Anatomy of Tor Network Links and How to Tell a Real One From a Clone
The parts of a Tor network link
A current onion link has three visible parts: an optional scheme, a 56-character address, and the .onion suffix. The scheme is usually http, because the Tor transport already encrypts the connection and the address already proves the key; some operators add https with a certificate to tie the onion address to a clearnet identity. The 56 characters are the interesting part. According to the Tor Project's specification, they encode the service's 32-byte public key, a 2-byte checksum and a 1-byte version marker, using a base32 alphabet of lowercase letters and the digits 2 through 7. The last character is always d, a side effect of the version byte, which is a handy sanity check: a 56-character address that does not end in d has been mangled somewhere. Older 16-character addresses used a truncated hash of a weaker key. The Tor Project retired that format, so any link onion tor page still showing a 16-character address is pointing at nothing. Understanding this structure lets you reject a large fraction of bad links before you touch a browser: wrong length, wrong alphabet, wrong final character, or an ordinary domain pretending to be an onion address.
How links tor onion clients resolve differ from ordinary URLs
On the regular web a link resolves through DNS: your computer asks a resolver, gets an IP address, and connects. Anyone in the path can see the query, and the answer can be poisoned or censored. Onion links never touch DNS. When Tor Browser sees a .onion address it hands the request to the local Tor client, which treats the address as a key fingerprint and looks up the service's descriptor inside the network's own distributed directory. From there the client and the service each build circuits to a meeting point and the page loads through six relays. Because no resolver is consulted, there is no record of the lookup outside your own machine, and there is no authority that can redirect the address to a different server. A link either reaches the service holding the key, or it fails. The flip side is that there is also no authority you can ask whether an address is legitimate. On the regular web you can look at a certificate and see which organization a browser vendor's trusted authority vouched for. With links tor onion services publish, that assurance has to come from outside the protocol: from the operator's signed statement, or from a clearnet page they demonstrably control. The network guarantees you reached the key; it says nothing about who holds it.
Why tor site links are so easy to fake
A clone needs three things: the real site's look, an onion address of its own, and a way to get that address in front of victims. The first two are trivial. Anyone can copy HTML, and anyone can generate onion keys at will. The third is where link lists, search engines and forum comments come in. Attackers exploit how people read addresses. Almost nobody compares 56 characters; most compare the first six or eight and stop. Generating keys until the first several characters match a target is feasible on ordinary hardware, so look-alike addresses that share a recognizable prefix with a well-known service are common. To a reader scanning tor site links, the clone passes. A scenario that has repeated many times: a forum announces a new address after an attack. Within days, look-alike addresses appear in directories and comment threads, some ranking above the genuine one in onion search engines because their operators cared about ranking and the forum did not. Users log in to the clone, which proxies their credentials to the real site, and the account is quietly taken over. Nothing in the address, the page or the connection would have revealed this. Only a signature check would.
What a tor links search engine can and cannot tell you
Search engines that index onion services are useful for one job, discovery, and unreliable for another, authentication. People conflate the two, and a tor links search engine is happy to let them. Discovery works reasonably well. If you want to know whether a newspaper or a project runs an onion service, a search will usually surface a result. Authentication does not work at all. The engine ranks by crawl signals, and clone operators optimize for exactly those signals while genuine operators rarely bother. The top result for a popular name is often a phishing copy for that reason. - Use search to learn that a service exists and roughly what it claims to be. - Copy the address from the result only to compare it against a signed source, never to log in directly. - Expect many dead results; onion services appear and vanish constantly and indexes lag. - Treat sponsored or pinned results with extra suspicion, since paying for placement is a clone operator's cheapest marketing. A useful habit is to run the search, then close the results page and go to the operator's clearnet site or signed announcement for the actual address. The search told you where to look. It should never be what you clicked.
A checklist before trusting any tor web link
This is the routine that turns the theory above into a habit. Run it on every tor web link that you intend to log into or send anything through. For links you only plan to read, steps one and two are enough. 1. Format check. Exactly 56 characters before .onion, lowercase letters and digits 2 through 7 only, last character d. Fail any of these and stop. 2. Source check. Where did the link come from? An operator's signed message or clearnet page is strong. A directory, search result or comment is weak and needs step three. 3. Signature check. Find the operator's PGP key from a source you trust, verify the signed address statement, and compare the full string character by character. Our Useful Resources page shows how to do this. 4. Arrival check. On the page, look for the operator's own signed confirmation of the address you used. Many careful operators publish one on their front page. 5. Behavior check. Does the site demand JavaScript, rush you to log in, or show a slightly different layout than documented? Any of these is a reason to leave and re-verify. The list looks long. In practice steps one and two take seconds, and step three is a two-minute task once your tools are set up. It is far less time than recovering from a stolen account.
Managing tor website links you have already verified
Verification is wasted if you repeat the search next time and land on a clone. The second half of good hygiene is keeping the tor website links you have checked in a place you control. Tor Browser supports bookmarks, and using them removes the most common failure: retyping or re-searching an address you already confirmed. Keep the bookmark name descriptive and check that the full address matches the signed statement before saving. Some users prefer an encrypted local notes file with the address, the date verified and the fingerprint of the key used; this makes it easy to notice when an operator announces a change. Re-verify on a schedule and after any event. If a service publishes a new address, if you hear of a phishing wave, or if a bookmarked site suddenly looks different, go back to the signed source rather than trusting the bookmark. Bookmarks protect you from typos and search-result clones, not from a compromised operator or a legitimately changed address. A scenario where this pays off: a service you use announces, in a signed message, that it has moved. Because your notes record the key fingerprint you trusted last time, you can confirm the new announcement is signed by the same key in under a minute. Without that record you would be back to guessing.
Carrying the idea forward
The single most useful idea about tor websites link hygiene is that the address proves the key and nothing else. Once that is fixed in your head, every downstream decision becomes mechanical: the network will get you to whoever holds the key, and your job is to make sure the key is the right one before you type anything. This reframes what a link is. Not an invitation, but a claim, and one that can be checked cheaply with tools you can install in an afternoon. It also reframes what lists, comments and search results are: useful leads, never proof. One concrete step for today. Take any onion link you currently use or have saved, run the five-step checklist above against it, and record the result. If it passes, bookmark it properly. If it fails at step three because you cannot find a signed source, you have learned something valuable about that service, and about how many of the links you were trusting had never actually been verified by anyone.
Frequently asked questions
how long is a valid tor onion link?
Current onion addresses are exactly 56 characters before the .onion suffix, using lowercase letters and the digits 2 through 7, and always end in the letter d. Older 16-character addresses were retired by the Tor Project and no longer work.
why does the same onion link work for one person and not another?
Usually timing. Onion services go offline, rotate addresses or suffer denial-of-service attacks, and the distributed directory can lag. If an address from a signed source fails, retry later before assuming it has changed.
can a tor link be fake if it loads correctly?
Yes. A clone has its own valid onion address and copies the real site's appearance. Loading correctly proves you reached whoever holds that key, not that the key belongs to the operator you intended. Only a signature check settles that.
is it safe to click tor links from a search engine?
Reading is low risk; logging in is not. Onion search results for popular names are frequently phishing copies. Use search to discover a service, then obtain the actual address from the operator's signed statement or clearnet page.
do i need https for onion sites?
No. The Tor protocol encrypts traffic to the onion service end to end and the address verifies the key. Some operators add TLS certificates to bind the onion address to a clearnet identity, which helps with verification but not with encryption.