Onion links resolve only inside Tor

Someone pastes an onion address into a normal browser, gets an error, and concludes the market is down. The address was never going to work there.

How it actually resolves

The client takes the key from the address, works out where in a distributed directory that key's descriptor should live, and fetches it. The descriptor names introduction points. From there a rendezvous is arranged. At no stage does anything outside Tor learn the name you asked for.

That last part is the real benefit and it is easy to miss. On the ordinary web, a lookup is a broadcast of intent to at least one resolver. Here the lookup happens inside the network, so the question itself does not leak to a party outside it.

What this rules out

• An ordinary browser reaching the address without Tor.
• A DNS based block affecting it, because there is no record to block.
• A registrar seizing the name, because no registrar issued it.
• A public certificate meaning anything about it. See the padlock page.

What it does not protect

It does not hide that you use Tor from whoever runs your connection. Connecting to the network is visible even though what you do inside it is not. That is a separate matter, handled by bridges and pluggable transports, and it has nothing to do with addressing.

It also does not protect you from your own copy of the address being wrong. Tor will faithfully reach whatever key you gave it, and it has no opinion about whether that was the key you meant.

The gateway confusion

Services exist that take an onion address and serve it over the ordinary web by appending something to the hostname. Using one means a stranger's server sits between you and the site, sees everything, and can change anything. It also means the property described on this page has been given away entirely.

People reach for these because the address is easier to type on a phone. The convenience is real and the cost is the whole design. An awazon market link reached that way is not an onion connection, it is a request to somebody's proxy.

The error message tells you nothing

When an ordinary browser refuses an onion address, the message is about name resolution failing. That message is identical whether the service is thriving, retired, or never existed. It is produced by software that was never going to be able to answer.

People report that error as evidence about the market. It is evidence about the browser. The only place a meaningful failure can happen is inside Tor, and the messages there are different and more specific.

What would move this

A change to the reservation that made onion a normal public suffix with real name servers. It is reserved specifically to stop that, and undoing it would break the addressing model rather than extend it.

The practical version already happens through gateways, and that is why this page names them. The statement is about the protocol. Habits can route around a protocol without changing it.

• The address is the key
• The padlock icon
• Glossary