Onion V3 Links: What Changed, Why Old Links Broke and How to Read the New Ones
What onion v3 links are and where the 56 characters come from
Onion v3 links are addresses for onion services using the third version of the Tor onion service protocol, and their most visible feature is length: 56 characters before the .onion suffix, drawn from the lowercase letters a to z and the digits 2 to 7. The length is not arbitrary. It encodes the service's full public key. An onion service is identified by a cryptographic key pair. In v3, the address is the base32 encoding of the service's 32-byte public key, plus a 2-byte checksum and a 1-byte version number, which together produce exactly 56 characters. Because the entire public key is in the address, a client that knows the address can verify that it is talking to the holder of the matching private key, with no certificate authority and no directory involved. The address is the identity. Anyone who can produce a valid signature for the key encoded in the address is the service. Nobody else can be. The cost is that addresses cannot be short or memorable. A 32-byte key encodes to 52 base32 characters before the checksum and version are added, and shortening it would mean discarding part of the key. Services that want a recognisable address generate keys repeatedly until one happens to begin with a chosen prefix, which is why some addresses start with a readable word followed by apparent noise. A scenario: a reader sees two addresses beginning with the same word. Both are valid v3 links; the shared prefix means only that both operators searched for it.
What was wrong with v2 and why v3 onion links replaced it
The second-generation protocol served from the mid-2000s until 2021, and the reasons v3 onion links replaced it are documented at length by the Tor Project. Three stand out. First, the cryptography was ageing. V2 addresses were derived from a truncated SHA-1 hash of a 1024-bit RSA key, producing the familiar 16-character addresses. Both SHA-1 and 1024-bit RSA were regarded as insufficient against a well-resourced attacker by the time the redesign was under way. V3 uses modern elliptic-curve cryptography, Ed25519 keys and SHA-3-based hashing, which is why the address had to grow. Second, v2 leaked addresses. The way v2 services published their descriptors allowed relays in certain positions to learn onion addresses they had no business knowing, and researchers demonstrated harvesting addresses at scale this way. V3 encrypts and blinds the descriptor process so that relays cannot enumerate services, which is a meaningful privacy gain for operators who do not advertise their address. Third, v2 could not be extended. The redesign added features such as client authorisation, allowing a service to be reachable only by clients holding a key, and cleaner support for improvements since. The Tor Project announced a timeline, shipped warnings in Tor Browser, and in Tor 0.4.6 released in mid-2021 removed v2 support from the network. Tor Browser stopped connecting to v2 addresses in October 2021. From that point, the old 16-character addresses stopped resolving. A scenario: a reader's decade-old bookmark to a 16-character address returns an error. Nothing is wrong with their browser or connection. The protocol that address belonged to no longer exists on the network.
Why tor browser onion links not working is usually a version problem
When people report tor browser onion links not working, the most common cause by far is that the link is a v2 address, and several related confusions follow from not recognising this. The diagnosis is simple: count the characters. Sixteen before .onion means v2, and the link cannot work in any current Tor Browser. Fifty-six means v3, and if it fails the cause is elsewhere: the service is offline, the address was mistyped, or the address was never valid. The confusions that follow: - There is no translation. A v2 address and a v3 address for the same service are unrelated strings derived from different keys. The only way to find a service's v3 address is from the operator. - The old address does not point anywhere. A v2 address is not redirecting, broken or parked. It refers to a key format the network no longer recognises. - Lists that still carry v2 addresses are stale by definition, and their v3 entries deserve the same scepticism. Pages promising tor links 2023 or any other year frequently mix both formats. - A v3 address that fails today may work tomorrow. Onion services go offline when the operator's machine does, and intermittent availability is normal, especially for hobbyist services. A scenario: a reader has a list of twenty addresses and half fail. Counting characters, eight are v2 and gone for good. Two are v3 and merely offline. The character count told them which failures were permanent.
How to read tor v3 links well enough to catch a fake
A 56-character address cannot be memorised, but tor v3 links can be read in a way that makes several common frauds visible. The skill is knowing which parts to check and which parts cannot be trusted. The prefix is untrustworthy. Because operators generate keys until an address begins with a chosen word, and because attackers can do exactly the same thing, a matching first six or eight characters proves nothing. Clones of well-known services routinely match the recognisable prefix and differ in the remainder. The remainder is what matters. Compare the full 56 characters against the verified source: the operator's clearnet page, the Onion-Location header, a signed announcement. Do this character by character or, better, by having Tor Browser deliver the address through Onion-Location so no comparison is needed. The character set is a quick sanity check. Valid v3 addresses use only a to z and 2 to 7. Any address containing 0, 1, 8, 9 or uppercase letters is malformed or a lookalike designed to pass a glance. The checksum is checked by Tor Browser automatically. An address with a typo in it will usually fail the checksum and produce an error rather than reaching a wrong service, which is a useful property. A scenario: a reader is shown an address that starts with the same eight characters as a newspaper's verified mirror. They compare the rest against the bookmark obtained through Onion-Location. Fourteen characters differ. The prefix was bait.
What to do with a list of onion links v3 and older that no longer works
Old lists are common, and a sensible process for triaging a file of onion links v3 and older that has stopped working turns a frustrating afternoon into a useful cleanup. 1. Sort by length. Every 16-character address is v2 and permanently dead. Delete them or move them to an archive folder if the names matter to you. 2. For each v3 address, identify the operator. 3. For operators you can identify, go to their clearnet presence and obtain the current address there. Compare it with the one in your list. If they match, the list entry was correct and simply offline when you tried. If they differ, the list entry was wrong, stale or a clone, and the clearnet address replaces it. 4. For operators you cannot identify, the address stays unverified. If you want to keep it, file it as pending with a note of where it came from, and treat any visit as read-only. 5. Add a source and date to every entry you keep. What not to do: paste dead addresses into a search engine hoping for a replacement, since the results will be directories and clones offering addresses of unknown origin. A scenario: a reader triages a list of forty. Twenty-two are v2 and deleted. Eleven belong to identifiable operators and are replaced or confirmed from clearnet sources. Seven are unverifiable and go to pending. The list is smaller and trustworthy.
Where to obtain onion links v3 that are actually current
Since v2 addresses cannot be translated, everyone who wants onion links v3 for a service they used to reach has to obtain the new address from somewhere, and the choice of source matters more than usual because the migration created a wave of impostors. The operator's own clearnet site is the primary source. Institutions that run onion services publish the address on a page about Tor or privacy, and most send the Onion-Location header so Tor Browser offers the address automatically when you visit the clearnet site. The operator's own communications are the second source: a signed announcement, a post on an account with a verifiable history, a note in official documentation. For hobbyist services without a clearnet presence, this is often all there is, and it has to be judged on the history of the channel. What is not a source: directories, search results, forum threads and list sites. During the migration, many directories simply filled their v3 columns with whatever addresses they could find, and impostors took the opportunity to register lookalike v3 addresses for well-known names. A directory's v3 address for a service is a claim, not a fact. The Tor Project's own documentation lists a small number of its own services and explains the address format, which makes it the right place to learn what a genuine v3 address looks like before hunting for others. A scenario: a reader wants the current address of a privacy provider. They open the provider's clearnet site in Tor Browser, accept the Onion-Location prompt, and bookmark the result.
The length is the security
Onion v3 links are 56 characters long because the address is the service's public key, and a shorter address would be a weaker key. That design choice, made when the Tor Project retired the second-generation protocol in 2021, is why old 16-character links stopped working, why they cannot be translated or revived, and why the only path to a current address runs through the operator. It is also why the prefix of an address proves nothing, since anyone can generate a key that begins with a chosen word, and why the remainder must be compared in full against a verified source or, better, delivered by Onion-Location so no comparison is needed. A list of links that stopped working is not a problem to be solved by finding another list. It is an opportunity to rebuild the list from operators' own channels, with provenance recorded, so that it never has to be rebuilt again. One step to take today: open your oldest saved onion address and count the characters. If it is sixteen, delete it and, if the service still matters to you, find its operator's clearnet presence and obtain the current address from there. If it is fifty-six, check whether you know where it came from, and if you do not, treat it as unverified until you do.
Frequently asked questions
why are onion v3 addresses 56 characters long?
Because the address encodes the service's entire 32-byte Ed25519 public key plus a checksum and version byte in base32, which produces exactly 56 characters. The key in the address is what lets Tor Browser verify it is talking to the genuine service without any certificate authority.
why do my old onion links not work in tor browser?
Almost certainly because they are v2 addresses, 16 characters long, which the Tor network stopped supporting in 2021. They cannot be revived, redirected or converted. If a v3 address fails, the service is more likely offline or the address mistyped.
can a v2 onion address be converted to v3?
No. The two formats are derived from unrelated keys, and no tool can translate between them. Any site or tool claiming to convert v2 addresses is fraudulent. The only way to find a service's v3 address is from the operator's own clearnet site or announcements.
how can i tell if a v3 onion link is fake?
Ignore the prefix, which anyone can reproduce by generating keys until one starts with a chosen word, and compare all 56 characters against the operator's verified source. Valid addresses use only the letters a to z and digits 2 to 7. Better still, obtain the address through Onion-Location so no comparison is needed.
where can i get current v3 onion links for a service?
From the operator's own clearnet site, ideally via the Onion-Location prompt in Tor Browser, or from a signed announcement on the operator's official channel. Directories and search results are not reliable sources, since many filled their v3 entries with unverified or impostor addresses during the migration.