Tor Links 2.2 and V3 Onion Addresses: What Changed and Why It Matters

Tor links 2.2, also called v2 onion addresses, were the standard format for hidden services from Tor's early years until 2020. These addresses were 16 characters long and looked like random letters and numbers followed by .onion, for example: thehiddenwiki.onion (a real historical example). The "2.2" designation refers to the Tor protocol version that generated them.

V2 addresses used 80-bit encryption, which was considered secure at the time but became vulnerable to theoretical attacks as computing power increased. The Tor Project documented that v2 addresses could be enumerated and attacked through brute-force methods, meaning someone with enough resources could potentially generate many addresses and look for matches. This weakness was not a flaw in Tor itself but rather a limitation of the address space and cryptographic approach.

Starting in 2017, the Tor Project began rolling out v3 onion addresses, which are 56 characters long and use 256-bit encryption. These tor v3 links represent a major security improvement: they are far more resistant to enumeration attacks and provide better protection against certain types of cryptographic compromise. By 2020, the Tor Project deprecated v2 addresses entirely, meaning they no longer work reliably.

The transition was gradual because many hidden services and users were still relying on v2 addresses. Some services migrated to v3, while others simply went offline. This created confusion in the darknet ecosystem: users bookmarked old v2 links that no longer functioned, and scammers created v3 clones of popular services to phish for users who were searching for the old addresses. Understanding this history helps you recognize why you might encounter dead links or suspicious mirrors when searching for tor directory links.

A real v3 onion address is always 56 characters long, contains only lowercase letters and numbers 2-7, and ends with .onion. The format is strict: if an address is shorter, longer, or contains characters outside that range, it is not a valid v3 address. Many phishing sites use addresses that look similar to legitimate ones, relying on the fact that most people cannot memorize a 56-character string.

The safest way to verify an address is to check the official announcement from the service itself. Legitimate projects publish their onion addresses on their main websites (accessed over HTTPS), in PGP-signed statements, or through their social media accounts. Never copy an onion address from a search result, a forum post, or a third-party directory without cross-checking it against the official source. This is especially important for services that handle sensitive information or transactions.

The Tor Project set a hard deadline for v2 address support and removed it from the Tor browser in version 9.5 (released in 2020). This means that even if you try to access an old v2 address today, your Tor browser will not connect to it. The decision was made for security reasons: keeping v2 support in the code created unnecessary attack surface, and maintaining two parallel systems was a burden on developers.

Some services tried to keep v2 addresses alive by running them on private Tor instances or through workarounds, but these are not reliable and may expose users to additional risks. If you encounter a service claiming to offer a v2 address, treat it with skepticism. The legitimate move for any serious hidden service was to migrate to v3, and most did. Understanding this helps you recognize when a link you found is genuinely outdated versus when it might be a scam or phishing attempt.

The Tor Project's official documentation on onion services confirms that v2 addresses are no longer supported and that v3 provides significantly stronger cryptographic guarantees. This matters because it means any v2 link you find is either historical (no longer in use) or being served by a non-standard setup that may not have received security updates.

Law enforcement agencies have used the transition period to identify and take down services that did not migrate. Some markets and forums that relied on v2 addresses simply disappeared rather than upgrade, often because they were already under investigation or because their operators abandoned them. Security researchers have documented numerous phishing campaigns that exploited user confusion during the v2-to-v3 transition, creating fake v3 addresses that mimicked popular services. This matters to you because it shows that the technical upgrade was necessary, but it also created a window of vulnerability for social engineering attacks. Always verify an address independently before trusting it with your data or identity.

You may see references to tor topic links 2.0 or tor directory links in older guides and forums. These are not official Tor Project terminology; they refer to informal collections of onion addresses that users compiled and shared. Many of these directories became outdated when v2 addresses stopped working, and some were never updated. A directory that lists mostly v2 addresses is a sign that it has not been maintained and should not be trusted as a current reference.

If you are looking for a list of legitimate hidden services, the safest approach is to search for specific services by name and verify their official onion address through their primary website or PGP-signed announcement. Do not rely on a single directory or aggregator. The decentralized nature of Tor means there is no single authoritative list of services, and this is actually a feature: it prevents any one point of failure or censorship. Treat any directory as a starting point for research, not as a source of truth.

When you need to access a hidden service, follow this approach:

1. Start with the official website of the service (accessed over regular HTTPS) and look for an onion address link or announcement.
2. If the service publishes a PGP-signed statement, verify the signature using the service's public key.
3. Check that the address is 56 characters long and contains only lowercase letters and numbers 2-7.
4. Bookmark the address in your browser or write it down in a secure location.
5. Before each visit, verify that the address has not changed by checking the official source again.
6. If you encounter an address that looks similar to one you know but is slightly different, do not use it; this is a common phishing technique.

These steps take a few minutes but protect you from the most common attacks. The cost of verifying an address once is far lower than the cost of compromising your anonymity or losing data to a phishing clone.

The shift from v2 to v3 onion addresses is complete, and any service still using v2 is either abandoned or operating outside the standard Tor ecosystem. If you have old bookmarks or notes with v2 addresses, you can safely delete them. When you need to access a hidden service, use the verification process outlined above: official source first, PGP signature if available, address format check, and bookmark for future use.

Understanding the difference between tor links 2.2 and v3 addresses also helps you recognize when someone is trying to deceive you. Scammers often rely on user confusion about which addresses are current and which are outdated. By knowing that v2 is obsolete and v3 is the standard, you can immediately dismiss any service claiming to offer a v2 address as either a phishing attempt or a sign of poor security practices. Start today by checking one service you use regularly: find its official website, locate its v3 onion address, and verify it matches what you have bookmarked.