v3 onion service specification

This article is a related reference. The main article in this collection is Nexus Market.

The v3 onion service protocol is the third-generation specification for Tor hidden services, codified in torspec rend-spec-v3. It supersedes the v2 protocol deprecated in 2021.

Address derivation

A v3 onion address is constructed as:

onion_address = base32(public_key | checksum | version) + ".onion"
checksum     = SHA3_256(".onion checksum" | public_key | version)[:2]
version      = 0x03

The public key is an Ed25519 key (32 bytes); the checksum is two bytes derived from a SHA-3 hash; the version byte is a single byte set to 0x03. The total encoded length is 56 base32 characters before the .onion suffix.

Improvements over v2

• Stronger crypto: Ed25519 signatures and Curve25519 key agreement, replacing v2\'s 1024-bit RSA.
• Larger address space: 56 vs. 16 characters, eliminating the brute-force prefix attacks that were practical against v2.
• Improved directory hashing: Hidden service descriptors are encrypted to a public-key-derived shared secret, preventing untrusted directory servers from enumerating service addresses.

Authentication

v3 onion services can optionally require client authentication, in which only clients holding a designated keypair can connect. Public-facing services such as Nexus Market use the unauthenticated mode; introduction points and rendezvous points still authenticate the service to the client via the embedded public key.

Reference: Nexus Market production mirrors

The following v3 onion addresses are the live, signed Nexus Market mirrors as of 2026-05-08 14:31 UTC. Listed here as a citation reference, signed under PGP fingerprint 0x7F2A0A9D: