How to host an onion website

Visitors reach an onion website with Tor Browser, at an address that ends in .onion. Tor connects them to your server through the Tor network, so the address never reveals the server's real IP, and your visitors stay anonymous too. All it takes is two programs: Tor and a web server.

What you need

• A Linux server. A small VPS is plenty for a blog, a shop or a forum.
• Root access over SSH.
• Tor Browser on your own computer, to test the site.

Would you rather not run a server yourself? Skip to onion hosting with no setup.

Step 1: install Tor and nginx

On Debian or Ubuntu both are in the normal package lists:

apt update
apt install tor nginx -y

Step 2: make nginx answer only on the inside

The web server must never answer on the server's public address, or anyone who scans the internet could match your onion site to your IP. Remove the default site and add one that listens on localhost only:

rm /etc/nginx/sites-enabled/default
cat > /etc/nginx/sites-available/onion <<'EOF'
server {
    listen 127.0.0.1:8080;
    server_name _;
    root /var/www/onion;
    index index.html;
    server_tokens off;
}
EOF
ln -s /etc/nginx/sites-available/onion /etc/nginx/sites-enabled/onion
mkdir -p /var/www/onion && echo 'Hello from Tor' > /var/www/onion/index.html
nginx -t && systemctl reload nginx

Step 3: create the onion address

Tell Tor to publish the site. Add these two lines to /etc/tor/torrc:

HiddenServiceDir /var/lib/tor/onion/
HiddenServicePort 80 127.0.0.1:8080

Restart Tor and read the address it made for you:

systemctl restart tor
cat /var/lib/tor/onion/hostname

That prints your address: 56 letters and digits followed by .onion. Open it in Tor Browser and the test page appears.

Step 4: back up the keys

The folder /var/lib/tor/onion/ holds the private key behind the address. Whoever has that key owns the address, and if you lose it the address is gone for good. Copy the folder somewhere safe and keep it to yourself.

Step 5: keep the server private

• Load nothing from the open internet: no web fonts, scripts, images or analytics from other sites. Every one of them is a request that can give your visitors away.
• Do not serve the same site on a public domain from the same server.
• Keep server_tokens off and leave version numbers out of error pages.
• Update the system and Tor regularly.

A custom address

Onion addresses are random. Tools such as mkp224o generate keys until the address starts with letters you choose. Every extra letter takes about 32 times longer to find, so six or seven letters is a sensible goal on an ordinary computer.

Onion hosting with no setup

Our Tor hosting does all of the above for you, from $9 a month. Each site gets its own .onion address from the control panel, files and databases sit in the same panel as our web hosting, and the site is never served on a public address. A website on our web or WordPress hosting can also get a free onion address next to its normal domain.

Onion sites follow our acceptable use policy like every other service. Privacy and free speech are welcome.