Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →To keep the same v3 onion address, move the existing service identity—not just the address shown in the hostname file. Back up the complete HiddenServiceDir, including its private identity material, configure the destination Tor instance to use that directory, restore it with access for the Tor process, restart Tor, and test the service through Tor Browser. Copying the hostname text into a new, empty service directory creates a different identity and therefore a different address.
Why the onion address follows the identity key
An onion service address is not an editable label. In Tor’s protocol, the address encodes the service’s identity public key, while the service uses the matching identity private key to sign its descriptor. A destination that generates a new key pair is a new onion service, even if its web application and configuration look identical.
As an Amazon Associate I earn from qualifying purchases.
Tor’s protocol overview explains this relationship in How do Onion Services work?. The practical consequence is simple: preserve the cryptographic identity directory and point the new Tor process at it. The text in hostname is useful for recording and checking the address, but it cannot recreate the private key that authenticates that address.
What must be moved, and what must be rebuilt
The service directory is the critical part of the migration. Tor’s setup guidance describes HiddenServiceDir as the location for service information and cryptographic keys. A complete copy gives the destination Tor process the material it needs to advertise the existing identity.
#1 Best Overall
- Hardware encrypted drive
- Simple to use pin access. RPM-5400
- Administrator password feature
- Bus powered
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
| Item | Move or recreate? | Why it matters |
|---|---|---|
HiddenServiceDir contents |
Move intact | Contains the service identity and other generated service data. Point the destination configuration to this preserved directory. |
Private identity material, including private_key where present |
Move and protect | Required for the service to authenticate as the existing onion address. Exposure can enable impersonation. |
hostname |
Move or record for verification | Shows the address Tor generated; the text alone does not preserve the identity. |
HiddenServicePort mappings |
Reproduce in destination configuration | Connects the onion virtual port to the local website, application, or Unix socket. |
| Website or application files and database | Rebuild separately | These are host and application state, not the onion identity. A Tor migration does not copy them automatically. |
| Application secrets, firewall rules, TLS settings, monitoring, and system users | Rebuild or migrate separately | They belong to the operating system or application stack and may differ on the new host. |
| Client-authorization material | Preserve separately when enabled | Authorized access uses additional service-side and client-side credentials. |
Tor’s setup page also recommends keeping a backup copy of the private_key for a service intended to remain available long term. It does not require one particular archive format, encryption program, backup device, ownership command, or transfer utility, so choose controls that fit the operating system and threat model.
Before you start: record the source service
Do this while the original service is known to work. Configuration paths and service names vary between operating systems and Tor packages, so treat the following as a record-keeping checklist rather than universal commands.
- Write down the full path configured as
HiddenServiceDir. - Read and securely record the current address from the
hostnamefile inside that directory. - Copy every
HiddenServicePortline, including the virtual port and its local destination. - Note whether the backend is a TCP address and port or a Unix socket, and record the application bind address and port.
- Record the Tor package and operating-system service account that currently owns or accesses the directory.
- Determine whether client authorization is enabled and which service-side and client-side files it uses.
- Document how the website or application is started, where its data lives, and which firewall rules permit local connections from Tor.
The goal is to separate the identity migration from the application migration. If the onion address survives but the backend is not listening at the configured endpoint, Tor can be healthy while visitors still see an application error.
Step-by-step migration procedure
1. Quiesce the source and make a complete protected copy
Stop the onion service or otherwise quiesce writes to its service directory using the host’s normal service-management procedure. A quiet directory gives you a consistent copy and avoids changing key or state files during transfer.
Copy the entire existing HiddenServiceDir, not only hostname and not only a file that happens to contain a key. Include the private identity material and all generated service files. Keep the backup in a location that other users and unrelated services cannot read. If you use an archive, protect it with controls appropriate for private keys; Tor’s documentation does not prescribe a particular archive or encryption tool.
Keep at least one protected backup before altering the source. For a long-running service, that backup is your recovery path if the destination is misconfigured or the transfer is damaged.
2. Prepare the destination application first
Install and configure the local website or application on the new machine. Confirm that it responds at the endpoint you intend to publish through Tor. If the original mapping used a Unix socket, create that socket at the destination and verify that the Tor process can reach it; if it used a local TCP listener, verify the address and port.
Migrate the application’s database, uploads, environment variables, certificates, and other host state independently. Test the application locally before introducing the onion service. This catches a backend failure without confusing it with a Tor identity or directory problem.
Rank #2
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
- Super fast USB 3.0 Connection - Data transfer speeds up to 10X faster than USB 2.0
- Software Free Design - With no admin rights needed
- Sealed from Physical Attacks by Tough Epoxy Coating
- Brute Force Self Destruct Feature
3. Configure Tor to use the preserved directory
Edit the destination Tor configuration and set HiddenServiceDir to the path where you will restore the copied service data. Recreate the required HiddenServicePort mappings exactly, adjusting only the local backend endpoint when the destination intentionally differs.
Tor’s setup example maps virtual port 80 to a local web server and also demonstrates a Unix-socket destination. Use the syntax documented for your installed Tor package. Do not assume that a configuration path from one distribution, container image, or operating system applies unchanged to another.
The configured directory must be accessible to the Tor process with the permissions required by that package. Identify the actual service account on the destination, then apply restrictive access that lets Tor read and write its service data without granting unrelated users access. There is no single ownership command that is correct for every package.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors4. Transfer and restore the directory securely
Move the protected copy through a channel and storage location suitable for private key material. Avoid temporary shared folders, public repositories, unencrypted logs, and transfer accounts that grant broad access. Remove transient copies after verifying the restore, subject to your retention policy.
Restore the directory at the exact path named by HiddenServiceDir. Preserve the files and their contents. If you deliberately changed the path, update the configuration to match before starting Tor. Check that the destination service account can access the directory and that ordinary users cannot browse the private material.
5. Start or restart Tor on the destination
Use the service-management command appropriate to the destination. Tor’s setup page gives sudo systemctl restart tor as a Debian-like example, but the unit name, init system, container command, and privilege model can differ elsewhere.
If Tor refuses to start, read its logs before changing files. Common configuration problems include a typo in HiddenServiceDir or HiddenServicePort, a missing directory, and permissions that prevent the Tor process from reading or writing the service data. Correct the underlying error, then restart using the destination platform’s normal procedure.
6. Verify the preserved address and the application
Read the restored hostname file and compare it with the address recorded on the source. The value should be the same. A different value is a strong indication that Tor started with an empty or newly initialized directory, or that the configuration points somewhere other than the restored data.
Rank #3
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Connect to the address with Tor Browser and exercise the application, not just the Tor connection. Check the main page, the paths that matter to users, form submissions, authentication, uploads, and any reverse-proxy behavior relevant to your service. Tor’s setup workflow uses Tor Browser for this end-to-end check.
7. Re-enable normal operations and retain the recovery copy
Once the destination is serving correctly, decide whether the source should remain offline, operate as a controlled fallback, or be retired. Do not run two independently writable instances with the same service identity unless you have a deliberate failover design; simultaneous instances can create confusing application state and operational uncertainty.
Keep the protected identity backup according to your retention policy. Test that you can locate and restore it without exposing the private files. Also document the destination’s service account, directory path, Tor configuration, application endpoint, and recovery steps for the next operator.
Free tools Windows power users keep installed
One-click scans. No signup required.
Client authorization is a separate migration
An onion address and client authorization solve different problems. The identity directory proves which service owns the address. Client authorization adds credentials that restrict who may connect.
When authorization is enabled, preserve the service-side authorization configuration and verify that each permitted client still has its own client-side private authorization file in the location expected by that client. Tor’s Client Authorization documentation distinguishes public keys stored for the service from private authorization credentials held by clients.
After migration, test with an authorized client and, separately, with a client that should be denied. A service can retain the correct onion address while authorized users fail because their client credentials were omitted, misplaced, or replaced. Conversely, copying client credentials to an insecure shared location can defeat the access control you intended.
Security practices for the backup
The service directory should be treated as sensitive material. Tor warns that disclosure of service keys can allow another party to impersonate the onion service. A backup therefore deserves stronger handling than ordinary website content.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- Limit directory and backup access to the Tor administrator and the small set of operators who need recovery access.
- Keep the private identity material out of source-control repositories, ticket attachments, chat messages, shell-history captures, and diagnostic logs.
- Protect backup media and any transfer staging area against other users on the system.
- Encrypt a backup when that is appropriate for your environment, while retaining the recovery key in a separately controlled location.
- Verify the restored files before deleting the source backup or temporary transfer copy.
- Keep more than one protected recovery copy if losing the only copy would permanently change the service identity.
- Record who can access the backup and review that access when staff, hosts, or automation change.
An encrypted external drive is one possible implementation choice, not a Tor requirement. The essential property is controlled access to the private identity material, whether the copy is stored offline, on a secured server, or in another appropriately protected medium.
Rank #4
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Troubleshooting by symptom
The address changed after the move
Check the destination’s HiddenServiceDir value and compare it with the path where you restored the backup. Inspect whether the directory was empty when Tor first started. Starting Tor against an empty directory causes it to initialize a new identity, which produces a new hostname. Stop Tor, correct the path, restore the original directory, and start it again. Keep the original backup untouched until the expected hostname is visible.
Tor will not start
Read the Tor service logs and configuration error output. Check for spelling errors, an invalid HiddenServicePort line, a nonexistent backend socket or port, and permissions that prevent access to HiddenServiceDir. Confirm that the destination package expects the configuration file and service account you used; commands and paths are not universal across operating systems.
Tor starts, but the onion site returns an application error
Use a local test to confirm that the backend is listening at the endpoint in the port mapping. Check that the application was migrated and started, that its database and secrets are present, and that host firewall rules permit the local connection. Then compare the destination’s HiddenServicePort lines with the source record. This symptom usually concerns the backend or mapping rather than the preserved identity.
The address is correct, but authorized clients cannot connect
Check the service-side authorization files and the client-side private authorization files separately. Verify that the client is using the intended onion address and that its credential files are in the location and format expected by its Tor client. Test an authorized and an unauthorized client to distinguish a missing credential from a general service outage.
Visitors see an old site or inconsistent content
Confirm which host is currently running the preserved identity and whether the old host is still serving traffic. Review DNS-like application assumptions, reverse-proxy configuration, caches, databases, and deployment jobs in the application layer. Tor’s identity migration does not synchronize website data or prevent two hosts from serving different application states.
Operational limits and planning choices
The official Tor pages provide setup, protocol, and client-authorization guidance; they do not publish a complete cross-platform migration script, universal permission commands, quantified downtime, or migration failure rates. Plan a maintenance window appropriate to your application, and validate the exact Tor package and operating-system service configuration on the destination.
| Decision | Safer default | Trade-off |
|---|---|---|
| Identity copy | Copy the complete existing HiddenServiceDir |
Preserves the address but requires careful protection of private keys. |
| Backup location | Restricted, protected storage with a tested restore path | Less convenient than an ordinary shared folder, but reduces impersonation risk. |
| Destination path | Use the path declared in HiddenServiceDir and verify service-account access |
May require package-specific permission work instead of copying source ownership blindly. |
| Cutover | Quiesce the source, verify the destination, then retire or isolate the source | Requires coordination but avoids conflicting writable instances. |
| Authorization | Migrate and test service-side and client-side credentials separately | Adds credential-handling work, but preserves restricted access. |
Migration checklist
- Record
HiddenServiceDir,hostname, port mappings, backend endpoints, and authorization status. - Quiesce the source and copy the complete service directory.
- Protect the backup and confirm the private identity material is included.
- Prepare and locally test the destination application.
- Restore the directory at the configured destination path.
- Recreate the required
HiddenServicePortmappings. - Verify permissions for the actual Tor service account.
- Start or restart Tor with the destination platform’s normal service command.
- Read logs if startup fails.
- Compare the restored
hostnamewith the original address. - Test the site in Tor Browser and exercise important application functions.
- Test authorized clients if client authorization is enabled.
- Retain a protected recovery copy and document the final configuration.
Bottom line
Address preservation is an identity-preservation task. Back up and restore the existing HiddenServiceDir, keep its private key material confidential, point the destination Tor instance at that restored directory, reproduce the port mappings, and verify both Tor and the application after restart. The hostname text helps you check the result; it is not a substitute for the cryptographic identity that makes the onion address yours.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
