How Tor Onion Domain Names Work

Tor onion domain names, recognizable by their .onion suffix, are specialized addresses used to access hidden services—now officially called Onion Services—within the Tor network. Unlike traditional websites that rely on the standard Domain Name System (DNS) and clear-text IP addresses, onion domains function using decentralized cryptographic key pairs and multi-layered routing. This article explains how .onion addresses are generated, how they bypass standard internet registries, and the multi-step handshake process that connects users to services while preserving the anonymity and location of both parties.

The Structure of an Onion Address

An onion address is not registered through a central domain registrar like ICANN. Instead, it is automatically generated from a cryptographic public key.

In the modern Tor standard (v3 Onion Services), a domain name consists of 56 alphanumeric characters followed by .onion. This string is a base32-encoded representation of the service’s Ed25519 public key, along with a small checksum and version byte. Because the address itself is the public key, the name inherently authenticates the destination without requiring a third-party Certificate Authority (CA).

Bypassing Traditional DNS

Standard web browsers resolve human-readable domains (like example.com) to numerical IP addresses via DNS servers. Tor completely bypasses this architecture:

  1. No Centralized Lookup: Onion addresses cannot be resolved by standard internet DNS servers.
  2. Distributed Hash Table (DHT): Tor relies on a decentralized directory database within the Tor network, known as the Hidden Service Directory (HSDir).
  3. Cryptographic Identity: The address itself contains the information necessary to verify the service’s identity, ensuring that requests cannot be spoofed or hijacked through standard DNS poisoning techniques.

Step-by-Step Connection Process

Establishing a connection to an onion service involves a coordinated sequence between the host, the client, and intermediate Tor relays:

1. Service Setup and Introduction Points

When an onion service launches, it builds standard three-hop Tor circuits to several random relays, designating them as Introduction Points. The service then creates a “service descriptor”—a signed document containing its public key and the list of its introduction points—and publishes this descriptor to the distributed hash table (HSDir).

2. Client Request and Rendezvous Point Selection

When a user inputs a .onion address into the Tor Browser: * The browser extracts the public key from the address and queries the HSDir to retrieve the service descriptor. * Simultaneously, the client builds a three-hop circuit to a randomly chosen relay and designates it as a Rendezvous Point (RP), creating a one-time secret (“cookie”).

3. The Introduction Handshake

The client constructs an encrypted introduction message containing the address of the chosen Rendezvous Point and the secret cookie. The client sends this message to one of the service’s Introduction Points, which forwards it to the hidden service.

4. Establishing the Rendezvous

The onion service receives the message, decrypts it, and builds its own three-hop circuit to the specified Rendezvous Point. It presents the secret cookie to prove that it is the intended service.

5. Encrypted Data Transfer

The Rendezvous Point connects the client’s circuit with the service’s circuit, forming a complete six-hop path. The Rendezvous Point merely relays encrypted packets back and forth; it cannot read the traffic or determine the true IP address of either the client or the service.

Core Security Benefits