The alphabet has no 0, 1, 8 or 9

People phrase this as a warning. If you see a zero in an onion address, it is fake. The warning is right, and the reason behind it is worth having properly.

Why those four digits are missing

Base32 needs exactly 32 symbols. Twenty six letters leaves six slots, and the encoding fills them with 2 to 7. The four digits left out are the ones that look like letters. Zero and the letter o, one and the letter l, eight and B, nine and g. Dropping them removes the readings that get confused when a human copies by eye.

So the exclusion is not arbitrary and it is not a security feature. It is a legibility decision baked into an encoding that predates Tor by decades.

The check this gives you

Scan for the four digits. If any of them appear, the string is not a valid onion address and no amount of context makes it one. This is faster than counting to 56 and it catches a different failure, which is text that has been retyped by hand somewhere along the chain.

It also catches confident corrections. Somebody sees what they think is a mistake in an awazon onion link, changes an o to a zero to be helpful, and produces a string that cannot exist. That happens more often than deliberate tampering.

Where people go wrong

The first mistake is treating this as a validity certificate. A string made only of legal characters is not thereby a real address. Every fake address anybody has ever built also used legal characters, because an illegal one would fail before it reached you.

The second is thinking the reverse holds for letters. Every letter a to z is legal, including the ones that look like digits in a bad font. If your font renders l and 1 identically, the letter is the one that belongs there and the digit never does. That is worth remembering when reading an address off a screenshot, which you should not be doing anyway.

A note on case

Base32 as used here is written in lower case by convention. Upper case is accepted by the client and folded down. That is a separate statement and it does not widen the alphabet, because A and a are the same symbol.

Why base32 at all

Because the result has to survive being spoken, written on paper, and typed into a browser bar without a keyboard shortcut. Base64 would be shorter and would introduce case sensitivity and punctuation, both of which turn a readable string into a fragile one. Hex would be unambiguous and half again as long.

What would move this

A change of encoding. If onion addresses ever moved to base64 or to hex, the alphabet would change and this page would be wrong. Base64 would introduce upper case as distinct, plus two punctuation characters, and it would make addresses shorter and much harder to read aloud.

There is no sign of that and no pressure for it. But it is a real possible change rather than an impossible one, which is why this page names it rather than claiming nothing could ever alter the rule.

• Why the length is 56
• Anatomy of an onion address
• Why checking the first characters fails

Questions people actually ask

What if I see an address with a zero in it?

It cannot be a valid onion address. Either it was retyped by a person or it was invented.

Are hyphens or underscores ever allowed?

No. Only the 26 letters and the digits 2 to 7 appear before the dot.