It's possible for Tor exit nodes to sniff traffic on normal websites, unless you connect via SSL/HTTPS. But what about hidden services, they don't seem to support the HTTPS protocol.

Can the exit node sniff/modify the traffic?

  • related: tor.stackexchange.com
    – strugee
    Feb 13, 2014 at 17:11

3 Answers 3


Tor exit nodes aren't involved in the connection to hidden services. Exit nodes are only needed when you want to exit the Tor network in order to connect to some website outside of it. In the case of connecting to hidden services, all the traffic stays inside the Tor network.

In the following illustration, you can see how Bob (a normal user) is trying to connect to Alice (hosting a hidden service). As you can see, the connection happens through a Rendezvous point (RP) inside the Tor network.

tor hidden
[image from torproject.org]

All traffic inside the Tor network are encrypted and secured with TLS tunnels.

  • 2
    If it helps to think of it another way, TOR traffic is encrypted and a TOR service is basically a particular exit node that actually also hosts the site, so your traffic gets directed to the node that has the site running on it and is protected by TOR the whole way. Feb 13, 2014 at 16:05
  • 1
    You should maybe mention that the green arrows in the above diagram don't represent direct connections but full-fledged TOR circuits. That means the RP doesn't know the IP of Bob or Alice.
    – Philipp
    Feb 13, 2014 at 16:18
  • @Philipp I didn't mention it because it's right there in the illustration legend. I assumed if people aren't gonna read what is written in the shiny nice picture, they probably wouldn't read what is in the boring text of my answer.
    – Adi
    Feb 13, 2014 at 16:36

Yes, it is.

A Tor hidden service deposits its public key in the distributed hash table of the Tor network and on several random nodes ("introductory points") all over the Tor network. When a client wants to connect to a hidden service, the first thing it does is to get that public key so it can encrypt the request to the hidden service.

That means hidden services don't need HTTPS, because the Tor hidden service protocol already provides end-to-end encryption. The public key infrastructure of the Tor network is even more secure than HTTPS, because it doesn't rely on public certificate authorities which can be compromised.

In fact, getting a certificate from a CA would make it quite pointless to have a hidden service in the first place. The purpose of a TLS certificate signed by a CA is to prove your identity. The purpose of a hidden service is to conceal your identity. When you don't want anonymity for yourself and only for your users, then set up a webserver on a non-onion domain, get a TLS certificate, and only allow connections from Tor exit nodes. That would also have a much better performance, by the way.

More information about the Tor hidden service protocol.


Yes. By consequence, there is no need for TLS , STARTLS, SSL when connecting to an *****.onion mailserver (like the bitmessage gateway and onionmail). However, onionmail for some odd reason still uses STARTLS. Also, Thunderbird with Torbirdy displays such a mailserver connection as "insecure and dangerous" because Thunderbird is unaware of .onion business and misinforms the user.

This adds to the confusion resulting in the OP's question.

  • Reading the question, then reading your answer, your answer doesn't really answer the question asked. It's more of a side-comment. You'll be able to use the comment feature once you've reached 50 reputation. Your answer contains good information, but maybe you could edit it to also include a direct answer to the question about exit nodes and sniffing? Dec 8, 2015 at 18:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .