[Home](https://servprivacy.com/) / [Privacy Hosting Guides](https://servprivacy.com/guides) / How to Host a Tor Hidden Service (.onion Site) — 2026 Guide Operations # How to Host a Tor Hidden Service A complete walkthrough for running a Tor hidden service — what an onion service is and why it is the strongest anonymous hosting there is, the setup from install to a live .onion address, and the discipline that keeps it anonymous. [Read the guide](#guide-body) [FAQ](#guide-faq) #### On this page - [Guide](#guide-body) - [FAQ](#guide-faq) - [Related guides](#guide-related) - [Recommended pages](#guide-cta) No KYC Crypto Only No Logs DMCA Ignored Full Root NVMe SSD 7 min read Updated May 2026 On this page [01What a Tor hidden service is](#what-a-tor-hidden-service-is) [02Why host a hidden service](#why-host-a-hidden-service) [03What you need](#what-you-need) [04Step 1 — Set up the server and a web service](#step-1-set-up-the-server-and-a-web-service) [05Step 2 — Install Tor and configure the onion service](#step-2-install-tor-and-configure-the-onion-service) [06Step 3 — Get your .onion address and test it](#step-3-get-your-onion-address-and-test-it) [07Step 4 — Lock it down so it stays anonymous](#step-4-lock-it-down-so-it-stays-anonymous) [08Hidden service, clearnet, or both](#hidden-service-clearnet-or-both) [FAQCommon questions](#guide-faq) [→Recommended pages](#guide-cta) ## What a Tor hidden service is A Tor hidden service — also called an onion service — is a website or application that is reachable only through the Tor network, at an address ending in .onion. Unlike an ordinary website, it has no public IP address and is not listed in DNS. Visitors reach it through Tor, and the connection between visitor and server is routed so that neither end learns the other's location or IP. This is a different and stronger model than putting a normal website behind privacy measures. With an onion service the anonymity is built into the protocol: the server's location is hidden by design, not by configuration you might get wrong. There is no IP address to leak, no DNS record to subpoena, and no hosting IP for anyone to scan or attack. The address itself is derived from a cryptographic key, so it cannot be spoofed. It is, in a real sense, the strongest form of anonymous hosting available. An onion service has no public IP and no DNS record — its location is hidden by the protocol itself, not by configuration. ## Why host a hidden service Onion services are used by a wide range of legitimate operators: news organisations running secure tip lines, the SecureDrop submission systems journalists rely on, privacy-focused projects offering a censorship-resistant mirror, messaging and file-sharing tools, and individuals who simply want a site whose server location nobody can determine. Major organisations — from large newspapers to well-known software projects — run onion services precisely because they are robust. The reasons come down to three properties. **Location privacy:** the server cannot be found by IP, so it cannot be geolocated, scanned or directly attacked. **Censorship resistance:** there is no IP or domain for a network to block, so the service stays reachable where ordinary sites are filtered. **End-to-end encryption:** Tor's protocol encrypts the connection by default, with no certificate authority involved. If any of those matter to your project, a hidden service is worth running — and this guide builds one. ## What you need The requirements are modest: - **A VPS.** An onion service is lightweight; a small plan is enough. Choosing a no-KYC, offshore VPS matters here for a specific reason explained below — the anonymity of the service depends partly on the anonymity of the server itself. - **A fresh Linux install** — Debian or Ubuntu for the commands here. - **The Tor Browser** on your own machine, to reach and test the finished service. You do not need a domain name — the .onion address is generated for you — and you do not need a TLS certificate, because Tor provides the encryption. ## Step 1 — Set up the server and a web service Provision the VPS and connect over SSH. Install whatever will serve your content — for a simple site, a lightweight web server such as nginx, installed with apt install -y nginx, is ideal. The important configuration detail: bind the web server to localhost only. The web service should listen on 127.0.0.1, not on the server's public IP. Tor will connect to it locally; nothing should reach it directly from the internet. Binding to localhost means that even though the box has a public IP, the website itself is not served on it — only Tor can reach the content. Confirm the site works locally with a quick curl 127.0.0.1 before moving on. ## Step 2 — Install Tor and configure the onion service Install Tor itself with apt install -y tor. Then edit Tor's configuration file, /etc/tor/torrc, to define the hidden service. Two lines do it: a HiddenServiceDir pointing to a directory where Tor will store the service's keys, and a HiddenServicePort mapping the virtual port 80 to your local web server — for example HiddenServicePort 80 127.0.0.1:80. Restart Tor with systemctl restart tor. On first start, Tor generates the service's cryptographic key pair in the directory you specified and derives the .onion address from it. That directory now holds the identity of your service — back it up securely and keep it readable only by the Tor user. Anyone who has those keys can impersonate your service; lose them and the address is gone forever. ## Step 3 — Get your .onion address and test it Tor writes the address into a file called hostname inside the HiddenServiceDir. Read it with cat and you will see a 56-character address ending in .onion — that is the public address of your service. Open the Tor Browser on your own computer, paste the address and load it. Your localhost-only web service should appear, served entirely through Tor. The first connection can take a few seconds while Tor builds the circuit. That is it — the service is live, reachable by anyone with Tor, and its server location is hidden from every visitor. ## Step 4 — Lock it down so it stays anonymous A working onion service is not automatically an anonymous one. The protocol hides the server's location from visitors — but several mistakes can undo that. The discipline that keeps it anonymous: - **Bind everything to localhost.** Re-check that the web server, and any database or backend, listen only on 127.0.0.1. A service accidentally exposed on the public IP can be matched to the onion site and deanonymise it. - **Strip identifying content.** Server banners, default error pages, analytics scripts, and metadata in files can all leak the real server or tie it to other sites. Audit what the service actually sends. - **Administer it anonymously.** Reach the server for administration over Tor as well — never SSH to it directly from your home IP. The onion service hides the server; do not undo that with your own connection. - **Keep the server itself anonymous.** This is why the no-KYC, offshore VPS matters: if the service is ever correlated to its host despite your precautions, the host should be a provider that holds no identity for the account and keeps no logs. The hidden service and the anonymous server reinforce each other. - **Disable anything that phones home.** Software that makes outbound connections — update pingbacks, external fonts, third-party APIs — can leak the server. Keep the service self-contained. ## Hidden service, clearnet, or both You do not have to choose exclusively. There are three sensible setups. A **hidden-service-only** site is the most private — no clearnet footprint at all, ideal for a tip line or a service that must not be locatable. A **clearnet site with an onion mirror** serves an ordinary audience normally while offering a censorship-resistant, private route for those who want it — this is what large news organisations do. And a **clearnet-only** site, covered in our guide on hosting a website anonymously, is simpler when location privacy at the protocol level is not required. For the strongest anonymity, hidden-service-only on a no-KYC offshore VPS is the answer: the server has no identity attached, the service has no IP to find, and the whole thing is reachable by anyone with Tor and locatable by no one. Set up with the discipline above, it is genuinely anonymous hosting — not as a marketing claim, but as a property of the protocol. FAQ ## Tor hidden services — common questions ### 01 What is a Tor hidden service? A Tor hidden service, or onion service, is a website or application reachable only through the Tor network at a .onion address. It has no public IP and no DNS record; visitors connect through Tor, and neither end learns the other's location. It is the strongest model of anonymous hosting. ### 02 Do I need a domain name for an onion service? No. The .onion address is generated automatically by Tor from a cryptographic key pair when the service first starts — you do not register or buy it. You also do not need a TLS certificate, because Tor encrypts the connection itself. ### 03 Is hosting a Tor hidden service legal? Yes. An onion service is just a website reachable over Tor, and running one is lawful — news organisations, software projects and privacy tools all do. As with any hosting, what matters is that the content itself is lawful; the Tor transport does not change that. ### 04 What most often deanonymises a hidden service? Configuration mistakes, not the protocol. The common ones are a web server or backend accidentally listening on the public IP instead of localhost, identifying content or banners that leak the real server, administering the box from a home IP, and software that makes outbound connections. The protocol is sound; the discipline around it is what fails. ### 05 Why does the choice of VPS matter for an onion service? The protocol hides the server's location, but if the service is ever correlated to its host despite your precautions, the host becomes the weak point. A no-KYC, offshore VPS means that even then, the provider holds no identity for the account and keeps no logs — the anonymous server and the hidden service reinforce each other. ### 06 Can I run an onion service alongside a normal website? Yes. Many operators run a clearnet site with an onion mirror — the ordinary audience is served normally, while visitors who want a censorship-resistant, private route use the .onion address. Large news organisations do exactly this. Hidden-service-only is the most private option; a mirror is the most flexible. Related guides ## Keep reading [### How to Choose an Offshore Hosting Jurisdiction in 2026 Buying A practical decision framework for picking an offshore jurisdiction: data-retention law, MLAT exposure, DMCA stance, court speed and real-world enforcement — country by country. 6-question FAQ](https://servprivacy.com/guides/choosing-an-offshore-jurisdiction) [### VPS vs Dedicated Server for Privacy-Critical Workloads Buying When a VPS is fine, when shared tenancy is a liability, and when bare metal is the only honest answer. Hardware isolation, hypervisor risk, and cost vs threat model. 6-question FAQ](https://servprivacy.com/guides/vps-vs-dedicated-for-privacy) [### Self-Hosted VPN on a No-KYC VPS: WireGuard vs OpenVPN Operations Why a self-hosted VPN beats commercial providers, and how WireGuard and OpenVPN really compare on privacy, performance and operational risk in 2026. 6-question FAQ](https://servprivacy.com/guides/self-hosted-vpn-wireguard-vs-openvpn) [### RTX 4090 vs H100 SXM5 for AI Inference (and Where the RTX 5090 Fits) Buying Buying guide: which NVIDIA GPU for self-hosted LLM, image, video, speech, and fine-tuning workloads in 2026. RTX 4090 vs RTX 5090 vs H100 SXM5 vs dual H100 — VRAM, throughput, $/token, when each wins. 6-question FAQ](https://servprivacy.com/guides/rtx-4090-vs-h100-for-ai-inference) [### Offshore Windows RDP for MT4 / MT5 / cTrader Forex Trading Operations Complete guide: why a Windows RDP for Forex trading, how to choose a low-latency offshore jurisdiction, MT4 / MT5 / cTrader / Expert Advisor setup, latency to broker servers, and the no-KYC checkout path. 6-question FAQ](https://servprivacy.com/guides/offshore-windows-rdp-for-forex-trading) [### DMCA-Ignored Hosting Explained: What It Really Means in 2026 Buying What "DMCA ignored" hosting genuinely buys you, which jurisdictions actually back it up, the workloads that need it, and the copyright traps the term doesn't cover. 6-question FAQ](https://servprivacy.com/guides/dmca-ignored-hosting-explained) [### Anonymous Domain Registration with Crypto: WHOIS Privacy in 2026 Privacy A practical 2026 guide to registering domains without revealing your identity: WHOIS regimes by TLD, registrar choice, crypto payment options, and the operational mistakes that leak you anyway. 6-question FAQ](https://servprivacy.com/guides/anonymous-domain-registration-with-crypto) [### Crypto Payments for Hosting: Monero vs Bitcoin vs USDT Privacy How payment coin affects what your host learns about you. Privacy, fees, finality and chain analysis exposure for XMR, BTC and USDT — with a clear recommendation. 6-question FAQ](https://servprivacy.com/guides/crypto-payments-monero-vs-bitcoin-vs-usdt) [### What Is No-KYC Hosting? Definition, Legality & How It Works Privacy No-KYC hosting lets you rent a server with zero identity verification — no name, no email, no ID. Here is exactly what it means, how it works technically, whether it is legal, and how to pick a genuine provider. 6-question FAQ](https://servprivacy.com/guides/what-is-no-kyc-hosting) [### Is Offshore Hosting Legal? The Honest 2026 Answer Buying Offshore hosting is legal — for you and for the provider. Here is what the term really means, where the legal line actually sits, the myths worth dropping, and how to use it responsibly. 6-question FAQ](https://servprivacy.com/guides/is-offshore-hosting-legal) [### How to Pay for Hosting with Monero (XMR) — Step by Step Privacy A step-by-step guide to paying for a VPS or dedicated server with Monero (XMR): why XMR is the most private option, how to get it, and how the checkout works — from invoice to a running server in minutes. 6-question FAQ](https://servprivacy.com/guides/how-to-pay-for-hosting-with-monero) [### How to Host a Website Anonymously — A Practical 2026 Guide Privacy A practical, layered guide to hosting a website with no identity attached: the account, the payment, the domain, the jurisdiction, your connection and the content — each layer explained. 6-question FAQ](https://servprivacy.com/guides/how-to-host-a-website-anonymously) [### How to Set Up a WireGuard VPN on a VPS — Step-by-Step Guide Operations Build your own private VPN on a VPS with WireGuard: why a self-hosted VPN beats a commercial one, the full setup from install to a connected client, and how to harden it. 6-question FAQ](https://servprivacy.com/guides/how-to-set-up-wireguard-vpn-on-a-vps) [### How to Self-Host an LLM on a GPU Server — 2026 Guide Operations Run your own large language model on a rented GPU server: why self-hosting beats an API, which GPU and model to choose, the setup with Ollama or vLLM, and what it costs. 6-question FAQ](https://servprivacy.com/guides/self-host-an-llm-on-a-gpu-server) [### Bulletproof Hosting vs Offshore Hosting — What Is the Difference? Buying Bulletproof hosting and offshore hosting are constantly confused — and they are not the same thing. Here is the real difference, why it matters, and which one you actually want. 6-question FAQ](https://servprivacy.com/guides/bulletproof-vs-offshore-hosting) [### How to Buy a VPS with Bitcoin — Step-by-Step (2026) Buying A beginner-friendly walkthrough of buying a VPS with Bitcoin: getting BTC, choosing a plan, paying the invoice, and what you get — a running server with no card and no name attached. 6-question FAQ](https://servprivacy.com/guides/how-to-buy-a-vps-with-bitcoin) [### Best Countries for DMCA-Ignored Hosting in 2026 Buying Where to host when you want servers beyond the easy reach of US-style takedowns: the jurisdictions that work, what DMCA-ignored really means, and how to choose. 6-question FAQ](https://servprivacy.com/guides/best-countries-for-dmca-ignored-hosting) [### Offshore Mail Server Setup — Self-Host Private Email in 2026 Operations Run your own private email server on an offshore VPS: why self-host email, what you need, the realistic setup with an all-in-one mail stack, and how to get deliverability right. 6-question FAQ](https://servprivacy.com/guides/offshore-mail-server-setup) [### Crypto Node Hosting Guide — Run a Blockchain Node on a VPS Operations How to host a blockchain node on a server: why run your own node, sizing the server for Bitcoin, Ethereum, Monero and more, the setup, and keeping it private. 6-question FAQ](https://servprivacy.com/guides/crypto-node-hosting-guide) [### GPU Hosting for Stable Diffusion — Run Your Own Image Server Operations Run Stable Diffusion on your own GPU server: why self-host image generation, which GPU to pick, the setup with a web UI, and what it costs versus a hosted service. 6-question FAQ](https://servprivacy.com/guides/gpu-hosting-for-stable-diffusion) [### Server OpSec — Staying Anonymous When You Run a Server Privacy Operational security for anyone running an anonymous server: the mistakes that deanonymise people, the habits that prevent them, and how to keep identities truly separate. 6-question FAQ](https://servprivacy.com/guides/server-opsec-staying-anonymous) [### Seedbox Setup Guide — Build Your Own Private Seedbox in 2026 Operations How to build your own seedbox on a server: what a seedbox is, sizing it, installing a torrent client with a web UI, and keeping it private and secure. 6-question FAQ](https://servprivacy.com/guides/seedbox-setup-guide) ## Deploy the VPS for your hidden service A ServPrivacy VPS — no-KYC, offshore, crypto-paid, full root — is the anonymous server a Tor hidden service needs. From $7.50/mo, live in minutes. [Private Hosting](https://servprivacy.com/anonymous-hosting) [View VPS Plans](https://servprivacy.com/vps) [No-KYC Hosting](https://servprivacy.com/no-kyc-hosting)