Where the one comes from
An onion address is not a name that somebody registered. It is a public key written out in a readable alphabet, with a short checksum stapled to the end. The client checks the checksum before it does anything else. If the checksum does not match the key, the address is rejected locally and no connection is attempted.
Changing one character changes five bits of the encoded value. Those five bits land either in the key part or in the checksum part. Either way the two stop agreeing. The odds of an accidental single character change producing a string that still checks out are roughly one in sixty five thousand, which is the size of the two byte checksum.
So the count here is one. One character is all it takes to turn a mars market working link into a string that produces an error rather than a page.
What one character buys you
It buys a free error check. If you retype an address by hand and get a page, you almost certainly typed it correctly, because a typo would have failed loudly. That is a genuinely useful property and it is unusual. A mistyped domain name on the ordinary web lands you on somebody else who bought the typo. A mistyped onion address lands you nowhere.
It also tells you what to do when an address fails. The first response to a failure should be to check for a transcription error, not to conclude that the market is gone. Copy the address instead of retyping it and try again. A large share of the reports that begin with an address being dead end here.
What people get wrong about it
The common mistake is to treat this property as protection. It is not. Nobody attacking you is going to change one character and hope. They will generate a whole address that is valid from end to end and shares an eye catching prefix with the real one, then publish it somewhere you will find it.
That attack costs almost nothing for the first few characters. The four character page works through the arithmetic. Against that attack, the fact that a single typo fails is completely irrelevant, because the attacker never made a typo.
The second mistake is the reverse: assuming that because a typo fails, an address that loads must be genuine. Loading proves the string is well formed and that something is listening. It proves nothing at all about who is listening.
What would move it
Nothing about the market can change this. It is a property of the address format, so it would take a change to the onion service specification itself. The previous version of the format, retired in 2021, had a shorter checksum and a shorter address, and the same logic applied with weaker odds.
The only thing that changes in practice is your own habit. If you copy rather than type, the number stops mattering to you at all, and you fall back on the checks that do work.
Questions people ask
Could a typo ever land me on a real but different site?
In principle, with a probability around one in sixty five thousand per typo, and then only if somebody happens to be running a service at that exact address. In practice this has never been the way people get caught.
Does capitalisation count as a change?
No. Onion addresses are case insensitive and are conventionally written in lower case. Typing one in upper case will resolve to the same place.