How do I host an onion service on my own server?

What is an onion service, and why host one?

An onion service is a service reached only over Tor, at an address ending in .onion. The Tor Project's overview, read on 1 November 2026, lists what it gives you:

• Location hiding: the service's IP address is not exposed; in the protocol it is not even used.
• End-to-end authentication: the 56-character v3 address is the service's public key, so no one can impersonate it.
• End-to-end encryption: traffic is encrypted from client to service, like HTTPS for free.
• NAT punching: the service makes only outgoing connections, so it needs no open inbound ports.

That last point means you can run an onion service without a public listening port at all. You still need a machine you control to run it on, with root and uptime, which is what a rented berth provides.

What goes in the torrc for an onion service?

Two lines are the minimum. Use a Unix socket so the service is not reachable over the local network, as the Tor Project recommends.

# Keys and hostname live here; keep this directory private
HiddenServiceDir /var/lib/tor/my-website/

# Forward the onion's port 80 to the local web server
# A Unix socket avoids exposing the service on the LAN
HiddenServicePort 80 unix:/var/run/tor/my-website.sock

# Then: systemctl restart tor
# Read /var/lib/tor/my-website/hostname for your .onion address

How do I keep an onion service safe?

The Tor Project's operational-security notes give the main points:

• Host the service on a Tor client, not a relay. A relay's uptime and properties are public, which leaks information about the service.
• Hide server fingerprints. Stop the web server revealing its software, version or anything about the operating system or location.
• Keep it up. If the machine goes offline, so does the service, and an intermittent service leaks patterns to an observer.
• Use client authorization to limit who can reach a private service, and OnionScan to check the site is not leaking its real IP.
• Vanguards guards against advanced attacks on the service's circuits.

For a busy service, the DoS guidelines add introduction-point rate limiting, a proof-of-work puzzle, stream limits and Onionbalance for high availability. A whole machine with root lets you apply every one of these; a berth keeps no logs, so there is nothing for Ravenquay to hand over about your visitors: We keep no logs at all: no connection records, no traffic records and no IP addresses of visitors or customers, whether on the website, in the dashboard or on the servers

Why host an onion service on a rented offshore machine?

Because an onion service wants uptime, root and a host that stays out of your traffic. A Ravenquay berth is a whole physical machine: Nothing on the machine is shared: its processor, memory and disks serve only your workloads. You choose the country your server sits in, Reykjavik (Iceland), Zurich (Switzerland), Bucharest (Romania) and Amsterdam (Netherlands): every berth in every port of call, at one price, and the company answers to Panamanian law.

Ravenquay checked 34 dedicated-server hosts on 30 October 2026: 21 stated no Tor policy for their servers. An onion service is a Tor client, not a relay, so ask such a host before you deploy one.

An onion service is lawful privacy infrastructure, not a shield for abuse. Ravenquay's rules still apply to whatever the service does: read what may run on a Ravenquay server. See also what privacy-focused hosting should include and the full Ravenquay pricing.