How to verify an onion link
A short routine for checking that an .onion address belongs to the service it claims to be, before you trust it with anything.
Updated
An onion address cannot be judged by looking at it. It is 56 characters derived from a cryptographic key, and a fake one looks exactly as plausible as a real one. Checking it means comparing it with something you already trust.
The routine
- Start from the operator, not from a list. Open the service's established ordinary website — the one you can reach from a search engine or a printed source — and look for the onion address it publishes there.
- Compare the whole address. Lookalike addresses are generated to match the first and last characters. Check the middle, or paste both into a text editor, one above the other.
- Look for the “.onion available” notice. Many official sites tell Tor Browser about their onion address, and the browser then shows a button in the address bar. That announcement comes from the operator's own server.
- Check a second, independent source. A project's code repository, its Wikipedia article, or the official SecureDrop directory for newsrooms.
- Save it once verified. Bookmark the address in Tor Browser and use the bookmark from then on. Most people are caught by searching again later and clicking a different result.
Signs that something is wrong
- A message saying the old address is compromised and you must switch to a new one now.
- A “mirror” that the operator's own site does not mention.
- A login page that accepts any password, or asks for a recovery phrase or a payment before showing anything.
- A service that was seized or closed and has apparently come back under the same name.
How WikiHidden helps
Each address on a profile names the source it was taken from, and is marked confirmed when the operator's own website announced it. Treat that as a pointer to check, not as a guarantee. For how clones and fake mirrors work, see Recognising impersonation.