A v3 onion address is a 56-character identifier for a hidden service in the Tor anonymity network. The 56 characters are the ed25519 public key of the service, base32-encoded, with a checksum and version flag tacked on at the end, terminated by the suffix .onion.
Self-authenticating
The address is the public key. When a Tor client resolves the address it derives the public key directly from the string, and then validates that whatever it receives from the hidden-service directory is signed by the corresponding private key. There is no DNS, no certificate authority, no separate name-to-key binding to attack.
Why partial-prefix verification is dangerous
The first eight to twelve characters of a v3 address are often a vanity prefix chosen by the operator (which is why several marketplaces tracked here have memorable starts like nexus or anubis). A phisher can run vanity generation to match the prefix and randomise the rest at low cost. Verifying only the prefix is not a verification.
Why v2 onions are dead
The earlier v2 scheme used 16-character SHA-1-truncated RSA-1024 keys. v2 was deprecated in late 2021 and removed from the Tor client shortly after. Any 16-character "onion" you see today is an archive entry, not a working address.
See also
Where the address comes from
It is not registered with anybody and it was not chosen. The fifty six characters are derived from a public key the operator holds, which is why nobody can take one away, nobody can issue a convincing near miss without the matching key, and the string looks like nonsense. There is no word in it to remember and no pattern to help you spot a typo.
What replaced the older format
The shorter addresses used previously carried weaker cryptography and a directory design where the relays holding the lookup information could learn which services they were being asked about. The current format fixes both, which is why the old ones stopped working rather than being kept around for convenience.
Why a normal browser cannot open one
There is nothing to resolve. An onion address is not in the ordinary naming system, so a normal browser has nothing to ask and nothing to look up. Anything advertising that it opens onion links without Tor is a service standing in the middle of the connection, reading it, and that is the entire product.
Vanity prefixes and why they mislead
Operators often generate addresses until the first characters spell something recognisable. That is cheap to do for a short prefix and expensive for a long one, which is exactly why phishers do it too. A familiar looking beginning means somebody spent an hour of computing time, not that the address is genuine.