Victor Schubert’s personal page

Advertising an onion service with Onion-Location

Many websites make themselves available through Tor as hidden services to help users preserve their privacy and circumvent blocks and censorship. A sample follows.

Clearnet domain Onion domain
duckduckgo.com 3g2upl4pq6kufc4m.onion
www.torproject.org expyuzz4wqqyqhjn.onion
www.propublica.org propub3r6espa33w.onion
facebook.com facebookcorewwwi.onion
keybase.io keybase5wmilwokqirssclfnsqrjdsi7jdir5wy7y7iu3tanwmtp6oid.onion
protonmail.ch protonirockerxow.onion
schu.be b5ec6jsfe2oyrqlt4od67bw7lyk2v77paixokjoq32xsdilvcuyeh5id.onion

Until recently it has been a challenge to discover the hidden service address for any website. Some advertise their onion service in their footer (Keybase, Protonmail), but it is otherwise usually hard to find out. Thankfully the latest version of the Tor browser (version 9.5) implements the Onion-Location spec. As explained by the Tor Project’s helpful explanation it allows websites to use either an HTTP response header or an HTML meta tag to advertise an onion address for a website. Once set up, visitors who reach the clearnet website will be shown a nice button which redirects them to the onion service. The browser can also be configured to do this always, automatically.

The Tor browser’s address bar,
showing a URL from the Tor Project’s website and a bright button reading
“.onion available”.

Again, this can be triggered in two ways. Either the HTTP response from the webserver includes the Onion Location header as follows.

Onion-Location: someonionaddress.onion

Alternatively, the same behaviour can be obtained by adding a meta tag in the HTML document itself.

<meta
  http-equiv="onion-location"
  content="someonionaddress.onion">

Of course this is now enabled on this website!