What the string is made of
It looks like noise, so people treat it like noise and check the ends. That habit is the single cheapest thing to exploit in this whole subject, and it costs nothing to break.
- What it is
- Fifty six characters plus
.onion, computed from a public key - Where you meet it
- Everywhere. Lists, messages, search results, your own notes
- What it settles
- Which key can answer there. Nothing else at all
- Cannot tell you
- Who runs it, whether it is honest, or whether it is the one you wanted
The specimen
^ the part people read ^ the part that decides it ^ read second
An address from the published set, spaced out. Cyan marks the eight characters at the front and the four at the back, which is roughly what a person takes in before deciding it looks right. The pale middle is where a forgery differs, and it is the part that gets skipped.
Why the middle is the whole game
Producing an address that starts with four or five characters of your choosing takes minutes on an ordinary laptop. Seven or eight takes days, which is still nothing if the payoff is a login form. Twelve is out of reach, and all fifty six is impossible in any sense that matters.
So the economics decide the shape of every forgery you will ever see. Familiar opening, unfamiliar middle, and often a plausible tail because a few characters at the end are cheap to steer as well.
| What somebody matches | Roughly what it costs them |
|---|---|
| The first four or five characters | Seconds to minutes |
| The first seven or eight | Hours to days, and people do it |
| The first twelve | Not worth anyone time |
| The whole string | Impossible, and everything rests on that |
Characters that can never appear
The encoding uses the letters a to z and the digits 2 to 7. There is no zero, no one, no eight and no nine. If you are looking at something with a 0 or a 1 in it, you are not looking at an onion address at all, and no amount of squinting at the font will change that.
Length, case and the suffix
- Always fifty six characters before the suffix. Anything shorter is from the old sixteen character scheme, which was retired years ago and does not come back.
- Case does not matter. Mixed capitals are formatting, not a different address. Nobody is tricking you with a capital letter.
- The suffix is
.onionand nothing else. Anything that appends a normal domain after it is a gateway, and a gateway reads everything you type. That is its own page in the screens room.
What to do instead of reading it
- Paste both strings into the same empty text box, one under the other, and look at whether they line up. Two identical lines are obvious. Two nearly identical lines are not.
- Or let something tell you they match exactly. Any comparison a machine does beats any comparison you do on the hundredth repetition.
- If you are checking by eye anyway, look at characters twenty through forty. It takes the same second as glancing at the ends and it is the second that counts.
None of this proves the address is the market. It only proves it is the address you meant to open, which is a smaller claim and a necessary one. The bigger claim is settled in the signatures room.