The CIA has an .onion site, as has the BBC, and ProPublica has had one since January 2016. In fact it is older than most of the websites that currently appear on the “top dark web links 2026” listicles vying for that keyword.
The entire problem regarding the way the dark web is reported comes from the gap between reputation and reality. If you search for onion links you will find scraped directories, half of which are dead and the other half of which have been populated with phishing clones. Yet the .onion addresses that have the longest period of uptime and the most clear indication of ownership are those of newsrooms, a Linux distribution, and a few email providers.
Here are eight examples of them. I am intentionally not including the actual addresses, and there is a good reason for that.
Table of Contents
Why This List Has No Onion Addresses in It
A version 3 onion address consists of 56 characters which look random. No one remembers such an address and neither does anyone check it by looking at it. If you swap four characters in the middle of that string then the reader will paste it without hesitation.
That’s precisely the method used in onion phishing: clone the website, create a vanity address with the same prefix, buy some listings in link directories, and then wait. Newsrooms and privacy tools are especially targeted since their visitors are the ones who have something to lose.
That is the rule to follow in the case of this list, and in fact the rule when dealing with any list: obtain the address from the organization which owns it. Each of the services listed publishes its own .onion address on its own clearnet website. The only chain of custody worth trusting is that one, and it requires about fifteen seconds per site.
The scale is in fact smaller than the headlines indicate. According to the Tor Project’s own metrics portal, the number of daily direct users is in the low millions, and only a small portion of that traffic relates to onion services; most of it goes to the regular web. If you want the actual darknet stats rather than the ones that have been reused, then that portal is the main source that everyone else is citing.
1. The Tor Project
Begin with this item since all the other entries on the list are based on it.
The onion service that the Tor Project operates is for its own website, including the page where the Tor Browser can be downloaded. At first this seems circular, and indeed it is, but it is important in situations where a user’s Internet service provider blocks the clearnet domain. In such countries users access the project via mirrors or bridges, and the onion service provides them with a means of verifying that they are receiving the actual software and not a recompiled version that contains additional material.
The project also provides onion services for its support portal, its documentation, and its metrics site.
2. DuckDuckGo
DuckDuckGo has run an onion service for years and it is set up as the default search engine in Tor Browser. It’s worth knowing what it actually does: it searches the regular web, not onion sites. It does this without using an exit node, which eliminates one of the more realistic attack surfaces in a Tor session.
If you thought it was going to index hidden services, you’ll be let down. That is a separate tool.
3. Ahmia
Ahmia is probably the most responsible of all onion search engines since it is a public and open-source project which indexes hidden services and filters out abusive material, thereby placing it in a category different from that of the crawlers which scrape everything.
It is available on the clearnet as well as through an onion address, and the source code can be found on GitHub. The exact details of what it collects can be read. The coverage is only partial for deliberate reasons, since onion services can only be discovered if someone submits them or provides a link to them, but partial coverage with accountability is better than having comprehensive and anonymous coverage.
4. ProPublica
It was the first major newsroom to introduce an onion service, doing so in January 2016. The reason given was that readers of investigative journalism on surveillance should not have their reading habits observable by the organizations being investigated.
The site of ProPublica is complete, not a simplified tip page, and includes the entire archive.
5. BBC News
In October 2019 the BBC started up its Tor mirror for people in countries where BBC News is blocked, giving the examples of China, Iran and Vietnam at that time. The onion site provides the international edition, which includes BBC Persian, BBC Arabic and BBC Russian.
The BBC was clear about one drawback: since it comes under the constraints of broadcasting rights, UK-only services such as iPlayer are not available through it. For this reason it is merely a news mirror and not a full BBC.
6. SecureDrop
SecureDrop is not a single website; it is a system for submitting whistleblower information which is maintained by the Freedom of the Press Foundation, and many newsrooms operate their own instances using their own onion addresses. The Guardian, the Washington Post, and the New York Times are some of the newsrooms that do so.
What is interesting is the architecture: the sources submit their information via Tor, the journalists take the documents onto a machine that is isolated from the internet, and the system is designed in such a way that the newsroom cannot identify the source even if it is served with a subpoena. Each organization lists the address of its instance on its own website, typically on a page named “tips” or “contact us securely”.
When it comes to writing on the infrastructure of press freedom, you need to understand this one.
7. Proton Mail
Proton provides an official onion service for its encrypted email service so that people in those jurisdictions, where the clearnet domain is blocked or where it is itself risky to connect to a known privacy service, can use it.
Once again the same caution applies: an onion address guards the connection, not the account. If you log in to an account that can be identified while using Tor, the service will know who you are regardless of the way you reached it.
8. Debian
The most unattractive option and perhaps the most useful one is Debian, since it provides onion services for its package repositories, its website, and its infrastructure, enabling you to carry out system updates over Tor.
The fact that this is the case isn’t due to paranoia regarding the contents of the packages, since package signatures already provide for integrity. The reason is metadata: the traffic generated when you carry out updates shows which distribution you are using, which packages you have installed, and which security patches you have not applied. That gives anyone monitoring the network a fairly good profile of the machine.
Tails and Qubes OS have similar infrastructure for the same reason.
Also Worth Bookmarking
When The New York Times set up an onion service in 2017, it did so for the same reason as ProPublica. Both Deutsche Welle and Radio Free Europe operate mirrors for censored areas. The CIA’s onion site, which was launched in 2019, is mainly there so that potential sources can get in touch with the agency without their traffic being noticeable.
Many mirrors don’t survive. Twitter’s onion service went dark in 2023 when the company allowed its certificate to expire and then never renewed it, which is a reasonable reminder that such services require ongoing maintenance in order to remain operational.
How to Verify an Address Yourself
Four checks, none of which take long:
Search for the Onion-Location. A website offering an onion service can indicate this using an HTTP header. The Tor Browser detects this and displays a “.onion available” button in the address bar. When you’re on a clearnet site and this button shows up, then you have the correct address directly from the source.
Check the organization’s own pages. Newsrooms publish theirs on a security or tips page, and software projects include them in the documentation.
Count the characters. The current v3 addresses consist of 56 characters together with the .onion suffix; any address that is shorter than this is a dead v2 address from before 2021, v2 having been deprecated many years ago. If a 16-character address appears in a “2026 updated list” then that means the list had not been updated.
View directories as a starting point rather than as a solution. Even reputable ones such as Ahmia can only inform you that an address exists. They cannot tell you that it is the one the organization actually runs.
What is interesting about this list isn’t the fact that these services are available. It is that they are dull. A Linux distribution providing package updates, a broadcaster offering news in Persian, a nonprofit newsroom providing access to its archive. That is essentially what the legitimate part of the onion web looks like when you stop reading the listicles.
READ ALSO: How to Find Updated Website Addresses More Efficiently
