i want to move my onion hosting from my local ubuntu 16 server to an hosting service one. My only concern is: how can i keep my domain generating privatekey totally safe? I've spent 12 days to generate my unique onion address and i really don't want to lose it.

Is there any way to encrypt them, lock them or anything else?

2 Answers 2


1. Run tor

2. Encrypt key:

openssl enc -aes-256-cbc -salt -pbkdf2 -in /var/lib/tor/example.onion/hs_ed25519_secret_key > /var/lib/tor/example.onion/hs_ed25519_secret_key

3. Profit

P.S. To restart again you need to stop tor daemon, decrypt your key:

openssl enc -d -aes-256-cbc -salt -pbkdf2 -in /var/lib/tor/example.onion/hs_ed25519_secret_key > /var/lib/tor/example.onion/hs_ed25519_secret_key

and repeat 1, 2 steps

  • I gotta decrypt/encrypt every time i restart tor, correct? I'm basically keeping my key there but password protected right?
    – user21205
    Mar 5, 2018 at 10:35
  • @FrancescoRubino yes, the above command (step 2) just takes original file "hs_ed25519_secret_key" and overwrites the content with AES encryption using a passphrase (you can use one more option '-a' it encode your binary secret key in readable base64 after encryption). Btw, you can "cat" secret key after running openssl command, and you will see your encrypted key. Tor does not need a secret key after you start daemon , so you can encrypt it and decrypt when you need to restart and encrypt again. I mean, you know, right? :D (sorry for my bad english)
    – Smirnov
    Mar 9, 2018 at 23:38
  • I used gpg, is it good enough too? any advice on securing the webserver and the server itself?
    – user21205
    Mar 10, 2018 at 12:47
  • @FrancescoRubino well, public key encryption (gpg) is unnecessary in this case, rly. Better to use the above openssl examples (for example, write a simple bash script). About security advices... The main thing is isolate tor from the outside and don't use shitty apache only nginx with unix sockets. I not really trust the containers so I prefer to use virtualization (kvm) on dedi, but it depends on which project you run, you know :D First tweak your torrc. For example, use "Sandbox 1, SocksPort 0 (Disabling client side... I mean, why do you need it for hidden service, right? :D)" etc. P1
    – Smirnov
    Mar 11, 2018 at 2:56
  • @FrancescoRubino Read about all stuff in the docs tor manual. Little example of tor/nginx configs if I remember it right :D SocksPort 0 Sandbox 1 HiddenServiceDir /var/lib/tor/example.onion/ HiddenServicePort 80 unix:/var/run/example-80.sock HiddenServiceVersion 3 then in "/etc/nginx/sites-enabled/default" in server{} block add listen unix:/var/run/example-80.sock default_server; server_name example.onion; allow unix:; deny all; server_tokens off; P2
    – Smirnov
    Mar 11, 2018 at 4:03

To my knowledge, there is currently no way to avoid that your key, at least for a short time, is on your server in cleartext.

However, the next generation onion services (V3) will allow you to do that once ticket #18098 (offline keys) has been implemented. Beware that the addresses differ from V2 addresses and you'll have to create a new onion address.

  • No way to implement it for now?
    – user21205
    Mar 5, 2018 at 9:22
  • Well, it's actaully already in the stable version. I just enabled it and now i have my onionv3 address. Now... how can i make the key secure? How do i have to split private and public key?
    – user21205
    Mar 6, 2018 at 12:23
  • @FrancescoRubino, yes, v3 is in stable. However, you can't keep the key off your machine until v3 support has been extended to support offline keys (ticket #18098). Mar 21, 2018 at 20:08

You must log in to answer this question.