Where the thirty five comes from
Add the parts. An ed25519 public key is 32 bytes. The truncated checksum is 2 bytes. The version marker is a single byte, currently holding the value three. Thirty five bytes in total, which is two hundred and eighty bits, which encodes to exactly fifty six base32 characters with nothing left over.
That the arithmetic comes out even is not a coincidence. The format was chosen so the encoded address has no padding characters, which is why onion addresses never end in the equals signs that other base32 strings sometimes carry.
| Part | Bytes | What it does |
|---|---|---|
| Public key | 32 | The identity itself. Cannot be forged without breaking the curve |
| Checksum | 2 | Catches transcription damage. Nothing more |
| Version | 1 | Says which format this is. Currently 3 |
What the split buys you
It tells you where the strength lives. Two hundred and fifty six bits of key material is an enormous number, far beyond any search. Sixteen bits of checksum is a rounding error. One byte of version is a label. When somebody says an onion address is cryptographically strong, they are talking about the thirty two, and that claim is true.
It also explains a practical fact that confuses people: you cannot pick your onion address, you can only keep generating keys until one of them encodes to something you like. The address is the key. There is no separate name to register and no registry to appeal to.
What people get wrong about it
The most common error is thinking the address points at a server, the way a domain name does. It does not. It names a key, and whoever holds the matching private key can serve that address from anywhere, on any machine, and move it whenever they like without the address changing.
That has a direct consequence people miss. An address staying the same across a server move proves nothing about who is running it, only that the private key travelled. Keys get stolen and keys get handed over.
The second error is treating thirty two bytes of key as thirty two bytes of secrecy. The public key is public by design. It is written on every page that publishes the address. The secrecy is in the private half, which never appears anywhere.
What would move it
A move to a different signature scheme, which would change the key size and therefore the whole address length. The previous version of the format used a truncated hash of an RSA key and produced sixteen character addresses. The change to thirty five bytes is what made addresses long and also what made them properly strong.
Within version three, nothing moves. Every v3 onion address on the network has exactly this layout.
The version byte deserves one line of its own. It holds the value three, and it exists so that a future format can be introduced without breaking every piece of software that parses addresses. Nothing reads it day to day. It is there for the transition that has not happened yet.
The order of the three parts also matters more than it looks. Key first, then checksum, then version. Because the key comes first, the opening characters of the address are pure key material, which is exactly why a vanity prefix is possible at all. If the version byte led, every address on the network would begin with the same few characters.
Questions people ask
Can two services have the same address?
Only if they hold the same private key, which means one of them copied it from the other. There is no allocation process that could hand out a duplicate.
What happens if the private key is lost?
The address is gone permanently. Nobody can reissue it, because there is nobody to ask. This is why markets publish more than one address.