Interesting Dark Web Sites: The Onion Services That Changed the Network
2004 to 2010: onion services arrive, and the first interesting dark web sites are experiments
Onion services, then called hidden services, were added to Tor in 2004, a few years after the Tor software itself emerged from research at the United States Naval Research Laboratory and was released as free software. The Tor Project's own history describes this period. The idea was to let a server be reached through Tor without revealing its location, using an address derived from a key rather than a registered name. For the first several years, the interesting dark web sites were experiments by people who understood the technology. Personal pages, mirrors of documentation, test services and small forums made up most of what existed. Addresses were the original 16-character format, derived from a hash of an RSA key. There were no search engines worth the name, and discovery happened through word of mouth and hand-maintained link pages, the ancestors of the directories that still cause trouble today. What this period established was the basic shape of the network: a space where anyone with a key could publish, where nobody could enumerate what existed, and where trust had to come from somewhere other than the address. Every later milestone builds on that shape, and every current safety problem descends from it. The link pages of this era, in particular, set the pattern of unverified lists that persists in every directory since.
2010 to 2014: attention, notoriety and the first institutional onion sites
The early part of the following decade brought onion services to public attention, largely through coverage of illegal marketplaces and their eventual seizures, events that are well documented in court records and journalism and that this site does not detail beyond noting them. That notoriety shaped how the public understood the network and still colours the phrase dark web today. Something else happened in the same years that mattered more for the network's future. In 2014, Facebook launched an onion service for its site, becoming the first major mainstream company to do so and, notably, obtaining a conventional TLS certificate for an onion address. The company's engineers explained publicly that the goal was to let users in places that blocked Facebook reach it through Tor, and to prevent Tor users being flagged as suspicious by the site's security systems. It was the first time a household-name organisation said, in effect, that an onion address was a legitimate way to reach it. The Facebook launch also demonstrated something technical that later became common: a vanity address, generated by brute force so that its first characters spelled the company's name. That practice, recognisable prefixes on otherwise random addresses, is now used by many legitimate operators and, for the same reason, by clone operators imitating them.
2016 to 2019: newsrooms and nonprofits make cool dark web sites respectable
The next wave of milestones came from journalism and civil society, and it is the reason that the cool dark web sites worth knowing about today are so often run by newsrooms. In 2016, ProPublica launched an onion version of its site, describing it as a way to offer readers privacy from surveillance and to reach audiences under censorship, and it was widely reported as the first major news organisation to do so. The New York Times followed in 2017 with its own onion service, and the BBC launched one in 2019, explicitly to make its news available in countries that block it. Alongside these, secure submission systems became standard at major outlets. SecureDrop, a whistleblower submission platform maintained by the Freedom of the Press Foundation, runs as an onion service and had been adopted by dozens of newsrooms by the end of the decade, each publishing its address on its clearnet site. In 2019 the United States Central Intelligence Agency launched an onion version of its website, an event the agency announced itself and which was covered as a sign that onion services had become an ordinary channel for institutions to reach people who needed privacy. The lesson of this period is that operators who want to be found by the right people publish accountable addresses, which is exactly what makes these services safe to reach and what distinguishes them from the unverifiable majority.
2017 to 2021: the address format changes and interesting onion links become longer
The most consequential technical milestone of the period was invisible to most users until it broke their bookmarks. In late 2017 the Tor Project introduced the next generation of onion services, version 3, with 56-character addresses encoding a full Ed25519 public key rather than a truncated hash. The Tor Project's documentation explains the reasons: stronger cryptography, addresses that fully identified their keys, and a directory design using blinded identifiers so that relays could no longer harvest lists of what existed on the network. For several years both formats ran in parallel, and interesting onion links published in that window came in two lengths. Then the Tor Project deprecated version 2, and in 2021 removed support from Tor Browser entirely. Every 16-character address stopped resolving. Services that had not migrated became unreachable, and every directory, wiki and article that still quoted old addresses became, at a stroke, a list of dead links. The transition matters to readers now for two reasons. First, any page still quoting 16-character addresses has not been meaningfully updated since 2021, which dates everything else on it. Second, the change closed the enumeration loophole, which is why no search engine or researcher can list what exists on Tor today and why discovery depends entirely on who links to whom. Both facts follow directly from a milestone most users never noticed.
2020 onward: Onion-Location and the era of cool dark websites you can verify
In 2020 Tor Browser gained a feature that quietly solved the oldest problem on the network for a large class of services. Onion-Location, documented by the Tor Project, lets a clearnet website send a header announcing its own onion address, and Tor Browser responds by offering to switch, or by switching automatically if the user chooses. For the first time, an ordinary user could obtain an onion address with certificate-backed provenance without knowing anything about PGP, directories or the clone problem. The cool dark websites of this era are the ones that adopted it: news organisations, privacy-focused email and search providers, nonprofits and projects whose clearnet sites now hand their onion addresses directly to the browser. DuckDuckGo, Tor Browser's default search engine, operates an onion service reachable this way. Proton and other privacy services do the same. The Tor Project's own site does. Some social networks have at various points offered onion services, and where they do, the announcement comes from the company. The pattern these services share is the reason they are interesting. They are proof that the network's trust problem is solvable for any operator willing to be accountable, and their existence draws a clear line between services that can be verified and services that cannot. Everything on the verifiable side of the line came from a decision by an institution to publish. Everything on the other side is still living in the world of 2005 link pages.
What the milestones tell you about interesting dark web sites today
Read together, the milestones give a reader a set of expectations about interesting dark web sites that no listicle provides. 1. Legitimacy is announced. Every institutional onion service in this history was launched with a public statement by the organisation running it. A service that claims institutional backing but has no such announcement on the institution's clearnet site is making a claim the institution has not made. 2. Vanity prefixes are common and prove nothing. The practice began with a legitimate 2014 launch and has been imitated by clone operators ever since. Only the full 56-character address matters. 3. Old addresses are dead. Anything 16 characters long stopped working in 2021. A source quoting one has not been updated since. 4. Onion-Location is the gold standard. Where a clearnet site offers it, no other source of the address is needed or advisable. 5. Notoriety and utility diverged early. The services that made headlines and the services that made the network useful were different services from about 2014 onward, and they still are. A scenario: a reader encounters a directory entry claiming to be a major newspaper's onion mirror. The history tells them the newspaper announced its service publicly and publishes the address on its clearnet site. They check there, find Onion-Location offered, and compare. The directory's address differs. The milestones did not just make good reading; they told the reader exactly where the truth would be.
The interesting part is who decided to be found
The interesting dark web sites in this history share one thing: an operator who decided, in public, to be reachable through Tor and said so. Facebook in 2014, ProPublica in 2016, The New York Times in 2017, the BBC and the CIA in 2019, and every organisation that has adopted Onion-Location since, each made the network more useful by publishing an accountable address, and each made it clearer that the unverifiable majority was unverifiable by choice. The technical milestones tell the same story from the other side. The 2017 address format made addresses fully identify their keys and closed the enumeration loophole; the 2021 retirement of the old format turned every stale directory into a museum; Onion-Location in 2020 gave ordinary users a way to skip directories entirely. The network has spent two decades building tools for accountable operators to be found safely. The interesting sites are the ones that use them. One step to take today: pick one organisation named above and find, on its own clearnet site, the page where it announced or documents its onion service. Read what the organisation said about why. Then open that clearnet site in Tor Browser and watch for the Onion-Location prompt. You will have traced a milestone from announcement to address in about five minutes, and the address you end up with will be one you can actually trust.
Frequently asked questions
which major organisations run onion sites?
Publicly announced examples include Facebook since 2014, ProPublica since 2016, The New York Times since 2017, the BBC and the CIA since 2019, the Tor Project itself, and privacy services such as DuckDuckGo and Proton. Each publishes its address on its own clearnet site, and many support Onion-Location.
when did onion addresses change to the long format?
The Tor Project introduced 56-character version 3 addresses in late 2017, ran both formats in parallel for several years, then removed support for the old 16-character format from Tor Browser in 2021. Old addresses no longer resolve, and pages quoting them have not been updated since.
what is onion-location and why does it matter historically?
A feature added to Tor Browser in 2020 that lets a clearnet site announce its onion address to the browser, which offers to switch. It gave ordinary users certificate-backed provenance for onion addresses for the first time, removing the need for directories for any service that adopts it.
why did facebook create an onion site?
The company explained in 2014 that it wanted users in places that blocked Facebook to reach it through Tor, and wanted to stop its security systems flagging Tor users as suspicious. It was the first major mainstream company to run an onion service and obtained a TLS certificate for the address.
are the interesting dark web sites the same as the notorious ones?
No. The services that made headlines for illegal activity and the services that made the network useful diverged from about 2014 onward. The milestones that changed what onion services are for came from news organisations, nonprofits, companies and the Tor Project, all of which announced their services publicly.