What is to prevent exit nodes from seeing the location of servers hosting Tor hidden services?

1 Answer 1


TL;DR — When you visit a hidden service through Tor, your traffic is never exiting the Tor network (No exit node is involved) like the picture below.

Tor hidden services final state

An overview of how we get to the above picture without revealing either parties location to anyone is below. A comprehensive explanation (with more pictures) can be found in the docs.

When a hidden service is created it randomly picks a few relays and builds circuits to them. It then asks them to be "introductory points" for the hidden service (but they don't know where it is because they're communicating with it via a Tor circuit). Once the hidden service has a few introductory points, it assembles a hidden service descriptor that lists those introductory points and its public key. It then signs this descriptor with its private key and sends it to a distributed hash table. When a client wants to contact that hidden service, it grabs the service descriptor from the DHT (using the .onion address). It then picks a random relay to use as a rendezvous point and tells it a secret. It then builds a circuit to that point, and creates an introductory message (which includes the rendezvous point's address and the secret) which is encrypted using the hidden services public key. It then sends that message to one of the introductory points which forwards it onto the hidden service. The hidden service then builds a circuit to that rendezvous point and tells it the same secret that it found in the introductory message. Now the rendezvous point can act as the middle man between the two circuits. It doesn't know the hidden services location, or the clients location, but it can forward data between them. The messages are end-to-end encrypted, so the rendezvous point never knows what the traffic is that it's forwarding.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .