What exactly makes an .onion site more secure than a regular html based website, except that it is "hidden" and can't be taken down easily. For a user term, am I more safe when I visit a onion site than a regular site? Does a .onion side has special securities? Like is the .onion site connected the same way to tor like I? Guard, Middle Node and Exit node?

Do I connect with my exit node to the .onion directly so my exit node sees it site or does my exit node connect to the exit node of the .onion side?

3 Answers 3


Edit: I thought of something to fix my answer which wasn't complete.

The main security boon is that even plain http traffic is encrypted between the last node and the onion service. You don't need to install an SSL certificate to get the same kind of encryption that you would get on the normal web with https. That is due to "onion routing" encryption scheme that Tor provides encryption and what makes it better than other networks that don't provide any kind of layred encryption between nodes. For example, proxychains can route your traffic but it won't give you the security of Tor.

Another weaker piece of extra security is "Security through obscurity" because onion services, especially v3 services, are ridiculously hard to find. Unless you tell someone that it exists, it is unlikely that someone will stumble upon it, especially if you are using a non-standard port.

As for anonymity, it help you and your visitors share information anonymously. Anonymity is what Tor is primarily about.

Does a .onion side has special securities?

There are some extra security functions out there that you can set up such as Client Authorization. Mostly security is up to you hardening your code and your web server.

Like is the .onion site connected the same way to tor like I? Guard, Middle Node and Exit node?

Almost. You don't go through an exit node for onion services and vice versa.

This is a bit dated but it will give you a good idea about onion services. Here is the actual documentation on how this all works.


Tor is not a website hosting: it pipelines your query to the actual server that serves it, so - the layer of additional security is an onion routing, nothing more! You have to secure your website yourself regardless of the connection path to it.


No, the security of Tor doesn't inherently mean the services themselves are secure.

Let's say you take a public bus to a fight club and get creamed. Taking a private "more secure" taxi to the still dangerous club isn't going to help you.

This is how Tor operates, it's the safe means of getting there, but the security of the site/destination is still 100% up to the owner of that site. Meaning, you probably shouldn't use the same password you use for your bank on any onion sites, as an example.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .