Popular Onion Sites: What Can and Cannot Be Known About Popularity on Tor
What Tor Metrics publishes, and why it says nothing about popular onion sites individually
The Tor Project runs a public statistics portal, Tor Metrics, that publishes aggregate data about the network: estimated numbers of users by country, relay and bridge counts, bandwidth, and, since around 2015, some figures about onion services. Those onion service figures are the closest thing to an official measurement of popular onion sites, and understanding what they contain is the first step to understanding why they cannot rank anything. The onion service statistics on Tor Metrics are estimates of two things: the approximate number of unique onion addresses seen across the network, and the approximate amount of traffic flowing to onion services in total. Both are derived from relays that volunteer to report, and both are deliberately aggregated and noise-added before publication so that no individual service can be identified. The result is a picture of the whole: roughly how many services exist, roughly how much traffic they carry between them. What is absent is any breakdown by service. Tor Metrics does not know, and is designed not to know, which addresses receive the traffic. A relay participating in the statistics sees encrypted cells for an address it cannot resolve to a service and cannot associate with content. So the one organisation with the best view of the network can tell you that onion services exist in the tens of thousands and carry a certain share of traffic, and cannot tell you which ten are busiest. Anyone who claims to know is not getting it from the network.
Why the network makes ranking top onion sites impossible by design
The reason no one can measure top onion sites is not a gap in tooling but a set of design choices the Tor Project made on purpose, and they are worth understanding because they also explain the network's other peculiarities. First, there is no central registry. Onion addresses are derived from keys generated on the operator's own machine and are never registered anywhere. Nobody has a list of all services, so nobody can survey them. Second, the directory system for the current address format uses blinded identifiers, which the Tor Project introduced with version 3 addresses in 2017 specifically so that the relays storing service descriptors cannot learn the addresses they are storing. Third, traffic to a service passes through relays that see only encrypted cells and cannot tell which service, or what content, is involved. A relay can count cells; it cannot attribute them. Fourth, the services themselves see no identifying information about visitors and, if well run, keep no logs, so even the operator's own count is a count of anonymous connections rather than of people. Every one of these properties protects users and operators, and every one of them also rules out popularity measurement. The privacy is the point; the unmeasurability is a consequence. Any ranking of onion services by popularity is therefore made of something other than measurement.
What lists actually mean when they call something a top tor website
Since network measurement is off the table, a list calling something a top tor website is drawing on one of a small number of proxies, and identifying which one tells you how much the claim is worth. - Mention frequency. How often a name appears across directories, forums, articles and social posts. This measures attention, not use, and it is trivially gamed by anyone willing to post. - Search engine placement. Where a service ranks on onion search engines, which is a function of how many pages link to it and, on some engines, of paid placement. - Inclusion in other lists. Whether earlier listicles named it. This is circular: services become popular by being called popular, and the circle can run for years after a service dies. - Uptime monitors. Some sites track whether services are reachable. Being online is not being popular, but it is often presented as such. - Anecdote. What the author has heard, seen recommended, or personally used. - Commercial interest. Services that pay for placement or affiliation, presented as popular because that is a more persuasive word than sponsored. None of these is traffic, and none is users. A scenario: a reader compares three lists of popular tor sites and finds the same eight names on all of them. The overlap is more likely inheritance than confirmation: each list drew on the others, and the eight names are the ones that were copied earliest and most.
The popularity trap: why popular tor sites are the most cloned
There is a practical consequence to all this that matters more than the philosophical point, and it inverts the usual logic. On the clearnet, a popular site is a safer bet, because popularity brings scrutiny and a registered domain ties the name to an owner. On Tor, popular tor sites, meaning widely mentioned ones, are the most dangerous category to reach through any third-party source, because mention is what clone operators optimise for. The mechanism is simple. A clone operator wants victims, and victims are people looking for a well-known service. So the operator creates an address resembling the real one, often with the same vanity prefix, and works to get it mentioned: in directories, in forum replies, in search engine results, in lists of popular sites. The more a genuine service is talked about, the more effort goes into impersonating it and the more impostor addresses circulate under its name. Popularity as measured by mention is, from the reader's side, a measure of how many fakes to expect. A scenario: a reader wants a widely discussed privacy provider's onion service. Because it is widely discussed, a search returns dozens of addresses across directories and forums. Because the provider is legitimate, its own help pages document exactly one. The reader who goes to the provider is safe. The reader who trusts the most-mentioned address is trusting a contest that clone operators have every incentive to win.
The one kind of popularity that can be checked: popular dark web sites with accountable operators
There is a narrow sense in which popularity on Tor can be known, and it is the sense that turns out to be useful. Popular dark web sites run by accountable institutions are popular in the ordinary world, and their onion services inherit that standing in a way you can verify. A major news organisation's onion mirror is popular because the organisation is; its readership is measured on the clearnet and its onion service is an extension. A widely used privacy provider's onion service is used because the provider has millions of clearnet users who are told about it. This gives a reader a workable test. Ask whether the popularity being claimed for a service exists anywhere outside the dark web itself. If a service is popular because a well-known organisation runs it, the popularity is real, checkable and comes with a verified address. If a service is popular only within the network, only in directories and forums and lists that refer to one another, the popularity is a rumour with no external anchor, and the address has no accountable source. A scenario: two services are both called top onion websites. One is a household-name newsroom's mirror; the other is a forum known only within Tor circles. The first claim is checkable and comes with a safe address. The second may be true, but no one can show it.
Reading a list of popular dark web websites with the measurement problem in mind
Knowing that popularity cannot be measured does not mean lists of popular dark web websites are worthless. It means reading them for what they can tell you, which is different from what they claim. A short routine helps. 1. Ask what proxy the list is using. Mention, search placement, inheritance from other lists, uptime, anecdote or commerce. If the list does not say, assume inheritance. 2. Sort the entries by whether the popularity has an external anchor. Institutional services with clearnet presences on one side, network-only reputations on the other. 3. For the institutional side, ignore the list's addresses entirely and obtain each from the institution. The list has told you the institution runs an onion service, which is useful, and nothing else. 4. For the network-only side, treat popularity as a clone warning. If you visit at all, do so read-only at the safest security level, enter nothing, and expect that the address you have may not be the one the list's author meant. 5. Note the list's date. Popularity claims from more than a year ago describe a network that no longer exists in that form. A scenario: a reader works through a list of twenty popular sites this way. Eleven have institutional operators; the reader obtains eleven verified addresses from clearnet sites and discards the list's versions. Six are network-only reputations; the reader looks at two read-only and bookmarks none. Three are dead. The list contained eleven useful facts and no usable addresses, which is roughly what a popularity list on Tor is worth.
Popularity you cannot measure is popularity you cannot trust
Popular onion sites are a category that the network is built to keep unknowable. Tor Metrics can say how many services exist and how much traffic they carry in total, and by design cannot say which ones. No central registry, blinded directories, encrypted relay traffic and logless services all point the same way. Whatever a list means by popular, it is not measurement, and the most common meaning, frequency of mention, is the one thing clone operators are best at manufacturing. The useful residue is this. Popularity that exists outside the network, in the standing of an institution that publishes its own onion address, is real and comes with a safe way to act on it. Popularity that exists only inside the network, in lists that cite lists, is a rumour and a clone warning at once. Sorting any list into those two piles takes minutes and turns an unreliable ranking into a set of leads worth checking through the right channel. One step to take today: find one list of popular onion sites and, without opening any address on it, mark each entry as institutional or network-only. Then, for one institutional entry, obtain the address from the institution's own site and compare it with the list's. Whether or not they match, you will have learned what the list was actually measuring, and what it could never have measured.
Frequently asked questions
does the tor project publish which onion sites are most popular?
No. Tor Metrics publishes aggregate estimates of how many onion addresses exist and how much traffic onion services carry in total, collected with deliberate privacy protections. It does not and cannot break these figures down by service, because relays cannot identify the services whose traffic they carry.
why can't anyone measure traffic to individual onion sites?
Because of the network's design: there is no registry of addresses, the version 3 directory system uses blinded identifiers so relays cannot learn which services they store, relay traffic is encrypted and unattributable, and services see no identifying visitor information. These properties protect users and make per-site measurement impossible.
what do lists mean when they call an onion site popular?
Usually how often the name is mentioned across directories, forums and other lists, sometimes search engine placement, uptime, anecdote or paid placement. None of these is traffic or users, and mention frequency correlates more with notoriety and copying than with actual use.
is a popular onion site safer to visit?
Not when reached through a third-party source. Widely mentioned services attract the most clone activity, because impostors target people looking for well-known names. The more popular the name, the more important it is to obtain the address from the operator's own clearnet site or documentation.
is there any kind of onion site popularity i can verify?
Yes: popularity that exists outside the network. A news organisation's or privacy provider's onion service inherits the measurable standing of the institution, and the institution publishes the address. Popularity that exists only within dark web lists and forums has no external anchor and cannot be checked.