Onion-Location
When a website is available over both the regular
internet and the Tor network, the unofficial
Onion-Location response header advertises the
.onion (Tor hidden service) equivalent of a
clearnet URL.
Usage
Websites accessible over both the regular internet and the
Tor network use Onion-Location to signal the .onion
address where the same content is available. When Tor Browser
encounters this header, a ".onion available" prompt appears in
the address bar, offering to redirect the user to the hidden
service version of the site.
The header serves a similar role to
Location in Redirects, but instead of forcing
a redirect, the browser presents a choice. Visiting the
.onion address provides end-to-end encryption within the
Tor network without relying on exit nodes, improving both
privacy and security. Organizations like Deutsche
Welle, the Guardian, the Internet Archive, Proton, and
various privacy services deploy this header alongside
Strict-Transport-Security and
Https to give Tor users a native hidden service
experience.
The Tor Project introduced this header as a standard
mechanism, replacing the earlier practice of manually linking
to .onion mirrors on web pages.
Tor Browser applies prerequisites before showing the prompt.
The page defining the header must be served over Https
and must not itself be an onion site, and the value must be
a valid http:// or https:// URL with a .onion
hostname. Sites without access to header configuration
achieve the same result with an HTML meta element:
<meta http-equiv="onion-location" content="...">.
Values
The value is a single absolute URL pointing to the .onion
equivalent of the current resource. The URL uses the same
scheme (http:// or https://) and includes the full
.onion hostname with the corresponding path.
Example
The Internet Archive serves an Onion-Location header
pointing to its .onion mirror. The long base32-encoded
hostname is a standard v3 Tor onion address.
Onion-Location: https://archivep75mbjunhxc6x4j5mwjmomyxb573v42baldlqu56ruil2oiad.onion/details/funkymix-304
A privacy-focused search engine advertising its hidden service
equivalent. The .onion URL mirrors the clearnet URL path
structure.
Onion-Location: http://search.privacyrkwfzsfmwtfnrilikxv7xkhw2feso7stq2ajmc6wx43hgj6ad.onion/
The Guardian newspaper provides its .onion address for
readers accessing news content through Tor Browser.
Onion-Location: https://www.guardian2zotagl6tmjucg3lrhxdk4dw3lhbqnkvvkywawy3oqfoprid.onion/world/2025/may/27/example-story
Requirements, and who ships the header
Tor Project documents three conditions, all
mandatory: the value is an http or https URL
with a .onion hostname, the advertising page is
served over HTTPS, and the advertising
page is not itself an onion site.
The header form beats the meta tag on one concrete point: a header appends the request path, sending a visitor to the onion copy of the page being read, while the meta form always lands on the static address regardless of which page carried the advertisement.
Tor Browser honors the header, showing the ".onion available" pill in the address bar with optional automatic redirection on desktop platforms.
Live checks show adoption concentrated among privacy-focused organizations: Tor Project, SecureDrop, Proton, Riseup, the Internet Archive, the Guardian, Freedom of the Press Foundation, and OnionShare all send the header today, with both onion URL schemes represented. The more telling result is the negative list: several major newsrooms operating well-known onion services answer without the header, so running an onion service and advertising one are separate decisions, and the header measures the second.