Understanding Tor v3 Hidden Services: Circuits, Introduction Points & Onion Routing

A .onion address isn't a domain in the normal sense — it's a cryptographic public key that lets a server receive connections without ever revealing its IP address. This guide explains how modern Tor v3 hidden services actually work: the circuits, introduction points, and rendezvous handshake that keep both visitor and operator anonymous. It builds on our beginner explainer, how Tor works.

v2 vs. v3 Onion Addresses

The old v2 addresses were 16 characters and used weaker crypto (SHA-1, RSA-1024). Tor deprecated them, and modern services use v3 addresses — 56 characters, built on SHA3-256, ed25519, and Curve25519. A v3 .onion is literally a base32 encoding of the service's ed25519 public key plus a checksum and version byte, which is why the address itself proves you're talking to the right server. Wikipedia's .onion overview summarises the format, and the full details live in the Tor rendezvous specification.

Step 1: The Service Publishes a Descriptor

When a hidden service starts, it:

1. Chooses several Tor relays to act as introduction points and builds circuits to them.
2. Signs a service descriptor (listing those introduction points) with its ed25519 key.
3. Uploads that descriptor to a distributed set of hidden service directories (HSDirs).

Nothing in this process reveals the server's real IP — every step happens over Tor circuits, the same onion routing used for ordinary browsing.

Step 2: The Visitor Finds the Service

When you enter a .onion address in the Tor Browser:

1. Your client derives the descriptor location from the address (the public key) and fetches it from the HSDirs.
2. It learns the service's current introduction points.
3. It picks a random relay as a rendezvous point and builds a circuit to it.

Step 3: The Rendezvous Handshake

This is the clever part that keeps *both* sides anonymous:

1. Your client tells an introduction point: "meet me at this rendezvous point."
2. The service builds its own circuit to that same rendezvous point.
3. Traffic flows through the rendezvous relay — but neither your circuit nor the service's circuit is ever fully known to any single relay, and neither side learns the other's IP.

Because the connection never touches an exit node, there's no clearnet exposure at all — a key reason .onion services resist surveillance and censorship, as the EFF has long noted.

Why v3 Matters for Security

  • Stronger cryptography resists the attacks that made v2 addresses harvestable.
  • Descriptors are encrypted, so HSDirs can't enumerate what services exist.
  • The address is the key, so a correct v3 address cryptographically guarantees you're reaching the real service — provided you got the address from a PGP-verified source and not a phishing clone.

Tor v3 Hidden Services FAQ

What is a v3 onion address? A 56-character base32 encoding of a service's ed25519 public key, checksum, and version — reachable only over Tor.

Why did v2 onions stop working? Tor deprecated them for weak cryptography; only v3 addresses are supported now.

Does a hidden service use an exit node? No — .onion traffic stays inside Tor via a rendezvous point, so there's no exit node. See how Tor works.

Can a v3 address be faked? Not the cryptography — but scammers register look-alike addresses. Always verify with PGP.

Bottom Line

Tor v3 hidden services use introduction points and a rendezvous handshake so a server can accept connections without ever exposing its IP, and the 56-character address *is* the server's public key. The crypto is strong — your only real risk is being handed a look-alike address, which is why verification matters more than the math.