How a List of Onion Sites Gets Made, Poisoned and Outdated
How a list of onion links gets compiled
Directories on the Tor network come from three sources, and the source determines how trustworthy the result is. Some are built by hand: an individual or small group visits sites, writes descriptions and adds addresses they have used. Some are crawled: a script follows links from known onion pages, records what it finds and publishes the result with minimal review. Some are copied: a site owner scrapes another directory, reorders the entries and republishes them under a new name. Hand-built lists start accurate and decay slowly. Crawled lists are large, mostly dead on arrival and full of spam pages created to be crawled. Copied lists inherit every error of their source and add their own, including entries the copier swapped for addresses that pay them. A scenario makes the distinction concrete. Two directories both list a well-known privacy email service. One shows the address alongside the date it was verified and the operator's key fingerprint; the other shows the address alone. If the service changed its address last month, the first list will probably update and the second probably will not. When you read any list of onion links, look for signs of which type it is before you look at the entries.
Why every onion site directory rots
Onion addresses are tied to keys, not names, so there is no way for a directory to follow a service when it moves. If an operator rotates keys after an attack, publishes a new mirror, or simply shuts down, the directory entry becomes wrong and stays wrong until a human notices. The rate of decay is high because the corpus is unstable. Academic measurements of onion services have repeatedly found that a large share of addresses observed at any given time are unreachable weeks later. Services run by individuals go offline when the individual loses interest. Services under attack change addresses to shake off the attackers. Services seized by police disappear overnight. Against that churn, a directory updated a few times a year cannot stay accurate. The retirement of the older 16-character address format made this worse in one step. Every onion site directory compiled before that change now contains a block of entries that can never work again, and many of those directories were never updated because their maintainers had moved on. When you find a tor link list and half of it fails, you are not doing anything wrong. You are seeing the natural state of the medium.
How an onion link index gets poisoned
Decay is passive. Poisoning is deliberate, and it is the reason a stale directory is worse than useless. Clone operators need traffic, and a directory that ranks in search for onion link index or similar phrases delivers it. There are two ways in. The first is editing. Many directories accept submissions or allow public edits. An attacker submits a look-alike address for a popular service, or edits an existing entry to point at a clone. Because addresses cannot be checked by eye, reviewers rarely catch it. The second is ownership. Someone acquires or builds a directory, populates it with mostly genuine entries to look credible, and swaps in clone addresses for the handful of services where a stolen login is worth money. The pattern was visible around several well-known forums that suffered phishing waves: within days of a genuine address change, directories were full of near-matching addresses, and users who trusted the directory logged into clones. The defence is not to find a cleaner directory. It is to treat every directory entry as a lead and to confirm the address against the operator's own signed statement before entering anything, using the process described on our Useful Resources page.
What an onion links database can legitimately offer
None of this means directories are worthless. Used for the right job they are helpful, and knowing the right job keeps you out of trouble. An onion links database answers the question what exists. It cannot answer the question is this address genuine. - Discovery: learning that a newspaper, a project or a service has an onion presence at all. - Categorisation: seeing what kinds of sites cluster together, which helps you recognise a new site's type quickly. - History: older lists document services that no longer exist, which is useful for research into how the network changed. - Cross-checking: an address that appears identically in several independently maintained lists, over time, is more credible than one that appears in a single place. The last point deserves care. Independence is the whole value. Ten lists that copied each other agree for trivial reasons. Two lists maintained by unrelated people who each verified an address at different times are meaningful evidence. When you use a directory this way, you are not trusting it. You are using it to generate candidates that you then check by other means.
Building your own list of some onion sites that you can trust
The practical replacement for hunting through directories is a small list of some onion sites you have verified yourself, kept somewhere you control. It grows slowly, it is only as large as your real needs, and every entry has a provenance you can explain. 1. Start from operators, not lists. For each service you want, find its clearnet site or its PGP-signed announcement and take the address from there. 2. Record the evidence. For each entry note the address, the date, where you got it and the key fingerprint that signed it. 3. Verify once with PGP. Follow the walkthrough on our Useful Resources page to check the signature. This is the step that distinguishes your list from every directory. 4. Bookmark in Tor Browser. Retyping or re-searching an address you already verified is how people land on clones. 5. Re-check on triggers. A signed announcement of a change, a reported phishing wave, or a site that suddenly looks different all mean returning to the source. A list built this way rarely exceeds a dozen entries, and that is a feature. Most people need a few news mirrors, one or two communication services and a search engine or two. Everything else in a public directory is either irrelevant to you or not worth the risk.
Reading a tor link list critically
When you do consult a public tor link list, a few minutes of critical reading tells you how much weight it can bear. Start with the metadata. Is there a date on each entry or on the page? Is there a stated method for verification? Is there a way to report a bad entry, and evidence that reports are acted on? Then look at the entries themselves. Are the addresses 56 characters, or is the list padded with retired 16-character ones? Are descriptions specific, or generic phrases that could have been written without visiting the site? Are there many entries for the same well-known service with slightly different addresses, which is the signature of clones creeping in? Finally, consider the operator's incentive. A directory that carries advertising for markets or shows sponsored entries is being paid by people who benefit from traffic, and its editorial choices follow the money. A directory maintained by a privacy project or a long-running community, with no visible revenue from listings, has fewer reasons to mislead you. None of this proves an entry correct; it only tells you how many of the entries deserve the verification step.
The list worth keeping
The directory you were looking for does not exist, because the medium does not allow it. Addresses change, maintainers leave, and anyone with a motive can edit or clone a list. What does exist is a method: use public directories to discover candidates, use operators' signed statements to confirm them, and keep the confirmed few in a place you control. That method is slower on the first day and faster forever after. It also changes your relationship to every list of onion sites you encounter. Instead of asking whether the list is good, you ask which entries are worth confirming, and the answer is usually a handful. A step you can take today: open whichever onion directory you last used, pick the one entry you actually care about, and try to find that operator's address from a signed source or a clearnet page they control. If you succeed, you have the first entry of your own list, with provenance. If you cannot find any independent confirmation, you have learned that the entry was never verified by anyone, which is worth knowing before you log in.
Frequently asked questions
where can i find an up to date list of onion sites?
No public directory stays accurate for long, because addresses change and lists are edited or copied without verification. Use directories only to discover that a service exists, then get its address from the operator's clearnet site or PGP-signed announcement.
why are most onion links in directories dead?
Onion services churn constantly: operators move, rotate keys after attacks, or shut down, and the retired 16-character address format left every old list partly broken. A directory updated a few times a year cannot keep up.
can an onion link directory contain phishing links?
Yes, and it is a common attack. Editors or submitters swap in look-alike addresses for popular services, and some directories are built specifically to spread clones. Treat every entry as unverified until you have checked a signed source.
how do i keep my own list of verified onion sites?
Take each address from the operator's signed statement or clearnet page, verify the signature once, record the date and key fingerprint, and bookmark the address in Tor Browser. Re-check whenever the operator announces a change or a phishing wave is reported.
is it legal to look at a list of onion sites?
Reading a directory is legal in most countries, as is using Tor. What matters legally is the content of the sites you visit and what you do there, which varies by jurisdiction; this is a general description, not legal advice.