Privacy tooling
What is Onion service?
An onion service is a service reachable only through Tor, whose address is derived from its public key rather than registered with any authority. Because there is no DNS registrar and no public IP, an onion service removes two of the main points at which a conventional site can be identified or seized.
Why Onion service matters
Because there is no DNS registrar and no public IP, an onion service removes two of the main points at which a conventional site can be identified or seized.
Onion service in practice
Running an onion service means editing your Tor configuration to point at your local server, then publishing the .onion address in place of a hostname. Your server must accept connections only over Tor's local SOCKS5 proxy, and your application should bind to the loopback interface. Get it wrong and your service leaks your real IP; get it right and you have a site whose address is your public key.
What people get wrong about Onion service
People assume an onion service hides the server automatically. It does not. If your application binds to all interfaces or logs real IPs, it can leak. The correction: bind to loopback, route through Tor, and treat the onion address as the only identity.
Onion service — common questions
How do I set up an onion service?
Configure Tor with a HiddenServiceDir and HiddenServicePort to forward to your local server's port. Then you get a .onion address in the hostname file; publish that instead of a DNS name.
Why would I use an onion service?
Because there's no DNS registrar and no public IP, so two of the main points for identifying or seizing a conventional site are removed.
More from privacy tooling
- WireGuard
- WireGuard is a VPN protocol implemented in about 4,000 lines of kernel code with a fixed modern cipher suite.
- OpenVPN
- OpenVPN is a mature userspace VPN protocol with configurable ciphers that can run over TCP or UDP.
- Tor
- Tor routes traffic through three volunteer-operated relays chosen so that no single relay knows both the origin and the destination.
- Tor exit node
- A Tor exit node is the final relay in a circuit, which connects to the destination and therefore appears to be the source of the traffic.
- SOCKS5
- SOCKS5 is a proxy protocol that forwards arbitrary TCP and UDP traffic, with optional authentication.
- Shadowsocks
- Shadowsocks is an encrypted proxy protocol designed to be difficult to identify by traffic analysis.
- No-logs policy
- A no-logs policy is a commitment not to retain records of user activity such as connection metadata, netflow or DNS queries.