How Tor Onion Domain Names Work
Tor onion domain names, recognizable by their .onion
suffix, are specialized addresses used to access hidden services—now
officially called Onion Services—within the Tor network. Unlike
traditional websites that rely on the standard Domain Name System (DNS)
and clear-text IP addresses, onion domains function using decentralized
cryptographic key pairs and multi-layered routing. This article explains
how .onion addresses are generated, how they bypass
standard internet registries, and the multi-step handshake process that
connects users to services while preserving the anonymity and location
of both parties.
The Structure of an Onion Address
An onion address is not registered through a central domain registrar like ICANN. Instead, it is automatically generated from a cryptographic public key.
In the modern Tor standard (v3 Onion Services), a domain name
consists of 56 alphanumeric characters followed by .onion.
This string is a base32-encoded representation of the service’s Ed25519
public key, along with a small checksum and version byte. Because the
address itself is the public key, the name inherently authenticates the
destination without requiring a third-party Certificate Authority
(CA).
Bypassing Traditional DNS
Standard web browsers resolve human-readable domains (like
example.com) to numerical IP addresses via DNS servers. Tor
completely bypasses this architecture:
- No Centralized Lookup: Onion addresses cannot be resolved by standard internet DNS servers.
- Distributed Hash Table (DHT): Tor relies on a decentralized directory database within the Tor network, known as the Hidden Service Directory (HSDir).
- Cryptographic Identity: The address itself contains the information necessary to verify the service’s identity, ensuring that requests cannot be spoofed or hijacked through standard DNS poisoning techniques.
Step-by-Step Connection Process
Establishing a connection to an onion service involves a coordinated sequence between the host, the client, and intermediate Tor relays:
1. Service Setup and Introduction Points
When an onion service launches, it builds standard three-hop Tor circuits to several random relays, designating them as Introduction Points. The service then creates a “service descriptor”—a signed document containing its public key and the list of its introduction points—and publishes this descriptor to the distributed hash table (HSDir).
2. Client Request and Rendezvous Point Selection
When a user inputs a .onion address into the Tor
Browser: * The browser extracts the public key from the address and
queries the HSDir to retrieve the service descriptor. * Simultaneously,
the client builds a three-hop circuit to a randomly chosen relay and
designates it as a Rendezvous Point (RP), creating a
one-time secret (“cookie”).
3. The Introduction Handshake
The client constructs an encrypted introduction message containing the address of the chosen Rendezvous Point and the secret cookie. The client sends this message to one of the service’s Introduction Points, which forwards it to the hidden service.
4. Establishing the Rendezvous
The onion service receives the message, decrypts it, and builds its own three-hop circuit to the specified Rendezvous Point. It presents the secret cookie to prove that it is the intended service.
5. Encrypted Data Transfer
The Rendezvous Point connects the client’s circuit with the service’s circuit, forming a complete six-hop path. The Rendezvous Point merely relays encrypted packets back and forth; it cannot read the traffic or determine the true IP address of either the client or the service.
Core Security Benefits
- Mutual Anonymity: Neither the client nor the server learns the other’s physical IP address or geographic location.
- End-to-End Encryption: Traffic inside the six-hop circuit is encrypted using keys negotiated directly between the client and the host.
- NAT and Firewall Traversal: Because the onion host makes outbound connections to relays rather than listening for inbound connections, it operates seamlessly behind firewalls and Network Address Translation (NAT) without requiring open inbound ports.