How Onion Web Pages Work, From Address to Browser Window
What an onion web page is, and what it is not
Strip away the mystique and an onion web page is HTML, CSS and images served by a web server, exactly like any other site. What changes is the path between you and that server. Instead of a domain name resolving through DNS to a public IP address, an onion address tells your Tor client how to find a rendezvous point inside the Tor network where the service is waiting. The server never learns your IP address, and you never learn the server's. Neither side needs to trust a certificate authority or a DNS provider, because the address itself is derived from the service's public key. If you reach the address, you are talking to whoever holds that key. This is why the phrase onion dark web is slightly misleading. The technology is a way to publish a service without revealing where it is hosted. Some operators use that for crime, many use it for journalism, censorship resistance, whistleblowing or simple privacy. The page format is the same in every case; what differs is the operator's motive and the legality of the content, which the protocol knows nothing about.
Why onion web addresses look like random letters
Current onion web addresses are 56 characters of lowercase letters and digits followed by .onion. They are not random and they are not chosen by the operator in the way a domain is. The Tor Project's specification derives the address from the service's public key plus a small checksum and a version number, encoded so that every character carries meaning. Two consequences follow. First, the address is self-authenticating: if your Tor client reaches the service at that address, the service has proved possession of the matching private key. No registrar, no certificate, no third party. Second, the address is unmemorable and impossible to check by eye. Two addresses that differ in one character are entirely unrelated services, and an attacker can generate keys until the first several characters match a target, producing look-alikes that fool casual reading. So when someone hands you a list of onion urls, understand what you are holding: a list of key fingerprints. Each one is exactly as trustworthy as the channel it arrived through. That is why signed announcements matter so much more here than on the ordinary web, where a certificate authority does part of that job for you.
What happens when you open an onion dark web site
The sequence is invisible to you but worth understanding, because it explains both the slowness and the privacy properties. Tor Browser first builds a circuit through three relays, as it does for any destination. It then uses the onion address to look up the service's descriptor in a distributed directory inside the network. That descriptor lists introduction points, relays the service has chosen to accept first contact. Your client picks a rendezvous point of its own and sends a message through an introduction point asking the service to meet there. The service builds its own circuit to the rendezvous point. From then on, traffic flows through six relays in total, three chosen by each side, and neither side ever sees the other's network address. That is why onion dark web sites load more slowly than clearnet pages and why the connection sometimes fails and succeeds on retry: there are many moving parts and no single server to blame. It is also why the usual trick of checking who owns a domain does not exist. There is no owner record. There is only a key, and the question of whether it belongs to who you think it does.
Where the padlock went: encryption and identity on onion tor websites
New users often notice that onion tor websites show a different security indicator than https sites and assume the connection is unencrypted. The opposite is true. Traffic to an onion service is encrypted end to end by the Tor protocol itself, all the way to the service, and the address verifies the key. Tor Browser reflects this with an onion icon instead of the usual padlock. A few operators additionally obtain TLS certificates for their onion addresses. That adds a layer where a certificate authority has checked that the same organization controls both a clearnet domain and the onion address, which helps you connect the two identities. It does not add meaningful encryption, because the transport is already encrypted. What the onion icon cannot tell you is whether the key belongs to the operator you intended. A clone has its own perfectly valid key and its own onion icon. Identity, in other words, is proved at the level of the address, and the address must come from somewhere you trust. That leads directly to the practice described on our Useful Resources page: verify addresses against PGP-signed statements from the operator, then bookmark them in Tor Browser so you never retype them.
A field guide to the kinds of onion sites on the dark web
Headlines suggest that onion sites dark web users visit are all marketplaces. Long-term users see a different distribution. Knowing the categories helps you recognise what a page claims to be and what a legitimate example usually looks like. - Mirrors of clearnet organizations: news outlets, human rights groups, a few large technology companies. These publish their onion address on their normal site, which makes verification easy. - Communication services: email and messaging providers that accept Tor users without phone numbers. - Whistleblower platforms: submission systems run by newsrooms and NGOs for anonymous sources. - Search engines and directories: indexes of onion services, useful for discovery and heavily polluted by spam and clone entries. - Community sites: forums, blogs, archives and hobby projects hosted on Tor because the operator values privacy. - Criminal services: markets, fraud shops, leak sites run by ransomware groups. These are the minority by count and the majority by press coverage. One scenario ties the categories together. A source inside a company wants to send documents to a newspaper. The newspaper's whistleblower platform is an onion service, published on the paper's clearnet site with a signed address. The source uses Tor Browser, verifies the address, and submits. Nothing about that is illegal, and it is one of the main reasons onion services exist.
Common mistakes when handling onion urls
Most problems people report with onion urls trace back to a short list of errors, and all of them are avoidable once you know the mechanism described above. 1. Trusting a directory or a comment as the source of an address. Directories and comments are unsigned text. Verify against the operator's own signed announcement instead. 2. Reading only the first few characters. Look-alike addresses are generated precisely to match the prefix people check. Compare the whole string, or better, follow a signed link. 3. Using an old 16-character address. The Tor Project retired that format, so those addresses cannot work no matter where you found them. 4. Opening onion addresses in a regular browser through a web proxy. The proxy sees everything you do and can alter the page. It removes the protections the protocol was designed to give you. 5. Enabling JavaScript because a site demands it. Tor Browser's safest setting exists because scripting is the most common path to deanonymization; a site that insists on it is asking you to take that risk for its convenience. Each of these mistakes looks small in the moment. Together they account for most of the phishing and deanonymization stories that circulate about onion services.
What to do with this understanding
The mental model to carry away is compact: an onion address is a key fingerprint, the connection is encrypted and location-hiding by design, and the only open question on every visit is whether the key belongs to the operator you meant. Everything practical follows from that. It changes how you read the web. A blog post listing onion web pages becomes a list of claims to verify. A search result becomes a lead rather than a destination. A site that pressures you to log in before you have checked anything becomes a red flag rather than a convenience. A step you can take today: pick one organization you already trust that publishes an onion mirror, find the address on its clearnet site, open it in Tor Browser and bookmark it. You will have completed the whole cycle described here, from signed source to verified page, on a site where nothing can go wrong. That experience makes the mechanism concrete, and it is the same routine you will use for every onion web address after it.
Frequently asked questions
what is an onion web page?
It is a normal web page served through a Tor onion service. The .onion address is derived from the operator's public key rather than registered like a domain, and the connection hides both the visitor's and the server's network location.
why are onion urls so long?
Current addresses encode the service's full public key, a checksum and a version number in 56 characters. That makes the address self-authenticating but impossible to memorize or check by eye, which is why signed announcements matter.
are onion sites encrypted without https?
Yes. The Tor protocol encrypts traffic end to end all the way to the onion service, and the address verifies the key. Tor Browser shows an onion icon instead of a padlock. Some operators add TLS certificates to link the onion address to a clearnet identity.
can an onion website see my ip address?
Not through a normal visit. Traffic passes through relays chosen by both sides and neither learns the other's address. Enabling JavaScript, downloading and opening files, or logging in with identifying details can still expose you, which is why Tor Browser's safest setting exists.
is visiting an onion dark web site illegal?
In most countries, using Tor and reading onion pages is legal, while the content of specific sites may not be. Laws differ by jurisdiction and change, so treat this as a general description rather than legal advice.