The numbers / Address

Thirty two symbols, and the four digits that are missing

Every character in an onion address is drawn from a fixed set of thirty two. If you see a character outside that set, you are not looking at an onion address.

32 symbols in the alphabet Counted
Value
32 symbols
Kind
Counted
Derived from
Base32, as defined in RFC 4648
Changes with
Nothing. The encoding is not market specific

Mars market addresses

Published, not monitored
mars24pas2vgwtr4drrsy7tlngevbvxyguejynnkeywibjzenet7knqd.onion
marsautbk3di5cj75eh4dakjjrngddnjwqfdltbq2sy6cf7unzkd2bad.onion
marsautkudspgk6j23cxdtrk36ae4fpis2eoe7izu5y2rsksvmfji2ad.onion

These three addresses are printed as given. This site does not test them, does not know whether any of them answers right now, and publishes no availability figure. An address that opens is not the same thing as an address that is genuine, which is what the forty character fingerprint is for.

Where the thirty two comes from

The encoding is base32, which means each character stands for exactly five bits. Five bits has thirty two possible values, so the alphabet needs thirty two distinct symbols and no more. Twenty six letters get you most of the way there and six digits finish the job.

The six chosen are 2 through 7. Zero and one are left out because they are easily confused with the letters O and I or l when a human reads them aloud or copies them down. Eight and nine are simply not needed, since the set was already full at thirty two.

That is the whole reason. It is not a security decision and it carries no hidden meaning. It is a readability decision taken in a specification about encoding text.

The full seta b c d e f g h i j k l m n o p q r s t u v w x y z 2 3 4 5 6 7
absent: 0 1 8 9

What the thirty two buys you

A free validity check that takes under a second. Scan a candidate mars market address for a zero, a one, an eight or a nine. If you find one, the string is wrong, and you can stop before you do anything else with it.

This catches a surprising amount. Optical character recognition on a screenshot produces zeros where letter o should be. People retyping from memory produce ones where letter l should be. Fabricated addresses written by somebody who has never looked at the format often contain the full digit range because it looks more random that way.

It also tells you how much information each character carries. Five bits per character, fifty six characters, two hundred and eighty bits total. That figure is what makes the prefix arithmetic work.

What people get wrong about it

A few people assume the missing digits are a Tor specific rule, and go looking for a reason. There is no Tor specific reason. Base32 is an ordinary encoding used in plenty of places that have nothing to do with anonymity.

Others assume the alphabet limits how many addresses exist. It does not, in any way you could notice. Two hundred and eighty bits of address space is far larger than the number of keys anybody will ever generate.

The last one is thinking the check is stronger than it is. Passing the alphabet test means the string could be an address. Nothing more. Every forged address passes it too.

What would move it

A change of encoding in a future address format. Base32 was picked because it survives case insensitive systems, which base64 does not, and because it is easier to read aloud than hexadecimal while staying compact. Those constraints have not changed.

Nothing the market does affects this. The alphabet belongs to the network, not to any service on it.

The one second checkA zero, a one, an eight or a nine anywhere in the string means the string is not an onion address. This is the cheapest check on the whole site.

Questions people ask

Are uppercase letters allowed?

They are accepted and treated as the same address, because base32 is case insensitive. Addresses are written in lower case by convention.

Why not use hexadecimal instead?

Hexadecimal has only sixteen symbols, so the same key would need seventy characters instead of fifty six. Base32 is the compromise between length and readability.