Victor Schubert’s personal page

Advertising an onion service with Onion-Location

Many websites make themselves available through Tor as hidden services to help users preserve their privacy and circumvent blocks and censorship. A sample follows.

Clearnet domainOnion domain
duckduckgo.com3g2upl4pq6kufc4m.onion
www.torproject.orgexpyuzz4wqqyqhjn.onion
www.propublica.orgpropub3r6espa33w.onion
facebook.comfacebookcorewwwi.onion
keybase.iokeybase5wmilwokqirssclfnsqrjdsi7jdir5wy7y7iu3tanwmtp6oid.onion
protonmail.chprotonirockerxow.onion
schu.beb5ec6jsfe2oyrqlt4od67bw7lyk2v77paixokjoq32xsdilvcuyeh5id.onion

Until recently it has been a challenge to discover the hidden service address for any website. Some advertise their onion service in their footer (Keybase, Protonmail), but it is otherwise usually hard to find out. Thankfully the latest version of the Tor browser (version 9.5) implements the Onion-Location spec. As explained by the Tor Project’s helpful explanation it allows websites to use either an HTTP response header or an HTML meta tag to advertise an onion address for a website. Once set up, visitors who reach the clearnet website will be shown a nice button which redirects them to the onion service. The browser can also be configured to do this always, automatically.

The Tor browser’s address bar, showing a URL from the Tor Project’s website and a bright button reading “.onion available”.

Again, this can be triggered in two ways. Either the HTTP response from the webserver includes the Onion Location header as follows.

Onion-Location: someonionaddress.onion

Alternatively, the same behaviour can be obtained by adding a meta tag in the HTML document itself.

<meta
  http-equiv="onion-location"
  content="someonionaddress.onion">

Of course this is now enabled on this website!