To host a website as a Tor onion service, first make the site work on a local web server, then configure Tor to forward an onion-service port to that server. Tor creates a v3 address in a hostname file after you restart it. Keep the service keys private, test the address with Tor Browser, and treat operational security as a separate task: a working onion address does not by itself hide the server, its software, its content, or its availability pattern.
What an onion service does
The Tor Project defines onion services as services that can only be accessed over Tor. Instead of publishing a normal DNS record that points directly to a server, you run Tor beside (or in front of) a web server. Tor publishes a cryptographic service address and builds Tor circuits between visitors and the service. The web server can listen only on the local machine, so it does not need to expose its HTTP port to the public internet.
As an Amazon Associate I earn from qualifying purchases.
The standard setup has three pieces:
- A working Tor installation and a configuration file, commonly called
torrc. - A local HTTP server such as Nginx or Apache serving the site.
- An onion-service directory containing the generated address information and private keys.
Tor’s current default is onion-service version 3 (v3). A v3 address is 56 characters long, not counting the http:// prefix or the .onion suffix. Version 2 is deprecated and unsupported in Tor 0.4.6.1-alpha and later, so new deployments should not use v2 instructions.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Before you configure Tor
Use an operating-system-appropriate installation
The exact package names, service names, file locations, and permissions depend on your operating system and Tor package. The official walkthrough uses Debian-like examples and assumes Tor is already installed and running. Follow your distribution’s Tor installation guidance first, then identify the active torrc file and the account under which the Tor process runs. Do not assume that a command written for Debian applies unchanged to another distribution, container image, or manually installed Tor build.
#1 Best Overall
- 🛡 Automatic VPN + Tor Routing All internet traffic is automatically routed through VPN and Tor for enhanced anonymity.
- 🔎 Privacy-Focused Linux Environment Designed specifically for secure browsing, privacy protection, and online anonymity.
- ⚡ Bootable Plug-and-Play USB System Run the entire operating system directly from the USB drive without modifying your computer.
- 🧰 Built-in Security & Monitoring Tools Includes network monitoring dashboards, encryption tools, and privacy utilities.
- 🌐 Secure Web Browsing Preconfigured browsers and privacy tools help reduce tracking and increase online protection.
Choose where the service will run
You can run Tor and the web server on the same host, or put them on separate machines. A same-host deployment is simpler: Tor can forward to a loopback address or a local Unix socket. A split deployment can be useful when the web tier and Tor process have different administration boundaries, but it adds a network path that must be protected and is one situation in which HTTPS can provide useful additional protection.
Have a site that works locally
Install and configure Nginx, Apache, or another web server and place a test page in its document root. Confirm that the page is actually served before involving Tor:
http://localhost/If http://localhost/ does not return the expected page, fix the web server first. Check its own error log, virtual-host configuration, document permissions, and listening address. Tor cannot repair a web server that is not serving locally.
Configure the onion service
1. Add a service directory and port mapping
Open the torrc file with administrator privileges and add entries like these:
HiddenServiceDir /var/lib/tor/my-website/
HiddenServicePort 80 127.0.0.1:80HiddenServiceDir is the directory where Tor stores the onion-service identity, address information, and keys. HiddenServicePort has two sides: the first number, 80, is the virtual port visitors use on the onion address; the second part, 127.0.0.1:80, is the local destination where your web server listens.
Port 80 in this example does not mean that the web server must be publicly reachable on port 80. The target address is loopback, so only processes on that host can reach it. You can select another local listening port if your web server uses one, but the target must match the server’s actual bind address and port.
Rank #2
- 🛡 Automatic VPN + Tor Routing All internet traffic is automatically routed through VPN and Tor for enhanced anonymity.
- 🔎 Privacy-Focused Linux Environment Designed specifically for secure browsing, privacy protection, and online anonymity.
- ⚡ Bootable Plug-and-Play USB System Run the entire operating system directly from the USB drive without modifying your computer.
- 🧰 Built-in Security & Monitoring Tools Includes network monitoring dashboards, encryption tools, and privacy utilities.
- 🌐 Secure Web Browsing Preconfigured browsers and privacy tools help reduce tracking and increase online protection.
2. Keep the service directory usable only by Tor
The directory named by HiddenServiceDir must be readable and writable by the Tor process. If the directory is owned by the wrong account, has restrictive parent-directory permissions, or is mounted read-only, Tor may fail to start or may be unable to create the address and key files. Use the ownership and permission model recommended by your operating-system package rather than copying permissions from an unrelated installation.
3. Consider a Unix socket instead of TCP loopback
The TCP example is the easiest way to get started. The Tor setup guidance also presents a Unix-socket arrangement as good practice when you want to avoid an additional local-network exposure path. In that design, the web server listens on a Unix socket and the HiddenServicePort target points to that socket, using the syntax supported by your Tor version and web server. Both sides must agree on the socket path and access permissions. A socket does not remove the need to secure the host, but it prevents another network-capable process from connecting through a TCP listener on the loopback interface.
| Forwarding choice | Advantages | Costs and checks |
|---|---|---|
TCP loopback, such as 127.0.0.1:80 |
Simple, widely understood, and easy to troubleshoot with ordinary HTTP tools. | Leaves a local TCP listener; verify that it is bound only where intended and is not exposed by a broader bind address. |
| Unix socket | Avoids a TCP path on the local network and can reduce accidental exposure. | Requires matching Tor and web-server socket configuration, directory permissions, and a stable socket path. |
Restart Tor and obtain the address
Restart using your distribution’s service mechanism
Save torrc and restart the Tor service using the command appropriate for your operating system. On a systemd-based Debian-style installation, that commonly resembles:
sudo systemctl restart torTreat that command as a packaging example, not a universal instruction. Some systems use a different unit name, an init script, a container supervisor, or a user-run Tor process.
Check for startup errors
If Tor does not restart, inspect its log and correct the first configuration error reported. Common causes include a misspelled directive, a malformed port mapping, an unavailable socket, an unwritable service directory, or a conflict with an existing configuration. Confirm that Tor created the directory named by HiddenServiceDir. Do not continue to testing until Tor is running with the intended configuration.
Read the generated hostname
After a successful start, open the hostname file inside the service directory. Its contents are the v3 onion address. The address is generated from the service’s key material; it is not selected through a DNS registrar and cannot be replaced casually without creating a different service identity.
Rank #3
- ✅ Lates Tails OS version
- ✅ Simply plug into PC and boot Tails OS off the usb where you can browse ananymously.
- ✅ Comes with Tor Browser installed for safe web browsing and Dark Web Access.
- ✅ Comes with detailed instruction manual.
cat /var/lib/tor/my-website/hostnameVisit the resulting address with Tor Browser. Include the .onion suffix exactly as shown. If the page does not load, first verify that Tor is running, then verify that the local URL works, and finally inspect Tor’s log for connection or configuration errors.
Protect the onion identity
The service directory contains more than a public hostname. It also contains private key material that allows the service to prove its identity. The Tor Project warns: “If your keys leak, other people can impersonate your Onion Service, deeming it compromised, useless, and dangerous to visit.”
- Restrict access to the directory and its private files to the Tor process and authorized administrators.
- Do not publish the directory in a web root, include it in a public archive, or paste private-key contents into a ticket or chat.
- Back up the private key securely if you need the same onion address to survive a host rebuild. A backup is itself sensitive and must be encrypted and access-controlled.
- When migrating, copy the identity material carefully and preserve the permissions expected by the Tor package. Starting with a new key creates a new onion address.
Decide whether the service is public or restricted
With no client authorization configured, anyone who learns or discovers the onion address can attempt to visit it. That is appropriate for a public publication, but not for an administrative panel, private preview, or internal application.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchFor a restricted service, configure v3 client authorization in Tor and issue credentials to the people or systems that should connect. A client without the corresponding private credential will not be admitted. The exact file format and provisioning commands vary with Tor packaging, so follow the client-authorization procedure for the Tor version you operate and protect both server-side authorization data and client credentials.
| Access model | Use it when | Operational implication |
|---|---|---|
| Unauthenticated onion service | The site is intended for anyone who knows the address. | Address secrecy is not an access-control mechanism; assume the URL may be shared. |
| v3 client authorization | Only selected clients should reach the service. | Distribute credentials securely, revoke or replace them when necessary, and test an authorized and unauthorized client separately. |
Does an onion website need HTTPS?
Not always. Tor’s onion-service protocol provides encryption and authentication between a Tor client and the onion service. For a web server and Tor process on the same host, an HTTP origin behind Tor can therefore be a reasonable design.
HTTPS can still be useful or necessary in several circumstances:
Rank #4
- Compact plug-and-stay design to instantly add storage to your laptop, game console, in-car audio, and more
- Save time with ultra-fast transfer speeds up to 400MB/s (Based on read speed. 1 MB/s = 1 million bytes per second. Based on internal testing; performance may vary depending upon host device, usage conditions, drive capacity, and other factors. USB 3.0 port required.)
- Transfer a full-length movie to the drive in less than 30 seconds (Based on 1.2GB MPEG-4 video transfer with USB 3.2 Gen 1 or USB 3.0 host device.)
- Get space for your high-resolution photos, videos, and more at a great value with up to 128GB of storage (1GB=1,000,000,000 bytes. Actual user storage less.)
- Password-protect files using a downloadable software (Password protection uses 128-bit AES encryption and is supported by Windows 10+ and macOS v10.9+ (Software download required, see Password Protection page on SanDisk site).)
- Tor and the web server run on separate machines and the connection between them crosses a network you do not fully trust.
- The application only functions when its public origin is
https://or requires TLS-specific behavior. - You are serving both a clearnet site and an onion site and need to prevent insecure cookies, mixed-content warnings, or incorrect origin handling.
- Your reverse proxy, framework, authentication layer, or API client is configured to reject plain HTTP.
Do not present HTTPS as a universal requirement or as a substitute for Tor’s own protections. Decide based on the complete path: browser to Tor, Tor to the web server, application-generated links, cookies, redirects, and any clearnet counterpart. Use relative links or carefully configured rewriting and proxy headers when one application serves both origins, so pages do not silently send onion visitors to the public site or load insecure cross-origin resources.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Advertise an onion counterpart from a normal website
If you operate a regular HTTPS website as well as an onion service, you can advertise the onion counterpart with an Onion-Location HTTP header or an equivalent HTML meta attribute. The clearnet page that defines the header must itself be served over HTTPS, and the value must be an HTTP or HTTPS URL whose host ends in .onion.
Use the exact v3 address from the service’s hostname file. In a template or configuration example, the value has this shape:
Onion-Location: http://<your-v3-address>.onion/Choose the scheme and path that match your deployment. Test the header in a browser that supports onion-service discovery and verify that the advertised address does not expose a private administrative path unintentionally.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Operational security: what the onion setup does not hide
Remove identifying server details
Review HTTP response headers, error pages, default files, diagnostic endpoints, comments, document metadata, image metadata, and generated URLs. Web-server banners and framework fingerprints can reveal software or operating-system details. Content can also identify an organization, author, location, time zone, or editing workflow. Tor cannot remove information that your server deliberately sends.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsSeparate administration from publication
Use a dedicated account and a narrowly scoped document root for the public site. Keep logs, backups, deployment keys, control panels, and source files outside that root. Do not expose a status page or management interface through the same public onion service unless it has its own authentication and network restrictions.
Understand availability and traffic patterns
A host that is not online continuously creates observable downtime. Tor’s operational-security guidance notes that an adversary can profile availability and compare induced traffic patterns over time. Frequent maintenance windows, predictable publishing times, or a distinctive response pattern can reveal information even when the onion address itself remains reachable through Tor.
Best Value
- High Data Transfer Speed: USB 3.0 flash drive with read/write transfer speeds up to 80MB/s and 20MB/s respectively and it is backwards compatible with USB 2.0/1.1; Storage is fast, safe and stable
- Incredible Storage : USB flash drive with 16GB capacity, meet your needs of daily use on work, school, home and travelling for photos, music, videos, files storage and transfer
- Plug an Play : Just plug the flash drive then start data storage, backup and transfer between devices and locations; It supports Windows OS and compatible with PC, Laptop, TV, Car, Audio and etc
- Sleek and Practical Design : The 360 degree metal swivel cover provides extra protection for the 16gb usb drive. The end of the usb thumb drive has a loop that can easily be attached to your key chain or lanyard, using to help keep from losing, and for easy carrying
- What You Get : 16GB USB 3.0 Flash Drive; All of usb drives have been rigorously tested and formatted before leaving the factory
An always-on server or VPS is one possible deployment environment when continuous availability matters, but the choice does not automatically provide anonymity. Evaluate the host’s account records, administration path, physical and network exposure, logging policy, and who can access the machine. No hosting provider or hardware arrangement can turn an otherwise identifying operation into an anonymous one.
Common failure modes and fixes
Tor will not start after editing torrc
- Read the first error in the Tor log rather than changing several settings at once.
- Check directive spelling, whitespace, and the number and format of arguments.
- Confirm that the service directory exists or can be created by the Tor process.
- Check that the target port or Unix socket exists and that no unrelated service is conflicting with it.
- Revert the last change if Tor worked before the edit, then add one change at a time.
The hostname file is missing
Tor probably did not complete initialization, or the configured directory is not the directory used by the running process. Confirm the active configuration file, inspect the service log, and verify directory ownership and write permissions. Do not create a hostname manually; it must correspond to Tor’s generated key material.
Recommended Free Tools
The onion address loads an error page or times out
- Open
http://localhost/on the server and confirm the expected page appears. - Check that the web server is listening on the port and address named in
HiddenServicePort. - Check that a local firewall or security policy permits the Tor process to reach that destination.
- Review Tor logs for connection-refused, timeout, or permission messages.
- Test again in Tor Browser using the complete v3 address from
hostname.
The site works on the onion address but redirects incorrectly
Inspect the web server’s canonical-host, redirect, cookie, and proxy settings. A configuration written only for a clearnet domain may redirect onion visitors to that domain or mark cookies for the wrong origin. Configure the application deliberately for the onion hostname, or use separate virtual-host rules when the two sites should behave differently.
A Unix-socket deployment fails while TCP works
Check the socket path, the Tor process’s permission to connect, the web server’s permission to create and use the socket, and whether a stale socket remains after a restart. Confirm that both configurations use the same path and that the socket directory is available during boot.
Choosing a publishing workflow
A conventional local web server gives you normal routing, server-side code, access logs, caching, and deployment controls. It is the appropriate foundation for a dynamic site or an application that already runs behind Nginx or Apache.
For a small static site, Tor documentation also mentions OnionShare as a potentially easier publishing workflow. Treat it as an alternative to investigate, not as a drop-in replacement for every web-server feature. Confirm that the workflow supports your required uptime, content updates, access control, logging, and administration model before adopting it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Workflow | Best fit | Questions to answer first |
|---|---|---|
| Local web server plus Tor | Dynamic applications, existing sites, and operators who need conventional server controls. | Who administers the host, how are updates deployed, and which local port or socket should Tor reach? |
| Static-site publishing workflow | Small, mostly static content where minimal server administration is preferred. | Can it provide the required availability, update process, custom behavior, and restricted access? |
Maintenance checklist
- Keep Tor and the web server updated through your operating system’s normal security process.
- Periodically test the local site and the onion address separately.
- Monitor Tor and web-server logs without publishing them through the site.
- Review headers, error pages, links, metadata, and uploaded files for identifying information.
- Verify that private keys and client-authorization credentials remain protected and recoverable.
- Recheck redirects, cookies, mixed content, and absolute URLs after application changes.
- Document the service directory, configuration location, backup procedure, and recovery owner in a protected administrative record.
- Reassess whether the site’s uptime pattern, content, and administration process could identify the operator.
The practical sequence
The shortest reliable path is: make the site work at localhost; add HiddenServiceDir and HiddenServicePort; ensure the directory is writable by Tor; restart and inspect the logs; read hostname; test with Tor Browser; then harden the application and decide whether client authorization or HTTPS is needed. Each layer has a different job: the web server serves content, Tor publishes and routes the onion service, and operational security determines what information the deployment reveals.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
