A .onion address looks like a normal website address, but almost nothing about how it works matches a regular website. There is no domain registrar, no DNS lookup, and no certificate authority involved anywhere in the process. Once you understand what replaced each of those pieces, the whole system makes a lot more sense.
No Domain Registrar, No DNS
To get a regular website address, someone buys a domain from a registrar, and DNS resolves that name to an IP address every time a visitor types it in. An onion address skips all of that. The address is generated locally by the operator’s own software from a cryptographic key pair. Nobody registers it, nobody can buy the exact same address someone else already has, and there is no central authority anywhere that could revoke, transfer, or reassign it.
The Address Is the Public Key
A modern v3 onion address is 56 characters of base32 text that encodes a 32-byte Ed25519 public key, plus a checksum and a version byte. That is a technical way of saying the address is not a label pointing at a key somewhere else the way a domain name points at a changeable IP. The address literally is the key. A regular domain can be redirected to a new server without changing its name at all; an onion address cannot be separated from the identity it represents.
No Certificate Authority Needed
A regular HTTPS site needs a certificate signed by a certificate authority to prove that the domain and the key behind it actually belong together. Onion services do not need that extra step, because the binding is already built into the address itself. Anyone who has the address can cryptographically verify that a response was signed by the matching private key, with no outside authority involved at all. In Tor’s own terminology this is called a self-authenticating name, and it is the whole reason onion sites can skip a piece of infrastructure that the rest of the web depends on.
What Still Works the Same
Once a connection is actually established, none of this weirdness carries over. The onion service still speaks ordinary HTTP or HTTPS underneath, still runs standard web server software, and still renders regular HTML, CSS, and JavaScript in your browser. Every difference described here is about how you find the service and confirm you are talking to the real one, not about how the site itself is built. That is also why checking a verified list of onion sites before you connect matters so much: once the connection opens, everything looks and feels like an ordinary page.
Tags: #onion sites #tor