Onion Service v3
An onion service is reachable directly inside the Tor network and has a cryptographically derived address ending in .onion. Version 3 uses modern keys and longer addresses. Client and service each build separate paths to a rendezvous point, so neither side needs to know the other's network address. Addresses should come only from verified primary sources.
The address is the key
A v3 address is not a name someone assigned, but the encoding of a public key. Anyone who enters the address correctly is speaking, with cryptographic proof, to the service that holds the matching private key. A certificate from an outside party is not required: authentication is already in the address. The 56-character length is the price of that.
Why there is no exit
Client and service each build their own circuits to an agreed rendezvous point. Traffic therefore stays entirely inside the Tor network and never passes an Exit Node. That rules out a whole class of risks and also hides the server’s location, which never has to reveal its own IP. The layered principle underneath is described in Onion Routing.
Phishing remains the real risk
Because nobody memorizes a 56-character string, addresses get copied — and that is where attackers start. A forged address that begins with the same four characters will not stand out in a quick glance. Cryptography protects the connection, not the choice of destination. The only reliable address is one from a verified primary source, checked once and then saved as a bookmark. Random directories and search lists are not proof of origin.
A well-known example is SecureDrop.
Category: Services