How to make a .onion site: A step-by-step guide

What is a .onion domain?

A .onion domain is the address of a website that can only be accessed through the Tor anonymity browser. Regular browsers won’t be able to navigate the relay of proxy servers that will take users to your website. The Tor browser uses Onion routing to send users’ traffic through encrypted proxy servers and in the process conceals the user’s location and activity from anyone trying to snoop on them.

Ordinary web domains, like .com, .org, or .biz, are issued by the Internet Corporation for Assigned Names and Numbers (ICANN). There are thousands of different domains out there, but not all of them can be used by everyone (like .apple, for example). Users have to submit proposals to ICANN to register a domain and sub-domain (the part before the period). There are usually costs associated with registering and maintaining the domain of your choice.

When you create a .onion site, a domain name will automatically be generated for you. It will be a string of 16 or 56 random lowercase letters and numbers (from 2 to 7) that the Tor browser can use to navigate to your server. Unfortunately, these random strings cannot be any shorter than 16 characters and are often hard to remember, making it difficult for users to memorize your website.

How to create a .onion site

Creating a .onion site requires at least basic knowledge of networking and web hosting — you will have to create a web server and configure the site yourself. Before you start working on your .onion website, make sure your Tor browser is set up and working properly. Here are the steps you’ll need to take to create your own .onion website:

1. Create a web server

First, create your website on your computer or server. You can use any tool or software you like for making websites. Just make sure it’s ready and working locally before moving on. If you already have an existing web server, Tor’s .onion service can give it a .onion domain if it’s configured correctly.

Note that the powerful anonymity provided by Tor isn’t worth much if your server leaks personal data or information that advanced users could use to identify you. Tor suggests binding your server to localhost, so when you set up your .onion services later, you’ll create a virtual port that visitors can connect through. This way, it won’t reveal your real IP address.

2. Configure your server’s .onion services

To configure your server, you’ll have to open your “torrc” file, which is a text file you received when you set up your Tor browser. You’ll need to add two pieces of information:

• A folder on your computer where Tor will store the files for your .onion site.
• The address of your web server so Tor knows where to find it.

For more detailed information on how to modify this file to create a .onion server, follow the instructions on the Tor project’s website.

3. Get your domain name

Once your setup is complete, restart your Tor browser to generate a public key, or domain, for your website. Check a file that Tor made in the folder you assigned it earlier. This file has the name of your new .onion site. It looks something like “eqdxk6lyjvo45c3shnrbmwtzf1uia2gp.onion” — and that’s the address people will use to visit your site through the Tor Browser.

After that, it’s up to you to distribute it and get people to visit your site. Just be sure not to share the private key with anyone!

Why would I want a .onion address?

A .onion domain has a few key advantages over an ordinary domain. The main one is that it can only be accessed using a Tor browser. It grants numerous layers of anonymity that are not available on more popular browsers. If you want to ensure near-total anonymity for both you and your visitors, you can’t do much better than a Tor address.

Since .onion domain names are automatically generated, it means that you do not need to register with ICANN to create your own domain. You won’t need to hide your details from “whois” searches, and your ICANN account won’t be vulnerable to malicious takeovers. You will be completely in control of your privacy and your domain.