How to read an onion address
A v3 address is not a name, it is a key. That distinction explains most of what is confusing about them.
Onion addresses look like nonsense, and readers treat them as nonsense to be copied rather than as something with structure. They do have structure, and knowing it changes how you check one.
It is a public key
A v3 onion address is fifty six characters of base32 followed by the suffix. Those characters are not assigned by anyone. They are a derivation of an Ed25519 public key, plus a checksum and a version byte. Nobody hands them out and nobody can take one away, because holding the address means holding the matching private key.
That has a consequence people find surprising. There is no registrar to complain to, no dispute process, and equally no authority that can seize an address the way a domain can be seized. The address is the key. Whoever has the key has the address, and nobody else can serve traffic at it.
Which is why forgery works the way it does
Because an address cannot be stolen, attackers do not try. They generate their own address that resembles the target. Vanity generation lets someone brute force a chosen prefix, so producing an address that starts with the same recognisable few characters is cheap. Matching the whole thing is not feasible, and matching the middle is not worth the compute.
So the forgery is always the same shape. Familiar opening characters, familiar ending if they bothered, and a middle that differs. Readers check the start, recognise it, and stop. The entire attack lives in the region people skip.
Checking one properly
- Compare the middle, not the ends. If you are going to spot check rather than compare the whole string, spot check characters twenty through forty, because that is where a forgery differs.
- Better, do not compare by eye at all. Paste both strings somewhere that will tell you whether they are identical.
- Best, do not rely on comparison. Verify the signature at the destination, which establishes what the address is regardless of what it looks like.
- Be aware that base32 has no visually confusable pairs by design, so an address that looks slightly off genuinely is off. This is not a font problem.
What the address does not tell you
Nothing about who runs it, where it is, or whether it is safe. An address is an identifier and identifiers carry no reputation. Two addresses that look equally random may be a market and a clone of it, and there is no property of the strings themselves that distinguishes them.
This is the part that trips up people arriving from clearnet habits, where a domain name carries at least some information about who registered it and a certificate carries a little more. Onion addresses carry exactly one claim, which is that whoever answers holds the key. Everything else you want to know has to come from a signature.
Verified working Nexus Market mirrors
Three v3 onion addresses currently serving the production market, signed under PGP fingerprint 0x7F2A0A9D. Use the Copy buttons.