Addresses
The three addresses at the top of every page are a published list. This page is about what that does and does not mean.
What a published list is
A statement about which addresses are in use. That is genuinely useful and it is not a security claim. This site does not probe them, does not monitor them, and publishes no uptime figure, because a number it cannot back would be worse than none at all.
Why several rather than one
Almost everything that makes an onion unreachable happens in the path rather than at the destination. A descriptor that failed to publish, an introduction point dropping out of consensus, a bad relay in the middle of your circuit, flooding aimed at one address. Every item there is per address, and the service behind them is fine throughout. Several addresses make those failures independent of each other, which is the whole argument.
They are not fully interchangeable in every respect. An older address has been in circulation longer, appears in more scraped lists, and attracts more junk traffic. A newer one is quieter and often noticeably faster, and appears in fewer places, so somebody who only ever saw the old one may be suspicious of it.
Keeping your own copy
| Where | Verdict |
|---|---|
| Password manager entry | Good. Under your control, easy to date and edit. |
| A text file you own | Good, and you can note where each came from. |
| Paper | Good. Cannot be edited by anything running on your machine. |
| Browser bookmark | Poor. Often synced, easy to click without thinking, and it hides the string behind a name you chose. |
| Memory | Bad. Nobody recalls fifty six characters, and near enough is the failure being exploited. |
The habit that matters
- Copy, never retype. Every manual transcription is a chance to introduce an error that will look like an attack when it fails.
- Note the source and the date beside each one. A single line, and it is the difference between judging something later and guessing.
- Compare against a published list every few weeks. Under a minute, and it is the entire maintenance burden.
- Delete rather than archive when something drops off. This is the half that actually protects you.
- Verify on arrival regardless of how familiar the string looks.
If you are going to spot check a string rather than paste and compare, check characters twenty through forty. That is where a forgery differs, and it takes exactly as long as checking the ends.