“Onion services” (sometimes called onion links or hidden services) are websites hosted on the Tor network and reachable only through Tor-capable browsers. They are one of the most misunderstood features of the modern internet. This article explains what they are, why the technology exists, how it is both used legitimately and abused, and the very real risks involved. It is educational in intent and does not promote or link to any illicit destination.
What an Onion Service Is
An onion service is a site whose address ends in .onion and whose physical location is concealed by the Tor network. Unlike an ordinary website, neither the visitor nor the server easily learns the other’s real IP address. Connections are encrypted end to end and routed through introduction and rendezvous points that hide both parties. The result is a system designed for privacy and censorship resistance.
Legitimate Uses That Are Easy to Overlook
Many reputable organizations run onion services precisely because the technology protects users. Major news outlets operate secure tip-submission portals as onion sites so whistleblowers can share information safely. Privacy-focused email providers, the Tor Project itself, and even some mainstream platforms maintain onion mirrors to serve people living under censorship. In authoritarian environments, onion services can be the difference between reaching independent information and being cut off entirely.
How the Same Technology Is Abused
The privacy that protects a journalist can also shield a criminal marketplace. Some onion services host darknet markets and other illegal operations. It is important to be clear-eyed here: the existence of criminal onion sites does not make the network itself criminal, but it does mean that unverified onion links are frequently gateways to fraud, malware, and prosecutable activity.
Why “Directories” of Onion Links Are Dangerous
Lists that claim to catalog onion links are notoriously unreliable. Addresses change constantly, and a large fraction of links lead to phishing clones, scam pages, or malware. Because there is no central authority verifying these destinations, users have no way to know what they are actually connecting to. This is one reason security professionals treat unsolicited onion links with the same suspicion as unknown email attachments.
Anonymity Has Limits
People often assume that visiting an onion site is untraceable. In practice, de-anonymization happens through browser exploits, misconfigured services, correlation attacks, and simple human error. Law enforcement has seized many hidden services and identified their operators and users. The Tor network raises the cost of surveillance; it does not make anyone invisible.
The Practical Takeaway
- Onion services are a privacy technology, valuable for censorship resistance and secure whistleblowing.
- The same technology is abused to host illegal marketplaces and scams.
- Unverified onion links overwhelmingly lead to phishing, fraud, or malware.
- Anonymity is conditional and regularly broken through mistakes and investigative work.
Understanding onion services means appreciating both their genuine social value and their capacity for harm, without treating them as a shopping directory. The informed reader studies the technology and steers clear of the illegal ecosystem built on top of it.