Why Major Sites Maintain .onion Mirrors: Clearnet vs Dark Web Comparison 2026

Major organizations maintain .onion addresses for multiple reasons. Censored country access: a site blocked by national ISPs is accessible via Tor, regardless of the block. NYT's .onion specifically targets readers in countries where New York Times content is blocked. BBC launched its .onion in 2019 specifically to serve Russian, Chinese, and Iranian users who cannot access BBC normally. Metadata protection: using a .onion address means connection metadata (that you accessed the NYT) is not in your ISP's logs. A journalist in a hostile country accessing NYT via the .onion address leaves no record with their ISP. Exit relay elimination: connections to a service's .onion never pass through an exit relay (both client and server connect to the Tor network rendezvous). Exit relay interception is eliminated.

New York Times (nytimes3xbfgragh.onion): specifically created to reach readers in censored countries. NYT's journalism team worked with the Tor Project to set up the mirror. BBC (bbcnewsd73hkzno2.onion): for global access to BBC journalism in censored environments. Facebook (facebookwkhpilnemxj.onion): Facebook's .onion (launched 2014, one of the first major .onion deployments) allows users in countries that block Facebook to access it. ProtonMail (protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion): allows ProtonMail access via Tor without exit relay interception. DuckDuckGo (duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion): private search via Tor with no exit relay. These mirrors use the same content as clearnet counterparts - the .onion provides access and metadata protection, not different content.

When you access example.com via Tor (clearnet), your traffic exits through an exit relay, which makes the final connection to example.com. A malicious exit relay could: modify clearnet HTTP responses (inject malicious content), log your connections, and in theory intercept unencrypted content. When you access example.onion via Tor, there is no exit relay. The connection stays entirely within the Tor network, terminating at the .onion server. The .onion address cryptographically authenticates the server (the address IS the public key), preventing MITM attacks. For HTTPS sites, exit relay risk is already mitigated by TLS. But for HTTP sites or as defense-in-depth for HTTPS sites, .onion access eliminates exit relay concerns entirely.

Connecting to a clearnet site via Tor: 3-hop circuit to exit relay, then clearnet connection from exit relay to destination. Total hops: 4 (including the site itself). Connecting to a .onion site via Tor: 6-hop circuit (3 from client, 3 from server, meeting at rendezvous relay). More hops, but all within the Tor network with no exit relay latency. Performance comparison: .onion connections have higher circuit establishment overhead but eliminate the exit relay's variable latency and geographic distance. For .onion mirrors hosted in well-connected data centers (as major organizations do), performance is typically comparable to or slightly slower than clearnet-via-Tor access. For sites where security is the primary concern (ProtonMail, for example), the .onion provides stronger guarantees that justify any performance difference.

Organizations wanting to provide .onion access to their services: Cloudflare Onion Service: if your site uses Cloudflare, enabling the Onion Routing option in Cloudflare's settings automatically creates a .onion mirror. Cloudflare manages the Tor hidden service configuration. Self-hosted .onion mirror: add a Tor hidden service to your server infrastructure, configure HiddenServicePort to point to your existing web server, and announce the .onion address in your site's footer, About page, and documentation. Onion-Location HTTP header: add this header to your clearnet site's HTTP response to automatically notify Tor Browser users of your .onion mirror (Tor Browser displays a purple button offering to switch to the .onion version). This is the recommended way to advertise .onion mirrors to Tor Browser users.