Recently I noticed that all the V3 addresses end in "d". Some examples from Ahmia.fi search results ("Tor" was the search query):
To make sure the story is correct, I made another test using mkp224o for creating custom V3 addresses (in this example I've generated addresses starting with test):
As another interesting result two ending letters as:
Then I checked Tor Spec for v3 in here: https://github.com/torproject/torspec/blob/main/rend-spec-v3.txt. This is the exact copy of section 6 (Encoding Onion Address):
- Encoding onion addresses [ONIONADDRESS]
The onion address of a hidden service includes its identity public key, a version field and a basic checksum. All this information is then base32 encoded as shown below:
onion_address = base32(PUBKEY | CHECKSUM | VERSION) + ".onion" CHECKSUM = H(".onion checksum" | PUBKEY | VERSION)[:2] where: - PUBKEY is the 32 bytes ed25519 master pubkey of the hidden service. - VERSION is a one byte version field (default value '\x03') - ".onion checksum" is a constant string - CHECKSUM is truncated to two bytes before inserting it in onion_address
Here are a few example addresses:
pg6mmjiyjmcrsslvykfwnntlaru7p5svn6y2ymmju6nubxndf4pscry**d**.onion sp3k262uwy4r2k3ycr5awluarykdpag6a7y33jxop4cs2lu5uz5sseq**d**.onion xa4r2iadxm55fbnqgwwi5mymqdcofiu3w6rpbtqn7b2dyn7mgwj64jy**d**.onion
For more information about this encoding, please see our discussion thread at [ONIONADDRESS-REFS].
All the examples are ended with d as I made them bold!
The documentation exactly says that: onion_address = base32(PUBKEY | CHECKSUM | VERSION) + ".onion"
Therefore, base32 of "PUBKEY | CHECKSUM | VERSION" is always ending with d? Or ad, id, qd, and yd?
I also checked https://lists.torproject.org/pipermail/tor-dev/2017-January/011816.html and https://lists.torproject.org/pipermail/tor-dev/2016-December/011734.html