Why Tor Phased Out V2 Onion Addresses

The Tor Project officially deprecated and completely retired Version 2 (V2) onion addresses in late 2021 due to critical security and architectural vulnerabilities. The legacy V2 system relied on outdated cryptography, exposed hidden services to discovery via malicious directory servers, and lacked modern privacy protections. By transitioning entirely to Version 3 (V3) onion addresses, the Tor network significantly improved security, confidentiality, and network resilience.

Outdated Cryptography

The primary catalyst for retiring V2 onion services was its obsolete cryptographic foundation. V2 addresses were generated using 1024-bit RSA keys and SHA-1 hashing algorithms. Over time, advances in computing power rendered SHA-1 vulnerable to collision attacks, while 1024-bit asymmetric keys no longer met modern security standards. These weaknesses meant that well-funded adversaries could potentially forge or compromise hidden service identities.

Hidden Service Directory Enumeration

Under the V2 architecture, the central lookup mechanism had a major privacy flaw: malicious relay operators could easily discover the existence of private onion sites.

When a V2 service published its introduction points to the distributed hash table (Hidden Service Directories, or HSDirs), those directories learned the onion address. Rogue operators running HSDir nodes routinely harvested 16-character V2 addresses, effectively deanonymizing sites intended to be secret and cataloging the entire hidden web.

Key Enhancements in Version 3

The Tor Project introduced Version 3 onion addresses to replace the flawed V2 design. The key improvements include:

• Modern Cryptography: V3 uses 256-bit Ed25519 public keys and SHA-3 hashing, eliminating legacy algorithmic weaknesses.
• Longer Addresses: V3 addresses are 56 characters long, directly encoding the full public key into the address itself.
• Address Blinding: V3 utilizes blinded public keys to publish service descriptors. HSDir relays can no longer learn or derive the actual onion address, stopping unauthorized indexing and enumeration completely.
• Advanced Metadata Protection: The protocol minimizes information leaked during the rendezvous and connection-establishment phases.

The Deprecation Timeline

The Tor Project initiated the deprecation schedule in September 2020 by actively warning operators and developers. Support for V2 addresses was gradually phased out across Tor client releases throughout 2021. With the release of Tor 0.4.6.x and Tor Browser 11.0 in late 2021, support for V2 addresses was entirely removed from the codebase, rendering all remaining 16-character V2 links unreachable across the network.