A link with a token inside it

Session and account

This is a link in which part of the path or the query string is itself the secret, so whoever holds the link holds the credential.

The shape

Structurally it is an ordinary link. What distinguishes it is one segment that carries no meaning to a reader: a long run of characters from a single alphabet, sitting either inside the path or on the right hand side of an equals sign in the query.

The rest of the link behaves normally. The host is the host, the early path segments usually name something readable, and the opaque part is bolted on at the end.

Where the secret sits

either a whole path segment between two slashes, or the value half of one query pair

Path form

a slash, then a run of characters from one alphabet, with no dots and no readable word inside it

Query form

a question mark, a short name, an equals sign, then the opaque run. Further pairs are joined with an ampersand

Run length

long enough to be obviously not a word. Typically well past twenty characters and fixed for a given system

Alphabet

one alphabet throughout, most often letters and digits with no punctuation inside the run

Not part of it

anything after a hash mark. That portion is handled locally and is a different thing entirely

one link, broken across two lines for width;
the break is not part of the link
http://awazonth6ocz5cyos63czmhtsglqr7ydkdcc4lopux7nxbauoo2qmvyd
    .onion/r/exampleexampleexampleexamplexxxx

the same secret as a query value; host line not repeated
    .onion/open?t=exampleexampleexampleexamplexxxx

the tail alone: a readable segment, then an opaque run
    .onion/xxxx/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

A credential written where credentials are not expected

People treat links as public. They are pasted into messages, saved into notes, dropped into chat windows, kept in a browsing history, quoted in a screenshot and read aloud. All of that is reasonable behaviour for an address and unreasonable behaviour for a secret, and a link of this shape is both at once.

That is a format observation with consequences that follow directly from the format. The secret is not stored in a field designed to hold secrets. It is stored in a field designed to be shared, and every mechanism that copies links copies it intact.

The observation is worth making precisely because the shape gives no warning. Nothing about a long path segment announces that it is a credential rather than an identifier, and both look identical to a reader.

Reading the link in two parts

It helps to split the string into the part that identifies and the part that authorises. The host and the early path segments identify: they say what you are asking for. The opaque run authorises: it is the reason the request is granted.

Some links have no authorising part at all. A link that merely carries a path to a page is documented separately at a mirror link that carries a path, and that shape has different problems. The difference is not always obvious from the outside, which is the honest position to hold: an opaque run may be a token, or it may be an identifier that happens to be unreadable.

How to check it by eye

What a wrong shape means

The damage that happens to these links is mechanical. A messaging client turns the visible text into something shorter and keeps the real target underneath, so what you read is not what you would follow. A line wraps in an email and the tail is dropped. A trailing full stop from the end of a sentence gets absorbed into the last segment. A tracking pair is appended after an ampersand by something in the middle.

The wrap is the worst of them, because a truncated token is still a well shaped string. It uses the same alphabet, sits in the same segment, and is merely shorter. If you did not know the expected length you cannot tell.

What a wrong shape does not mean: that the link was forged. Almost everything that mangles links does so while trying to be useful, and the result is indistinguishable from deliberate alteration by inspection alone.

What a correct shape does not prove

A link of this shape is the clearest case on the site of a string that passes every check and settles nothing. Both halves fail you separately. The host half establishes no fact about who operates it, and the token half is unreadable, so there is no fact in it to establish.

• Not that the token is still live. Tokens are ended by a record on the far side and the string is unchanged when that happens.
• Not that it was meant for you. A link that reached you through a forward or a screenshot has exactly the same shape as one that did not.
• Not that it has been used only once, or not at all. Use leaves no mark on the characters.
• Not that the host is what you think. A correct looking address deserves the treatment described at a host built from lookalike characters, and this site does not check or endorse any address.
• Not that the visible text matches the target. In any medium that renders links, the words you read and the destination are separate values.

What this card is not

This card offers no method for producing, extending, replaying or extracting any token, and it describes no way to obtain a link you were not given. It is a description of a format and the risks that follow from the format itself. Encoded characters inside a URL are covered at percent encoding inside a link, plain paths at a mirror link that carries a path, and the equivalent opaque run stored by software rather than written down at a session cookie.