Onion Sites List: How to Find and Verify Real .onion Addresses

An onion site runs on Tor hidden services, a protocol that routes traffic through multiple encrypted relays before reaching the server. The server's location and IP address remain hidden, which is why journalists, activists, and privacy-conscious organizations use onion sites to publish information without fear of censorship or surveillance. The .onion domain is cryptographically derived from the site's public key, making it theoretically impossible to forge. However, this does not mean every onion site is legitimate or legal. Some host forums, marketplaces, and services that operate outside the law. Others are honeypots, scams, or law-enforcement operations designed to identify users. The key distinction is that the technology itself is neutral; what matters is the operator's intent and the site's actual content.

Unlike the surface web, there is no centralized registry of onion sites. The Tor Project does not maintain a directory, and search engines like Google do not index .onion addresses. This fragmentation exists by design: it prevents mass surveillance and censorship, but it also makes discovery difficult and risky. Historically, sites like the Hidden Wiki attempted to catalog onion services, but these directories became targets for vandalism, phishing, and misinformation. A link that worked last month may now point to a clone or a dead server. Reddit communities sometimes share onion sites lists, but these are crowdsourced, unverified, and often include outdated or fraudulent addresses. The absence of a trusted list is a feature, not a bug. It forces users to rely on direct recommendations from trusted sources, PGP-signed announcements, or official project websites rather than clicking blindly on a directory.

The safest way to find a real onion site is to start from a trusted source outside the dark web. If you want to access a news organization's onion mirror, visit their main website first and look for a link to their .onion address. Major outlets like BBC, ProPublica, and others publish their onion URLs on their homepage or security pages. For privacy tools and services, check the official project website or GitHub repository. If you are looking for a forum or marketplace, ask in a trusted community or check the project's official social media accounts. Never rely on a single source. Cross-reference the address across multiple official channels. If an address appears only on Reddit or a random blog, treat it with extreme skepticism. Bookmark the address directly in your Tor Browser after you verify it, so you do not have to search for it again and risk landing on a clone.

Phishing clones are fake copies of popular onion sites designed to steal login credentials, cryptocurrency, or personal data. They often have nearly identical layouts and domain names that differ by only one character. For example, a real address might be something like thehiddenwiki7xyz.onion, and a clone might be thehiddenwiki7xyy.onion. Users who do not carefully check the address bar fall victim immediately. The Tor Browser's address bar displays the full .onion address, but many users ignore it or assume they are on the right site because the page looks correct. To avoid clones, verify the address before you log in or enter any data. Check the site's PGP signature if it provides one. Many legitimate onion sites publish a PGP public key on their official surface-web homepage; you can use this to verify that the content you are reading was signed by the real operator. If the site does not offer a signature, be especially cautious with sensitive actions like logging in or sending money.

According to Tor Project documentation, the majority of onion traffic is legitimate: it includes privacy-focused email providers, messaging services, news archives, and whistleblowing platforms. However, law-enforcement agencies and security researchers also run onion sites to monitor criminal activity and identify users. Court records from major darknet marketplace seizures show that even popular sites with thousands of users can be shut down and their operators arrested. This means that visiting an onion site does not make you anonymous to the site operator, and the site itself may be under surveillance. A second reality is that onion sites are frequently abandoned or go offline without warning. A directory you find today may be 50 percent dead links within a month. Third, the lack of a central authority means that scams and exit scams are common. A marketplace or forum can operate legitimately for months or years, then suddenly disappear with users' funds or data. Finally, many onion sites are mirrors of surface-web content or provide services that are freely available elsewhere; the .onion version exists mainly for users in censored regions or those who prioritize anonymity.

Before you use an onion site, work through this checklist to reduce the risk of phishing or scams:

1. Find the address from an official source (the organization's main website, GitHub, or a PGP-signed announcement).
2. Check the full .onion address in the Tor Browser address bar and compare it character by character to the official source.
3. Look for a PGP signature or security certificate on the site and verify it using the operator's public key.
4. Check whether the site has a surface-web presence or official social media accounts where you can ask other users about recent activity.
5. If the site asks for a login or payment, verify the address one more time before entering credentials.
6. Test with a small action first (like viewing public content) before committing sensitive data or money.
7. If something feels off (slow loading, unusual layout, spelling errors), leave and try again later or from a different source.

This checklist does not guarantee safety, but it significantly reduces the chance of landing on a clone or a honeypot.

If you want to explore onion services without relying on a single list, start with these vetted sources. The Tor Project's official website lists recommended onion services and mirrors. Major news organizations publish their .onion addresses on their security or about pages. Privacy-focused projects like Signal, ProtonMail, and Tails provide onion mirrors on their official sites. Academic institutions and libraries sometimes run onion mirrors of their archives. Whistleblowing platforms like SecureDrop operate onion sites; you can find links on their main websites. Online communities focused on privacy and security (like the EFF or privacy subreddits) sometimes discuss onion services, but always verify any address they mention against official sources. The key principle is to start from the surface web and work backward to the onion address, rather than starting from a dark-web directory and hoping it is legitimate. This approach takes longer but is far more reliable.

If an onion address no longer works, do not assume it is gone forever. The site may be temporarily offline for maintenance, or the operator may have moved to a new address. Check the organization's official website or social media for an announcement. If you suspect you have landed on a phishing clone, do not enter any data. Close the tab and verify the correct address from an official source. If you have already entered credentials, change your password immediately on a different device and network. Report the phishing clone to the site operator if they provide a contact method. Many legitimate onion sites have abuse or security email addresses where you can report clones and scams. If you are using the Tor Browser, you can also report the malicious site to the Tor Project. Finally, if you have lost money or data to a scam onion site, document what happened and report it to law enforcement if you are comfortable doing so. While recovery is unlikely, reports help agencies identify patterns and shut down repeat offenders.