I am doing research about the dark web. However I find it hard to understand how Tor hidden services work. The whole point of it is to actually anonymize the server from the client so that the client does not know where the server is located. I understand how this is achieved by using the hash table and the onion address however I got a couple of questions:

  1. Does the first node in the circuit connecting the hidden service to the introduction point know the server's IP address? If so, can't someone just sniff the channel between them and know where the server is located?

  2. If the client sends a message to the hidden service, is it technically sending the message to the rendezvous point and then the rendezvous point forwards it to the server? Doesn't the rendezvous point in this case know the hidden service's IP address?

  • See 2019.www.torproject.org/docs/onion-services for a good explanation of the process, particularly While the introduction points and others are told the onion service's identity (public key), we don't want them to learn about the onion server's location (IP address).
    – mti2935
    Commented May 10, 2023 at 15:05

1 Answer 1


As to 1)

When the Onion Service sets up a circuit to an introduction point, the first relay just forwards encrypted data from one IP address to another IP address like with any other circuit. It doesn't know what the data is, and it doesn't know that the host behind the first IP address runs an Onion service and wants to connect to an introduction point. So even if an attacker could intercept the traffic to the first relay, that wouldn't tell them anything beyond “two hosts are communicating”. Besides that, since the traffic is TLS-encrypted, an attacker cannot “just sniff” it.

As to 2)

The data exchanged between client and Onion Service is end-to-end-encrypted, so it's meaningless for all relays in between, including the rendezvous point. The rendezvous point also doesn't have a direct connection to the service. It relays the encrypted data over a Tor circuit to the Onion Service, so it neither knows the IP address of the service nor that there even is an Onion Service behind that IP address.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .