What Is .tor

Content on WhatAnswers is provided "as is" for informational purposes. While we strive for accuracy, we make no guarantees. Content is AI-assisted and should not be used as professional advice.

Last updated: April 11, 2026

Quick Answer: .tor is a special-use top-level domain designated by IANA in 2015 (RFC 7686) for accessing Tor hidden services, which are websites running on the Tor anonymity network accessible only through the Tor browser. These onion services use encryption and multi-hop routing to provide strong anonymity and censorship resistance.

Key Facts

The Tor anonymity network was developed by the U.S. Naval Research Laboratory and launched as an open-source project in 2002
.tor was officially designated as a special-use TLD by IANA in June 2015 under RFC 7686 to standardize naming for onion services
Tor v3 onion addresses, introduced in 2017, use 56-character alphanumeric strings providing stronger cryptographic protection than the deprecated 16-character v2 format
The Tor network reports millions of daily users, with data showing 2-4 million concurrent users at any given time globally
Accessing .tor services requires the Tor browser, a modified Firefox-based application that routes traffic through multiple volunteer-operated nodes for anonymization

Overview

.tor is a special-use top-level domain (TLD) officially designated by the Internet Assigned Numbers Authority (IANA) in 2015 specifically for Tor hidden services, now formally called onion services. These are websites and services that operate exclusively on the Tor anonymity network, accessible only through the Tor browser or other compatible Tor software. The designation was codified in RFC 7686, establishing a standardized naming convention for services prioritizing user privacy, anonymity, and censorship resistance.

The Tor network implements onion routing, a sophisticated technique that encrypts traffic and routes it through multiple volunteer-operated servers worldwide before reaching its destination. This multi-layered approach makes it extremely difficult to trace internet activity back to its origin, user identity, or physical location. Unlike traditional internet domains (.com, .org, .net) registered through centralized registrars, .tor addresses operate on Tor's decentralized infrastructure with no single point of control or failure.

How It Works

The mechanics of .tor services involve several interconnected processes:

Onion Routing Protocol: When accessing a .tor service, your traffic is encrypted multiple times and routed through a random sequence of at least three Tor nodes operated by volunteers worldwide. Each intermediate node only knows the identity of the previous and next nodes, not the complete path or final destination, making traffic analysis cryptographically difficult even for sophisticated adversaries.
V3 Onion Address Format: Modern .tor services use version 3 (v3) onion addresses consisting of 56-character alphanumeric strings derived from the service's public key, providing significantly stronger encryption and authentication than the older 16-character v2 format, which was deprecated and discontinued in 2021 due to security vulnerabilities.
Tor Browser Access Mechanism: Accessing .tor services requires the Tor browser, a privacy-focused web browser built on Firefox that automatically routes all traffic through the Tor network and disables plugins, JavaScript, and other features that could compromise anonymity. Users simply enter the onion address like any regular URL.
Service Publication and Discovery: Website operators configure standard web servers to operate as Tor hidden services using the Tor daemon software. The Tor network cryptographically generates a unique onion address and publishes it to a distributed directory, allowing discovery while keeping the server's physical location, IP address, and hosting provider completely private.
Layered Encryption Security: .tor services typically employ additional encryption layers (such as HTTPS/TLS) on top of Tor's network-level encryption, creating multiple security boundaries and protecting against potential compromise at any single cryptographic or network layer.

Key Comparisons

Feature	.tor Onion Services	Regular Domains	VPN Services
User Anonymity	Very high; source IP hidden through multiple encrypted routing hops	Very low; ISP and service provider see user IP address directly	Moderate; VPN provider logs IP address while hiding it from destination
Server Location Privacy	Complete; server location hidden from all users and external parties	Low; server location queryable through DNS and WHOIS records	Low; server location known to VPN provider and potentially vulnerable to subpoena
Access Requirements	Requires Tor browser; only accessible through Tor network infrastructure	Accessible through any standard web browser with standard internet connection	Requires VPN client software but accessible through any browser thereafter
Censorship Resistance	Extremely high; decentralized network difficult to block at national scale	Low; easily blocked via DNS filtering, IP blocking, or ISP-level filtering	Moderate; VPN access itself sometimes identifiable and blockable
Performance	Slower; typical latency 200-500ms due to multi-hop routing through volunteer nodes	Near-instant; minimal latency with direct connections to servers	Moderate; 10-100ms latency depending on VPN server geographic proximity

Why It Matters

Protecting Vulnerable Populations: .tor services enable journalists, political activists, LGBTQ+ individuals in hostile countries, and vulnerable minorities to communicate securely without government surveillance, corporate tracking, or persecution. Major news organizations including ProPublica, BBC, and the New York Times maintain .tor mirrors to reach users in censored regions.
Enabling Investigative Journalism: Secure communication platforms like SecureDrop rely on .tor services as their foundational technology, allowing sources to submit sensitive documents and information anonymously, protecting whistleblowers from retaliation while enabling critical investigative reporting.
Bypassing Internet Censorship: In countries with restrictive internet policies and national firewalls (China, Iran, North Korea), .tor services provide access to blocked information, independent news sources, and educational resources, maintaining freedom of information and digital civil liberties.
Research and Law Enforcement: Cybersecurity researchers, law enforcement agencies, and intelligence services use .tor to monitor and study cybercriminal activity in controlled environments, while also conducting legitimate undercover operations requiring anonymity.

.tor represents a significant technological achievement in privacy infrastructure, enabling genuine anonymity in an increasingly surveilled digital landscape. As governments and corporations expand digital surveillance capabilities and data collection programs, the Tor network and .tor services play a crucial role in protecting fundamental rights to privacy, freedom of speech, and access to information, even as they remain controversial due to their dual-use nature and association with both legitimate privacy needs and illegal activities.