In generating keys for a new hidden service, and the corresponding .onion address, does the tor client check for collision with existing .onion addresses? The process being so fast, I can't imagine how it could. Or instead, does it rely only on luck, in that the address space (280~1024) is so much greater than the number of published addresses?

Also, how many hidden service addresses have been published? Is it on the order of 107? As I recall, each of those ~106 Mevade slaves created a hidden service, and that's the largest known influx. Yes? I'm guessing that far more have been generated in seeking vanity addresses, but most have never been published.

2 Answers 2



As there are 32^16 possible addresses, such a collision is astronomically unlikely. In any case, there's no way of knowing if someone else has the same hidden service, just happens to be offline; there's no way of knowing whether another entity with the same HS key is actually you (from a previous session, or another machine etc).


If you happen to get the same onion, then you may have the same private key, which essentially means you get to "take over" that address, because any clients connecting to the previous onion URL may get redirected to your server instead. In practice, this will never, ever, ever happen accidentally. It takes many billions of intentional tries on powerful computers to even get half of the address correct.

No, the bots did not create their own hidden services. They connected to an existing one. Hidden services don't scale well, and if they all tried making their own, I believe it would cripple the network (or at least hidden services).

  • So, is your answer "no", that the tor client doesn't check, and just relies on luck? About Mevade, I vaguely remembered that slaves were creating hidden services, but don't have a cite. How many descriptors have been published?
    – mirimir
    Commented Aug 18, 2014 at 1:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .