If we talk about .onion sites only, can the bad nodes see the part of site's link? Like "example.onion/" or full link like "example.onion/user404/data/page/example123.txt"?

I don't talk about IP of site, cause I know that find IP itself is very difficult for attackers.

In Tor documentation indicated, .onion traffic always stays inside the Tor network and protected from attackers. But I still have some doubts about it. So, if 2 nodes like bridge and exit are bad, .onion V2/V3 user /user404/ is theoretically de-anonymised, right?

2 Answers 2


Let's say a bad node is actively scanning sites. If you have a link to example.onion/user404/data/page/example123.txt then yes they can see that because you linked to it. Also, if you turn on directory browsing in your web server and the node sees example.onion/user404 and can browse into those files and subdirectories then yes they could see that.

If you don't link to a file and you don't have a way to browse to a file, then it's very unlikely that someone will find that file.

This all comes down to your responsibility to harden your web server and if you are using a CMS, make sure you keep it patched and follow all security guidelines.

One more thing, and I will use Wordpress as an example because I know it best. I know that somewhere there is probably a example.onion/wp-admin page. I also know that there is a wp-content directory and a wp-config directory, etc. and if you haven't set up your security sufficiently these are all places where I can try to hack you and steal your data. This really has nothing to do with an onion service, but all about being a good webserver admin.


Usually - no, but in rare insecure cases - yes. The service hardening is basically the service owner's sole task. For Tor the website, SSH, VPN or anything else is basically a tunnel. So - use latest TLS and if you need more security - a client and server certificates served separately and off the Tor network: EmerCoin is a great alternative to do so easily, but it can be done in a numerous ways.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .