Onion Service (.onion)

An onion service (historically a "hidden service") is a server — a website, a Bitcoin node, an SSH endpoint — that is reachable only from within the Tor network, through a special address ending in .onion. Unlike ordinary web browsing over Tor, traffic to an onion service never passes through an exit relay; both the client and the server stay inside the network end to end, hiding the server's IP address and physical location from visitors, network observers, and even the Tor relays carrying the traffic.

Self-authenticating addresses

A modern v3 onion address is 56 characters long because it is an Ed25519 public key, not merely a hash of one. The service signs a descriptor with the matching private key, and the client verifies that signature using the key encoded in the address itself. The address therefore authenticates the server cryptographically: there is no certificate authority to trust, no DNS to hijack, and no possibility of connecting to an impostor as long as you hold the correct .onion string. Connections are encrypted end to end by construction — HTTPS is redundant for confidentiality, though some operators layer it anyway.

How the rendezvous works

Neither side ever learns the other's network location. The service builds circuits to a few relays it selects as introduction points and publishes them in its signed descriptor. A client that wants to connect picks a random relay as a rendezvous point, tells the service about it via an introduction point, and both sides extend circuits to meet in the middle. Every hop is chosen so that no single relay sees both who is asking and who is answering. The cost of all this indirection is latency — six relay hops instead of three — and throughput that suits control panels and node traffic better than bulk media.

Why sovereign operators use them

For self-hosted infrastructure, onion services solve a genuinely hard problem: exposing a home-hosted service without opening a router port, renting a static IP, buying a domain, or revealing where you live. A Bitcoin node, a Lightning node, a personal Nostr relay, or a private file server can sit behind an onion address and remain reachable from anywhere, while NAT, dynamic IPs, and ISP port-blocking become irrelevant because the Tor network handles the rendezvous. Bitcoin Core ships with first-class onion support, and wallets have connected to home nodes over Tor for years precisely because it requires zero inbound firewall changes. The same property protects the metadata of who connects to your node — an eavesdropper on your line sees Tor traffic, not Bitcoin traffic.

For services that should be private even within Tor, v3 onion services support client authorization: the operator registers the public keys of permitted clients, and the service's descriptor can only be decrypted — the service cannot even be discovered, let alone reached — by those keys. That makes an onion address the cleanest way to expose a home dashboard, a node RPC port, or a workshop camera to exactly one person: yourself, remotely. The inverse trade also exists — services that need Tor's reachability but not anonymity for the server can run in a single-onion configuration that shortens the circuit for speed while clients stay protected. As always, match the configuration to the requirement rather than defaulting to maximum everything.

Limits and good practice

An onion service hides your location, not your mistakes. Application-level leaks — a server banner with your hostname, an error page revealing a clearnet IP, reused keys — can undo the anonymity the transport provides, so operators harden the service itself, not just the tunnel. Availability depends on the Tor network being reachable, and latency-sensitive uses will feel the extra hops. Onion services are built on the same machinery described under Tor (The Onion Router), and whether you need one at all is a question your threat model answers: for many node runners, "reachable from anywhere, revealing nothing about home" is exactly the property worth the friction.