The current onion address is a run of 56 characters followed by .onion, and it is the only shape on this site that has exactly one length, no punctuation inside it, and a fixed ending.
The shape
Four properties do all the work, and they are the four a reader actually uses. The address is one length and only that length. It contains no separators of any kind between its first and last character. It is written in lower case in normal use. It finishes with a suffix that never changes. Hold those four in mind and you can pick the shape out of a paragraph without reading a single character of it closely.
The alphabet is base32 in its lower case form: the twenty six letters plus a short run of digits that starts at two and stops at seven. Everything outside that run is unavailable, which quietly removes several characters people expect to see in a long identifier. The character class in full, with the three other alphabets used on this site, is on the alphabets page, and repeating it here would only give you a second copy to disagree with.
- Total width
- 56 characters, then a dot, then
onion - Alphabet
- the letters
atozplus the digits2through7 - Case
- insensitive in use, lower case by convention
- Separators
- none inside the 56 characters; no hyphen, no underscore, no dot
- Suffix
- exactly one dot, then the four letters of
onion - Internal structure
- none you can see; no fields, no groups, no version prefix
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.onion
fifty six x characters, one dot, then the word onionx stands for one character of the base32 alphabet.awazonth6ocz5cyos63czmhtsglqr7ydkdcc4lopux7nxbauoo2qmvyd.onion
one of the three strings printed above every page hereTelling it apart from the other long strings
This reference documents a dozen long opaque strings, and in running text they all look like a smear of characters. Recognition is therefore a practical skill, and it is faster than any check. Each of the others breaks at least one of the four properties above, usually in a way you can see from across the room.
| You may be looking at | What gives it away |
|---|---|
| A file hash | hex only, so no letter later than f, and no suffix at the end |
| A Bitcoin address in the older alphabet | mixed case, and visibly shorter than a full address line |
| A key fingerprint | upper case, and usually broken into spaced groups |
| A session token | tends to carry a hyphen, an underscore or a dot inside it |
| A seed phrase | ordinary words with spaces between them |
The comparison runs the other way too. If a string is uniform lower case, unbroken, and tailed with .onion, there is nothing else on this site it could be. That is a claim about which card to read next, and about nothing else at all.
How to check it by eye
Recognising the address without a tool
- Look at the end. The suffix
.onionmust be there, preceded by exactly one dot and no other. - Sweep the middle for punctuation. A hyphen, an underscore, a slash or a second dot means you are holding two things that have run together, not one address.
- Sweep again for digits outside the range two to seven. Anything below or above that run puts the string outside the alphabet.
- Look at the case. Capitals are legal but unusual, and in practice they mean some piece of software reformatted the line rather than that the address is odd.
- Count the width in blocks of ten with the method on counting by eye: five full blocks and six left over.
What a wrong shape means
A malformed address is nearly always damage in transit. Line wrapping in a message that split the run in half, a selection that started one place late and dropped a character, a screenshot the reader had to retype, an address quoted inside a sentence that took the closing bracket along with it. These causes are dull, and they are the common ones.
A broken string also carries a small piece of good news. The address has an internal check built into it, which is why a mistyped character usually produces something that goes nowhere at all rather than something that quietly goes somewhere else. The failure is loud instead of silent. That protection covers slips of the finger. It does nothing whatever about an entire address that was replaced by another entire address, since the replacement arrives with its own check intact.
Intent is the one thing malformation does not indicate. There is no advantage in handing anybody a string that cannot resolve. Treat a broken address as evidence about the channel it came through, and go back to that channel rather than reading motive into it.
Right shape
awazonth6ocz5cyos63czmhtsglqr7ydkdcc4lopux7nxbauoo2qmvyd
one unbroken run, every character inside the alphabetWrong shape
awazonth6ocz5cyos63czmht-sglqr7ydkdcc4lopux7nxbauoo2qmvyd
the same string with a hyphen pushed into the middleThe wrong version is the published string above with one hyphen inserted, shown mutated on purpose so the illegal character sits in a real position rather than being described in the abstract. Hyphens are ordinary in domain names generally, which is why the eye slides over one here.
What a correct shape does not prove
Suppose the string in front of you passes everything above. All of the following stay open, and none of them can be settled by looking harder at the characters.
- Who holds the private key. The address is derived from a public key, the matching private half could be in anyone at all, and the address reads the same either way.
- Whether the service behind it is the market. An address names whatever answers to it, and an opening sequence that spells a familiar word can be produced by anybody who wants one.
- Whether anything is running. An address for a service switched off long ago is still correctly shaped, and the shape has no way to say otherwise.
- Whether the person who passed it to you passed on what they received. Substitution swaps one valid string for another valid string and leaves no mark in the format.
- Whether it is current. Services change addresses, and there is no date anywhere inside those 56 characters.
The internal check ties the address only to itself. It is a consistency test, not a provenance test, and consistency has never had anything to say about where a string came from.
What this card is not
The subject here is one bare address with nothing attached to it. A scheme in front and a path behind make a different shape with different traps, documented on the mirror link card. The older and shorter form has its own card. Deliberate imitation is weighed on the lookalike host card, which is where the imitation tricks are sorted into the ones that are possible here and the ones that are not. Reachability is out of scope on every page of this site, for the reason set out on the thesis page.
Questions people send about this shape
Does upper case change the address?
No. The address is case insensitive, so a string typed in capitals refers to the same service as the same string in lower case. Lower case is used everywhere by convention. A mixed case address usually means some piece of software reformatted the line, for instance a mail client applying sentence case to text it treated as prose, rather than the address itself being unusual.
Why is 56 the only length worth remembering?
Because the format has one width and no options. There is no short variant for a small service and no extended variant for a large one, so width alone separates a current address from most other strings you will be handed. Counting is still the slowest of the checks on this card, which is why it comes last in the eye procedure rather than first.