What is an onion service, and how does it work?

What is an onion service?

An onion service is a service, such as a website, that can only be reached over the Tor network. The Tor Project's support pages say it hides the location and IP address of the service, which makes it harder to censor or trace to its operator. Onion services were formerly called hidden services.

The address is the service's identity. The Tor Project describes the onion address as the service's identity public key, which is why it looks random. Version 3 addresses are 56 letters and numbers followed by .onion; the older 16-character version 2 addresses no longer work on the Tor network.

How does a connection to an onion service work?

A client and an onion service never connect directly: they meet at a relay both reach through Tor. The Tor Project describes five steps.

1. Introduction points. The service picks several relays, builds long-term three-hop circuits to them and asks them to act as introduction points.
2. Descriptor. The service writes a descriptor that lists its introduction points and keys, signs it with the private key behind its address and uploads it to a distributed hash table inside the Tor network.
3. Lookup. The client fetches the descriptor by address and checks the signature against the public key that is the address.
4. Rendezvous. The client builds a circuit to a relay of its choice, the rendezvous point, and gives it a one-time secret. It sends its details to the service through an introduction point.
5. Meeting. The service connects to the rendezvous point over its own circuit and presents the secret. The rendezvous point relays end-to-end encrypted traffic between the two.

The full connection consists of six relays: three chosen by the client, ending at the rendezvous point, and three chosen by the service. The Tor Project states that the service's IP address is protected and that IP addresses are not even used in the protocol.

Why is an onion address enough without HTTPS?

An onion address is enough because the address is itself a cryptographic check. The Tor Project's support page says all traffic between Tor users and onion services is end-to-end encrypted, and that the address uses cryptography to confirm that you reached the intended service and that nothing was altered on the way. Some onion sites still use HTTPS, which Tor Browser shows in the address bar.

Because the service only makes outgoing connections, it also needs no open port on its host: it punches through NAT. A server behind a firewall that blocks inbound connections can still publish an onion service.

How many VPS hosts publish an onion address?

Few hosts do. According to Gloamport's survey of 10 November 2026, 10 of the 42 active hosts publish an official .onion address for their own site: Njalla, FlokiNET, Privex, PrivateAlps, Servury, Servers.Guru, MyNymBox, NiceVPS, Kyun and DarkVPS. The survey counts only addresses the host publishes itself.

A host's onion address protects the connection to the host's website and billing pages. It is a separate question from whether you can run an onion service of your own on one of its servers, which is what the next section covers. For the other criteria that make a host fit a privacy need, read What makes a VPS privacy-focused?.

How do you run an onion service on a VPS?

You install Tor on the server and add two lines to its configuration. The Tor Project's setup page gives them for a web server on port 80:

HiddenServiceDir /var/lib/tor/my-website/
HiddenServicePort 80 127.0.0.1:80

What does an onion service not protect?

An onion service does not protect the contents of a badly configured server. The Tor Project's setup page tells operators to configure the web server so that it does not reveal the server's IP address or other identifying details.

It also does not change how you pay for the server. Monero keeps a payment off the public record, but not out of your account: Gloamport still links your orders, the IP addresses of your VPS and the transaction ID you declare to your account number. For the payment side, read What is KYC in VPS hosting, and why do hosts ask for ID?.