Darknet Terms and Tor Vocabulary Explained

A .onion address is a special-use top-level domain suffix designating an anonymous hidden service accessible via the Tor network. These addresses are not registered with any DNS authority; instead, they are generated cryptographically by the Tor software itself. When you connect to a .onion site, your traffic is routed through multiple Tor relays before reaching the destination, encrypting your IP address and location. The address itself is derived from the public key of the hidden service, making it impossible to spoof or forge without controlling the underlying cryptographic material. Onion addresses appear as a long string of alphanumeric characters followed by .onion—for example, a v3 address contains 56 characters. This design ensures that the address and the service are cryptographically bound, preventing attackers from impersonating a legitimate onion site.

A v3 onion address is the current standard for Tor hidden services, introduced to replace the older v2 format. V3 addresses use stronger cryptography, specifically Ed25519 elliptic-curve keys, compared to v2's RSA-1024 keys. This makes v3 addresses significantly more resistant to brute-force attacks and future cryptographic vulnerabilities. V3 addresses are 56 characters long, whereas v2 addresses were 16 characters. The Tor Project deprecated v2 support in 2021 because the shorter address space and weaker cryptography made v2 services vulnerable to harvesting attacks, where adversaries could generate many fake v2 addresses to create phishing clones. Any legitimate onion service you encounter today should use a v3 address. If you see a v2 address, it is either outdated or potentially a scam designed to exploit users unfamiliar with the newer standard.

A Tor relay is a server operated by volunteers that forwards encrypted traffic through the Tor network. The Tor network uses a three-hop circuit by default: your connection passes through an entry relay (guard node), a middle relay, and an exit relay. Each relay only knows the IP address of the relay before and after it, not the full path or the original source. An exit node is the final relay in the circuit; it decrypts the outermost layer of encryption and forwards your traffic to the destination website or service. Exit nodes can see the unencrypted traffic leaving the Tor network, which is why they are operated by trusted organizations and monitored by the Tor Project. When connecting to a .onion address, traffic never leaves the Tor network, so no exit node is involved. Understanding this distinction is critical: .onion services provide end-to-end encryption within Tor, while clearnet traffic exiting Tor is only encrypted up to the exit node.

A Tor bridge is a relay that is not listed in the public Tor directory, making it harder for network observers to detect that you are using Tor. Bridges are useful in countries or networks where Tor usage is blocked or monitored. Your Internet Service Provider or network administrator can see that you are connecting to a Tor relay if you use standard Tor, but they cannot see that you are connecting to a bridge if you configure it correctly. To use a bridge, you must manually add its address to your Tor Browser configuration. Bridges are distributed through the Tor Project's bridge distribution service to prevent adversaries from harvesting all available bridges. However, bridges do not provide anonymity benefits beyond hiding the fact that you use Tor; they do not strengthen your anonymity once you are connected to the network. Bridges are most relevant for users in censored regions; users in countries where Tor is legal and unblocked do not gain additional privacy from using a bridge.

OpSec, short for operational security, refers to the practices and habits you maintain to protect your identity and security while using Tor. Poor OpSec can compromise your anonymity even if Tor itself is functioning correctly. Common OpSec mistakes include maximizing your browser window (which reveals your screen resolution to websites), using the same username across multiple onion sites, enabling plugins or extensions that bypass Tor, or visiting clearnet sites while using Tor. Each of these actions can leak identifying information. Effective OpSec requires treating your Tor Browser as a separate, isolated environment: do not install additional software, do not customize it beyond the Tor Browser's built-in security settings, and do not use it for activities that would identify you offline. The principle is simple: Tor protects your network traffic, but you must protect your behavior. Visiting a website that knows your real name while using Tor defeats the purpose of the anonymity network.

A phishing clone is a fraudulent copy of a legitimate onion site created by an attacker to steal credentials, funds, or personal information. Because onion addresses are long and difficult to remember, users often rely on bookmarks or search results, making them vulnerable to clones. An attacker registers a new .onion address and replicates the appearance of a legitimate site, then promotes the clone through search results, forums, or social engineering. To identify a phishing clone, always verify the onion address character-by-character against an official source. Legitimate sites publish their v3 addresses on multiple channels—official documentation, PGP-signed announcements, or verified mirrors. If the address differs by even one character, it is a clone. Additionally, check for HTTPS certificates on onion sites; legitimate sites often display security indicators. Never assume a site is legitimate based on appearance alone. The Darkweb site maintains a directory of verified marketplace addresses to help users distinguish genuine services from clones.

A PGP (Pretty Good Privacy) signature is a cryptographic proof that a message or file was created by the holder of a specific private key and has not been tampered with. Onion sites use PGP signatures to authenticate announcements, address changes, and security notices. When a site publishes a signed message, you can verify the signature using the site's public key to confirm the message is genuine. This prevents attackers from impersonating the site through fake announcements. To verify a PGP signature, you download the message, the signature file, and the site's public key, then use PGP software to check that the signature is valid. If the signature is invalid or missing, the message may be fraudulent. Many onion sites publish their public keys on multiple mirrors and in official documentation. Users who regularly interact with onion services should learn to verify PGP signatures as a defense against phishing and social engineering attacks. The process is straightforward but requires attention to detail.