Who Registers Onion Domains in the Tor Network?

Unlike traditional web domains, onion domains are not registered or issued by any central organization, domain registrar, or governing authority. Instead, .onion addresses are automatically generated through mathematical cryptography directly on a user’s machine using the Tor software. This article explains how onion addresses are created, who controls them, and how the Tor network manages address generation without a central registry.

The Absence of a Centralized Registry

Standard web domains (such as .com or .org) rely on a centralized system managed by the Internet Corporation for Assigned Names and Numbers (ICANN) and commercial registrars like GoDaddy or Namecheap. The Domain Name System (DNS) maps human-readable names to numerical IP addresses.

The Tor network does not use the traditional DNS system. Consequently, there is no organization to approve registrations, collect fees, verify identity, or revoke .onion domains.

How Onion Domains Are Generated

Onion addresses are self-authenticating cryptographic identifiers derived from a public-private key pair generated by the Tor software.

When a user sets up a Tor Onion Service, the process works as follows:

1. Key Generation: The Tor software creates a public and private cryptographic key pair (currently using the Ed25519 algorithm for modern v3 onion services).
2. Address Derivation: The public key is combined with a checksum and version metadata.
3. Encoding: This combined string is encoded into Base32 format, resulting in a unique 56-character string.
4. Suffix Addition: The .onion suffix is appended to complete the address.

Because the address is directly derived from the public key, anyone connecting to the address can mathematically verify that the server they reach possesses the corresponding private key.

Domain Ownership and Control

Ownership of an .onion domain is determined entirely by the possession of the corresponding private key:

• Control: Whoever holds the private key file on their server controls the onion address.
• Loss of Access: If the private key is deleted or lost, the onion address is permanently lost and cannot be recovered.
• Transfer: Transferring ownership simply involves securely moving the private key to a new owner or server.
• Revocation: No third party can seize, suspend, or block an .onion domain at the registry level, because no registry exists.

Vanity Onion Addresses

Because addresses are mathematical outputs, standard .onion domains appear as random strings of characters. Users who want a recognizable name generate “vanity addresses” by running software that repeatedly calculates cryptographic keys until it finds a public key starting with the desired letters. This process requires significant computational power and becomes exponentially harder for longer custom prefixes.