25519_secret_key and printing it as a paper key stored in a secure physical vault.

Once transferred, securely delete the local backup archive from the server:

shred -u onion_backup.tar.gz.gpg

5. Restoring the Keys

To restore your Onion service on a new server:

Install Tor and configure the HiddenServiceDir path in /etc/tor/torrc.

Decrypt the archive into the designated directory:

gpg --decrypt onion_backup.tar.gz.gpg | sudo tar -xzf - -C /var/lib/tor/

Set the required Tor ownership and strict permissions:

sudo chown -R debian-tor:debian-tor /var/lib/tor/your_hidden_service_name/
sudo chmod 700 /var/lib/tor/your_hidden_service_name/
sudo chmod 600 /var/lib/tor/your_hidden_service_name/*

Start the Tor service:
```
sudo systemctl start tor
```