I'd like to find out the IP address of a given .onion address.

Is it possible for me to simply assign an exit node (that I control) to my client and just monitor it to determine what IP address that exit node uses?

  • If no, what are other solutions in determining what the IP address of the .onion is?

  • If none of this is possible, why is that?

  • A TOR hidden service sits behind multiple relays, just like a client is behind multiple relays. It's similarly difficult to find its IP. You'd essentially learn only the service's exit node's IP, not it's real IP. (There are some subtleties and the terminology is a bit different for hidden services, but this should capture the basic idea) Jun 29 '13 at 19:24
  • 1
    @CodesInChaos So there is an exit node defined for my client, and the HSP adds additional hops to my exit node? Jun 29 '13 at 19:38
  • 1
    Both sides have their own circuit with several hops which they chose themselves, and the two exit nodes (one chosen by client, one by server) talk to each other. (Though they're not called exit-nodes and behave slightly differently from that) Jun 29 '13 at 20:10
  • If you could get the IP address of a Tor hidden service there would be no point in having a Tor hidden service.
    – user253751
    Nov 20 '18 at 21:23

It is not possible to get the IP address of a Tor hidden service.

For a normal Tor circuit, the client knows the IP of the server, but the server does not know the IP of the client.

The idea behind hidden services is that when both a client and a server are Tor-enabled, it's possible to build Tor circuits in both directions and hide both the client and server IP (by using intermediate nodes).

The protocol


  • The hidden service picks N introduction points, builds a Tor circuit to each, and communicates its public key
  • The hidden service advertises these introduction points and its public key


  • The client chooses an entirely new relay called a "rendezvous point", builds a Tor circuit to it, and tells it a newly-generated one-time secret
  • The client contacts an advertised introduction point over a Tor circuit and tells it the rendezvous point's IP and the one-time secret, encrypted by the hidden service's public key
  • The introduction point relays this encrypted rendezvous point and one-time secret to the hidden service over the existing Tor circuit
  • The hidden service decrypts this data, builds a Tor circuit to the rendezvous point, and tells it the one-time secret
  • The rendezvous point now relays information between these two Tor circuits


This is what IPs each actor knows after this process:

  • The hidden service knows the IPs of its introduction points
  • The client knows the IPs of the hidden service's introduction points
  • The client knows the IP of the rendezvous point
  • The hidden service knows the IP of the rendezvous point

Essentially, at no point is a Tor circuit built directly to the hidden service, the hidden service always builds its circuits outwards. Therefore, its IP is never revealed.

References: a high-level description of the protocol can be found in Tor: Hidden Service Protocol, while a more detailed description can be found in the original design paper Tor: The Second-Generation Onion Router.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.