Configuring Hidden Services for Tor

Tor allows clients and relays to offer hidden services. That is, you can offer a web server, SSH server, etc., without revealing your IP address to its users. In fact, because you don't use any public address, you can run a hidden service from behind your firewall.

If you have Tor installed, you can see hidden services in action by visiting this sample site.

This page describes the steps for setting up your own hidden service website. For the technical details of how the hidden service protocol works, see our hidden service protocol page.

Step Zero: Get Tor working

Before you start, you need to make sure:

  1. Tor is up and running,
  2. You actually set it up correctly.


Step One: Install a web server locally




Step Two: Configure your hidden service

Next, you need to configure your hidden service to point to your local web server.



This section of the file consists of groups of lines, each representing one hidden service. Right now they are all commented out (the lines start with #), so hidden services are disabled. Each group of lines consists of one HiddenServiceDir line, and one or more HiddenServicePort lines:


Add the following lines to your torrc:

    HiddenServicePort 80


    HiddenServicePort 80

Now save the torrc and restart your tor.



First, Tor will generate a new public/private keypair for your hidden service. It is written into a file called "private_key". Don't share this key with others -- if you do they will be able to impersonate your hidden service.


Now that you've restarted Tor, it is busy picking introduction points in the Tor network, and generating a hidden service descriptor. This is a signed list of introduction points along with the service's full public key. It anonymously publishes this descriptor to the directory servers, and other people anonymously fetch it from the directory servers when they're trying to access your service.


Step Three: More advanced tips


If you want to forward multiple virtual ports for a single hidden service, just add more HiddenServicePort lines. If you want to run multiple hidden services from the same Tor client, just add another HiddenServiceDir line. All the following HiddenServicePort lines refer to this HiddenServiceDir line, until you add another HiddenServiceDir line:

    HiddenServiceDir /usr/local/etc/tor/hidden_service/
    HiddenServicePort 80

    HiddenServiceDir /usr/local/etc/tor/other_hidden_service/
    HiddenServicePort 6667
    HiddenServicePort 22

Hidden services operators need to practice proper operational security and system administration to maintain security. For some security suggestions please make sure you read over Riseup's "Tor hidden services best practices" document. Also, here are some more anonymity issues you should keep in mind:

  • If your computer isn't online all the time, your hidden service won't be either. This leaks information to an observant adversary.
  • It is generally a better idea to host hidden services on a Tor client rather than a Tor relay, since relay uptime and other properties are publicly visible.
  • The longer a hidden is online, the higher the risk that its location is discovered. The most prominent attacks are building a profile of the hidden service's availability and matching induced traffic patterns.


Finally, feel free to use the [tor-onions] mailing list to discuss the secure administration and operation of Tor hidden services.