If you have ever copied a .onion address, you have probably noticed it looks nothing like a normal web address. There is no readable name, just a long string of letters and numbers. Understanding why onion addresses are so long and random is a small piece of Tor literacy that makes the whole system easier to trust.
What a V3 onion address actually contains
A typical V3 onion address is 56 characters long, made up of lowercase letters and the digits 2 through 7. That is not a style choice. It is base32 encoding of real cryptographic data.
Inside that string is a full ed25519 public key, a version number, and a checksum of both. The address is not assigned by a company or registry. It is generated mathematically when the onion service is set up.
This is different from earlier V2 addresses, which were only 16 characters long and encoded an 80-bit hash of a key rather than the full key itself.
Why the address has to be random-looking
Normal websites rely on domain name systems and certificate authorities to prove you are talking to the right server. Onion services do not use either.
Instead, the address itself is the proof. Because it is derived directly from the service's public key, your Tor Browser can mathematically confirm it is connecting to the holder of that exact key, with no separate authority to trust or trick.
That security benefit is the whole reason the address cannot be short or memorable. A friendly name would mean giving up the direct link between the address and the key behind it.
Why V3 replaced V2
The Tor Project moved from V2 to V3 addresses because V2's shorter hash offered weaker protection as computing power grew. V3 addresses use a full 256-bit key, which is a meaningful jump in strength.
Moving from 16 characters to 56 characters was a deliberate choice to make the cryptography stronger, not an accident of design.
By 2021, roughly a third of all onion domains in active use were already V3. The older, weaker V2 format was phased out shortly after, making V3 the only format in use.
Can you make an onion address easier to remember?
Some operators generate what is called a vanity address: a V3 address that starts with a chosen, readable sequence of characters, with the rest of the 56 characters still random.
This can make an address easier to recognize at a glance, but it does not shorten it and does not replace the full cryptographic string. The random tail is still doing the actual security work.
Vanity prefixes are a convenience, not a trust signal. A recognizable-looking prefix tells you nothing about who actually controls the service.
What the length does and does not protect you from
A long, random address protects the integrity of the connection to that specific onion service. It does not protect everything else you do.
- Tor Browser routes your traffic through multiple relays, but routing alone does not make every action you take anonymous.
- Logging into a personal account, reusing a username, or downloading and opening a file can still identify you, regardless of how strong the onion address is.
- The address format tells you nothing about whether the service itself is trustworthy, legal, or safe to use.
How to actually find a legitimate onion address
Because these addresses are unmemorable by design, people are often tempted to search for them or pull them from directory sites. That is where most of the risk creeps in.
General-purpose directories, including the various sites calling themselves "the Hidden Wiki," are not a safe starting point. There is no single authoritative version of that name anymore, only a scattering of clones and copycats. Many of the links on them are outdated, fake, or actively malicious.
A more reliable approach: if an organization you already trust on the regular web offers an onion service, get the address from that organization's official site directly, not from a third-party list. Several privacy-focused and news organizations publish their onion address this way, directly on their own clearnet site, so you can verify it comes from them.
You can also use a privacy-respecting search engine like DuckDuckGo to locate an organization's official page, then look for the onion address there rather than on an unrelated directory.
Always run onion services through Tor Browser from the Tor Project, and treat any address you cannot verify against a source you already trust as unverified, no matter how official it looks.
The short version
Onion addresses are long and random because the string itself is the cryptographic key, not a label pointing to one. That design removes the need for a central naming authority and lets your browser verify the connection directly.
The length is the security feature, not a flaw to work around. Verify addresses at the source rather than trusting them because they look official.