Setting Up a Tor Hidden Service v3: Technical Guide

Tor Hidden Services v3 use ed25519 keys and generate 56-character .onion addresses. They provide stronger authentication and improved cryptography compared to the deprecated v2 format.

Basic Setup

Install Tor, edit torrc: add HiddenServiceDir /var/lib/tor/myservice/ and HiddenServicePort 80 127.0.0.1:8080. Restart Tor. Your .onion hostname appears in /var/lib/tor/myservice/hostname. The private key is in hs_ed25519_secret_key — back it up securely offline.

Nginx Configuration

Configure Nginx to listen only on 127.0.0.1:8080. Set server_tokens off, remove version headers, disable access logs (or encrypt them). Add security headers: X-Frame-Options DENY, X-Content-Type-Options nosniff, Content-Security-Policy with strict rules.

Hardening

Run the service in a sandboxed environment. Use Sandbox 1 in torrc. Set strict file permissions (chmod 700 on HiddenServiceDir). Configure iptables to block all non-Tor traffic. Monitor logs for suspicious activity. Use OnionBalance for load balancing across multiple instances.