PRIMER · ONION ADDRESSING
What Is an Onion Link in 2026, and How to Open One Safely
First time reaching Torzon? Start here — this Torzon primer covers exactly what an onion link is. An onion link is a web address that only resolves inside the Tor network. It ends in .onion, and the long block of letters and digits before that suffix is not decoration. It is math, and it is the reason a fake link cannot quietly stand in for the real one.
Published 2026-08-17 · Updated 2026-08-19 · Written by Alex Ferran, security research
What is a .onion address, exactly?
A current Torzon-style onion address is 56 characters followed by .onion. Those characters are an encoding of the site public key. When you open the address, Tor uses it to confirm you reached the exact server that holds the matching private key, with no certificate authority sitting in the middle. The address and the identity are one and the same.
That is why the meaning of a Torzon onion link is literal: the string is the site. Change one character and you are talking to a different server, which on Torzon usually means a clone built to phish you.
How does onion addressing actually work?
A Torzon mirror's address is not assigned by a registrar and cannot be bought from one. It falls out of the site own cryptographic key. Here is the path from a keypair to the string you paste.
Where the address comes from
Because the string is derived from the key, no one can mint a valid address for a key they do not hold. A scammer can register a similar clearnet domain in seconds, but they cannot forge an onion that both looks right and answers with the matching key.
Why one changed character breaks it
The address is the fingerprint of a specific key. Flip a character and it points at a different key, which nobody may even control. There is no autocorrect and no near-miss. This is exactly why you copy addresses rather than type them.
How is this different from a normal web address?
A clearnet address like torzon-market.net is looked up through DNS and vouched for by a certificate authority you have to trust. An onion address skips both. There is no DNS lookup that a network can tamper with and no authority to compromise; the address itself carries the proof of identity. The trade is reach: a .onion only works inside Tor, and a normal browser cannot open it at all.
How do you open an onion link?
- Install the Tor Browser from its official project before attempting to reach Torzon. An ordinary browser cannot open .onion at all.
- Copy the full Torzon address from a source you trust. Never retype it by hand.
- Paste it into the Tor Browser address bar and load it.
- For Torzon, match the string against the signed mirror list and the PGP fingerprint first.
- Only then log in. If the address fails the signed record, close the tab and start over.
Why do darknet markets use onion links and PGP together?
An onion link proves you reached a specific server. It does not prove that server is Torzon rather than a clone that looks the same. That second job belongs to PGP. Torzon signs its mirror list with a key, you check the signature, and the two together close the gap. This is why Torzon, like most serious darknet marketplaces, publishes a fingerprint right next to its addresses. Either one alone leaves a door open.
Honest limit: we can explain the mechanism, not guarantee your setup. Tor can be misconfigured, malware can hijack a clipboard, and a stale bookmark can point at a dead or hostile host. Verify the string every single time, even when it feels familiar.
Onion links and clearnet domains like torzon-market.net: how they relate
This page lives on a clearnet domain, and it explains onion addressing precisely because the two systems solve different problems and get confused constantly. A clearnet domain such as this one is easy to remember, indexed by ordinary search engines, and secured by the certificate authority system — but it can be seized, DNS-hijacked, or cloned by anyone who registers a similar-looking name. For Torzon specifically, an onion address cannot be seized in the same way and cannot be typo-squatted with a similar-looking string, because there is no "similar" in cryptographic addressing — a changed character is a completely different key.
Why a Torzon reference needs both
A clearnet page like this one exists so people who do not yet have the correct onion address have somewhere findable to start. Its entire job is to hand off responsibly to the real onion address through PGP-signed verification, then get out of the way. Trusting a clearnet Torzon reference page for convenience is fine; trusting it as a substitute for verifying the onion address itself is the mistake phishing operators count on.
The handoff, done correctly
A responsible handoff from clearnet to onion looks like this: land on a clearnet reference, cross-check its PGP key against an independent source if possible, copy the exact onion string, verify it with the tools on this page, and only then open it in Tor Browser. Skipping straight from a search result to an onion address, with no clearnet reference and no PGP step at all, is how most onion-link phishing succeeds.
Onion v3 cryptography: why the address itself is the public key
The earlier section covers the shape of the process — key, encode, address. This section goes one level deeper into why that specific design makes a Torzon onion link resistant to the kind of spoofing that plagues every clearnet Torzon lookalike.
Ed25519, and why the key length matters
Current onion services (the "v3" addressing scheme that replaced the older, shorter v2 format) use Ed25519 public-key cryptography. Every Torzon mirror's 56-character address is a base32 encoding of that public key plus a version byte and a checksum, packed together so the address is self-verifying: a client can check the checksum without contacting anything, which is part of why a mistyped onion fails immediately rather than silently connecting somewhere wrong.
No certificate authority means no certificate authority to trick
On the clearnet, a phishing operator's real obstacle is a certificate authority — get a certificate issued for a lookalike domain and a browser will show a padlock for it anyway. Torzon over onion routing has no certificate authority in the loop at all. The address itself does the job a certificate normally does, which removes an entire category of clearnet attack (mis-issued certificates, compromised CAs) from the threat model — at the cost of needing the exact address, since there is no fallback trust anchor to fall back on.
What this means in practice for a Torzon visitor
In practice, this is why every Torzon guide on this reference repeats the same instruction: copy the address, never retype it, and check it character by character. The cryptography is genuinely strong; the practical failure mode is a human copying the wrong string, not the math being broken. Onion v3 removes the weak links a clearnet system has and replaces them with exactly one strong requirement — get the string right.
Common onion link mistakes that lead to phishing
Typing an onion address from memory
Because a .onion string carries no readable pattern, typing a Torzon address from memory is functionally guessing. Always copy an onion address as text from a source you have verified, never retype it.
Trusting a shortened or "friendly" onion link
Some services offer to wrap a long Torzon onion address in a shorter, memorable redirect. Every layer of redirection is a place an attacker can substitute a different destination; a genuine reference like this one always shows the full, unshortened onion string.
Confusing HTTPS padlock habits with onion verification
Clearnet training teaches "look for the padlock," a habit that does not map cleanly onto Torzon over Tor. Tor Browser does show connection security indicators for onion services, but the padlock habit does not replace comparing the actual address — a well-built clone can also present a technically valid connection to the wrong server.
Assuming an onion link found via search is verified
Search engines index onion-related content, including phishing pages that mention Torzon and other real market names. Appearing in search results is not verification of anything; only a signed canon and a matching PGP fingerprint constitute verification.
Why a Torzon onion link can stop working without being fake
An onion address is not a fixed identity the way a clearnet domain often feels like one. It is derived from a keypair, and a market operator can generate a new keypair and rotate to a new address deliberately — after a suspected compromise, as routine operational hygiene, or simply as a scheduled precaution. When that happens, the old address does not become fake retroactively; it becomes retired, and the correct response is to check this reference or the signed canon for the current one, not to assume the change itself is a red flag.
Rotation versus takedown versus phishing
Three different events produce the same symptom — a link that no longer loads — and they call for different responses. A planned rotation is announced through the signed channel and simply requires picking up the new address. A takedown or extended outage looks the same from outside but has no announced successor, which is why this reference marks status honestly rather than guessing. A phishing clone, by contrast, often loads just fine; the danger is not that it fails to load but that it loads convincingly while being the wrong address entirely.
Frequently asked questions
Can two different onion links point to the same real destination?
Yes — a project like Torzon can run multiple onion services, each with its own address, as failover mirrors. That is exactly the mirror pattern used on this Torzon reference, and it is why every mirror is checked against the same signed list rather than assumed safe on its own.
Does an onion link expire?
Not in the way a subscription or session token does. An onion address stays valid as long as the operator keeps the corresponding key and keeps the service running. Mirrors go offline for operational reasons, which is what the Checking and Dead statuses on this page reflect.
Is a longer onion address more secure than a shorter one?
Modern onion addresses (v3), including every Torzon mirror on this reference, are all the same 56-character length by protocol design — there is no shorter "legacy" format still in legitimate use. Any address of a different length is not a valid current onion address at all.
Why does this page keep pointing back to PGP?
Because the onion address alone answers "which server," not "is this Torzon rather than an impostor." PGP answers the second question. Neither check substitutes for the other, which is the core idea behind every guide on this Torzon reference.
Put it to use
Now that the string makes sense, pull a live one and check it. Read how to access Torzon, run a link through the validator, or learn what PGP adds.