Quick answer
How do I host an onion site on a VPS?
To host an onion site on a VPS, install tor and a web server, add HiddenServiceDir and HiddenServicePort lines to /etc/tor/torrc, restart tor, and read your address in the hostname file. A Gloamport Dusk plan, 1 vCPU, 2 GB RAM, 40 GB NVMe, 2 TB traffic, runs it for $5.25 a month on 12 months.
What are the parts of an onion site on a VPS?
| Part | Value in this guide |
|---|---|
| Plan | Dusk: 1 vCPU, 2 GB RAM, 40 GB NVMe, 2 TB traffic |
| Price | $5.25 a month on 12 months, $10.50 on 1 month |
| Packages | tor and nginx (Apache works the same way) |
| Key directory | /var/lib/tor/my-website/ |
| Torrc keys | HiddenServiceDir, HiddenServicePort |
| Address file | /var/lib/tor/my-website/hostname |
| Backend | nginx on 127.0.0.1, port 80 |
Prices checked on
Config keys from the Tor Project onion service setup guide and the Tor manual.
What is an onion service, and why host one?
An onion service is a website that is reachable only through Tor and whose address is derived from its own key. Visitors reach it without a domain registrar or a public IP, and the traffic is encrypted end to end. For the full definition see What is an onion service, and how does it work?.
According to Gloamport's survey of 10 November 2026, 10 of the 49 hosting entries we read offer an onion address of their own. A VPS lets you run one for your own project instead.
Which Gloamport plan hosts an onion site?
Dusk is a fit: Gloamport lists it for "A VPN plus a Tor relay or an onion site". A small static site or a light app runs well on 1 vCPU and 2 GB of RAM, with 40 GB NVMe of storage. Linux only: Debian, Ubuntu, AlmaLinux and Rocky Linux images. No Windows.
The order takes a plan, a coin and an optional email: An order asks for three things: a plan, a coin and, only if you want one, an email address. There is no name field, no postal address, no phone number, no card and no identity document anywhere in the process. The wider case for hosting without handing over identity documents is in Where can I buy a VPS with no KYC?.
How do I host an onion site on a VPS, step by step?
Six steps from a blank server to an address you can open in Tor Browser.
Install tor and a web server
Run
apt update, thenapt install tor nginx. Confirm that http://localhost/ serves a page from the VPS.Bind the web server to localhost
Make nginx listen on 127.0.0.1 only, so the site is reached through Tor and not through the public IP.
Add the onion service to the torrc
Add a
HiddenServiceDirand aHiddenServicePortline to/etc/tor/torrc.Restart tor
Run
systemctl restart tor. Tor creates the directory on startup if it does not exist.Read your address
Print the
hostnamefile in the HiddenServiceDir. Addhttp://in front and open it in Tor Browser.Back up the key
The other files in that directory are your keys. Keep them private, and copy the private key somewhere safe if the address matters.
How do I configure tor to publish the site?
Two torrc lines publish the site. HiddenServiceDir names the directory where Tor stores the keys and the hostname file, and HiddenServicePort maps a virtual port to a local target. The Tor manual says each hidden service must have its own directory and that, by default, a port maps to the same port on 127.0.0.1 over TCP.
apt update
apt install tor nginx
curl -I http://localhost/HiddenServiceDir /var/lib/tor/my-website/
HiddenServicePort 80 127.0.0.1:80systemctl restart tor
cat /var/lib/tor/my-website/hostnameShould I use a Unix socket instead of a TCP port?
A Unix socket is safer, because the backend then never listens on a network port at all. The Tor Project guide recommends it to avoid exposing the service on your local network. The manual lists unix: followed by a path as an accepted target.
HiddenServiceDir /var/lib/tor/my-website/
HiddenServicePort 80 unix:/var/run/tor/my-website.sockHow do I know the onion site works?
Open the address from the hostname file in Tor Browser. If tor fails to start, the Tor Project names typos in the torrc and wrong directory permissions as the usual causes; read the log with journalctl -u tor.
Then secure the machine behind it. How do I harden SSH on a new VPS? comes first, and How do I run a Tor relay on a VPS? is a good second project on the same Dusk, priced on the pricing page. A v3 address stays the same as long as you keep the key files, even if you reinstall the web server.
In summary
- Install
torandnginx, then confirm the local page loads. HiddenServiceDirstores the keys and thehostnamefile.HiddenServicePort 80 127.0.0.1:80forwards onion port 80 to the local server.- A Unix socket target avoids exposing the backend on the local network.
- The key files let anyone impersonate the site: keep them private and backed up.
- Dusk (1 vCPU, 2 GB RAM, 40 GB NVMe, 2 TB traffic) costs $5.25 a month on 12 months.
Hosting an onion site on a VPS: common questions
Do I need a domain name for an onion site?
No. The address comes from the key Tor creates in the HiddenServiceDir and is written to the hostname file.
Which onion version does Tor use?
The Tor manual says versions 2 and 3 are supported and that the default is 3. Version 3 is the one the Tor Project guide describes.
Can I run more than one onion site?
Yes. Add another HiddenServiceDir line for each new service; its HiddenServicePort lines apply to the most recent HiddenServiceDir above them.
What if I lose the key files?
The address is gone with them. The Tor Project suggests keeping a copy of the private key file in a safe place for any long-lived service.
Is Dusk big enough?
Gloamport describes Dusk as fitting "A VPN plus a Tor relay or an onion site". For a static site, 2 GB of RAM is ample.
Sources (2)
- Set up your own Onion Service community.torproject.org/onion-services/setup — The Tor Project (checked 2026-11-10)
- Tor manual (HiddenServiceDir, HiddenServicePort, HiddenServiceVersion) 2019.www.torproject.org/docs/tor-manual.html.en — The Tor Project (checked 2026-11-10)