[digits]

Hello? Are we still live?
Ah, there you are. Look, I know some of you have been wondering how to set up your own Tor hidden service. Maybe you've seen .onion sites and thought "how the hell do they do that?" or maybe you just want to learn something new. Either way, I got you.
This is a complete guide to hosting your own .onion site on the Tor network. No bullshit, no gatekeeping, no assuming you already know what you're doing. If you can follow basic instructions, you can have your own hidden service running in about 20 minutes.
Disclaimer: This guide is presented for educational purposes only. I take no responsibility for the use of this information. Hosting a Tor hidden service is legal. What you choose to host is your responsibility. Stay legal, stay safe.

---

What is Tor?
Tor is both a network and a piece of software. The Tor network is a distributed system of volunteer-run servers (relays) that encrypt and route your internet traffic through multiple hops to provide anonymity. The Tor software includes both the Tor daemon (which runs the actual routing) and Tor Browser (which you use to access .onion sites).
A hidden service (also called an onion service) is a server that's only accessible through the Tor network. It gets a .onion address that's derived from cryptographic keys, providing both anonymity for the server operator and end-to-end encryption for visitors.
We'll be covering two approaches: a basic setup using Python's SimpleHTTPServer (perfect for learning), and a production setup using XAMPP (for when you're ready to run something serious).

---

What You'll Need
For basic setup:

• Windows 10/11 OR Linux (Debian/Ubuntu-based)
  
• Tor Expert Bundle (Windows) OR 
  apt-get install tor
   (Linux)
  
• Python (usually pre-installed on Linux)
  
• About 20 minutes of your time
  

For production setup:

• XAMPP (Apache/MySQL/PHP stack)
  
• Basic understanding of web servers
  
• Dedication to security best practices
  

The basic setup is perfect for learning how hidden services work, hosting a simple personal page, testing and development, and static content sites.
The production setup is for forums and blogs, dynamic content with databases, sites that need PHP scripting, and anything expecting real traffic.

---

WINDOWS SETUP - BASIC EDITION
STEP 1: DOWNLOAD TOR EXPERT BUNDLE
Navigate to: https://www.torproject.org/download/tor/
Download the "Expert Bundle" for Windows. Extract the entire contents to: 

C:\tor

The Expert Bundle includes just the Tor daemon without the browser, which is exactly what we need for running a hidden service.
STEP 2: CREATE WEBSITE FOLDER
Create a new folder: 

C:\tor\hidden_service_web

This is where all your website files will live.
STEP 3: CREATE INDEX.HTML
Create a file: 

C:\tor\hidden_service_web\index.html

Here's a basic template:

<!DOCTYPE html>
<html>
<head>
    <meta charset="UTF-8">
    <title>Hidden Service</title>
    <style>
        body {
            background: #000;
            color: #0f0;
            font-family: 'Courier New', monospace;
            margin: 40px;
        }
    </style>
</head>
<body>
    <h1>TOR HIDDEN SERVICE</h1>
    <p>Welcome to the dark web. This is a Tor hidden service.</p>
    <p>Edit this file to customize your site.</p>
    <p><i>Powered by Tor • Privacy is a right, not a privilege</i></p>
</body>
</html>

STEP 4: CREATE TOR CONFIGURATION FILE
Create a new file: 

C:\tor\torrc

 (NO FILE EXTENSION!)
Add the following configuration:

HiddenServiceDir C:\tor\hidden_service
HiddenServicePort 80 127.0.0.1:8000

CRITICAL: When saving in Notepad, change "Save as type" to "All Files" and name it exactly "torrc" with no extension. Not "torrc.txt".
What this config does:

• HiddenServiceDir: Where Tor stores your keys and hostname
  
• HiddenServicePort: Maps external port 80 to localhost:8000
  

STEP 5: START TOR
Open Command Prompt and run:

cd C:\tor\tor-expert-bundle-windows-x86_64-15.0\Tor
tor.exe -f C:\tor\torrc

Note: The version number (15.0) may be different. Check your actual folder name and adjust accordingly.
Wait for the message: "Bootstrapped 100% (done): Done"
KEEP THIS WINDOW OPEN. Closing it stops your hidden service.
STEP 6: GET YOUR .ONION ADDRESS
Open a NEW Command Prompt window and run:

type C:\tor\hidden_service\hostname

Your .onion address will be displayed. It'll look something like: 

abcdefghijklmnop.onion

Copy this address. This is how people will access your hidden service.
STEP 7: START WEB SERVER
Open another NEW Command Prompt or PowerShell window and run:

cd C:\tor\hidden_service_web
python -m http.server 8000

You should see: "Serving HTTP on :: port 8000..."
KEEP THIS WINDOW OPEN. This is your actual web server.
STEP 8: TEST YOUR SITE
Open Tor Browser (download from torproject.org if you don't have it). Enter your .onion address in the URL bar. Your site should load!
If it doesn't work immediately, wait 30-60 seconds. Hidden services take a moment to propagate through the Tor network.
IMPORTANT NOTES FOR WINDOWS:

• Keep BOTH windows running (Tor daemon + Python server)
  
• Edit index.html anytime, refresh browser to see changes
  
• Your PC must be ON for the site to be accessible
  
• BACKUP 
  C:\tor\hidden_service\
   - contains your private keys
  
• Lose that folder = lose your .onion address forever
  

---

LINUX SETUP - BASIC EDITION
The Linux setup is actually simpler because Tor integrates better with the operating system.
STEP 1: INSTALL TOR
 

sudo apt update
sudo apt install tor

That's it. Tor is now installed and will run as a system service.
STEP 2: CREATE WEBSITE FOLDER
 

mkdir -p ~/tor_service/website
cd ~/tor_service/website

STEP 3: CREATE INDEX.HTML
 

nano index.html

Paste the HTML template from the Windows section above. Save with: Ctrl+O, Enter, Ctrl+X
STEP 4: CONFIGURE TOR

sudo nano /etc/tor/torrc

sudo nano /etc/tor/torrc

Scroll to the bottom and add:
 

HiddenServiceDir /var/lib/tor/hidden_service/
HiddenServicePort 80 127.0.0.1:8000

Save with: Ctrl+O, Enter, Ctrl+X
STEP 5: RESTART TOR
 

sudo systemctl restart tor
sudo systemctl status tor

Check that status shows "active (running)" in green.
STEP 6: GET YOUR .ONION ADDRESS
 

sudo cat /var/lib/tor/hidden_service/hostname

Your .onion address will be displayed. Copy it.
STEP 7: START WEB SERVER
 

cd ~/tor_service/website
python3 -m http.server 8000

KEEP THIS TERMINAL OPEN.
 
STEP 8: TEST YOUR SITE
Open Tor Browser and visit your .onion address. Done.
OPTIONAL: RUN AS BACKGROUND SERVICE
If you want the web server to run automatically:

sudo nano /etc/systemd/system/hidden-web.service

Paste this (replace YOUR_USERNAME with your actual username):

[Unit]
Description=Hidden Service Web Server
After=network.target

[Service]
Type=simple
User=YOUR_USERNAME
WorkingDirectory=/home/YOUR_USERNAME/tor_service/website
ExecStart=/usr/bin/python3 -m http.server 8000
Restart=always

[Install]
WantedBy=multi-user.target

Then run:

sudo systemctl daemon-reload
sudo systemctl enable hidden-web
sudo systemctl start hidden-web
sudo systemctl status hidden-web

Now your web server will start automatically on boot.
LINUX NOTES:

• Tor runs automatically as a system service
  
• Edit 
  ~/tor_service/website/index.html
   to customize
  
• Backup 
  /var/lib/tor/hidden_service/
   to preserve address
  
• Web server must be running for site to be accessible
  

---

XAMPP PRODUCTION SETUP - THE REAL DEAL
Now we're getting into the good shit. Python's SimpleHTTPServer is fine for testing and static sites, but if you want to run something serious - a forum, blog, image board, or anything with actual traffic and dynamic content - you need real web server software.
XAMPP gives you: Apache (production-grade web server), MySQL/MariaDB (database), PHP (server-side scripting), phpMyAdmin (database management), better performance, logging, security options, and .htaccess for URL rewriting.
WINDOWS - XAMPP INSTALLATION
Download XAMPP from: https://www.apachefriends.org/download.html
Run the installer. Install to: 

C:\xampp

 (default is fine)
During installation, select: Apache, MySQL, PHP. Skip FileZilla and Mercury unless you need them.
Configure Apache Port (if needed)
If port 80 is already in use (by IIS, Skype, etc.):
Open 

C:\xampp\apache\conf\httpd.conf

Find: 

Listen 80

Change to: 

Listen 8080

Start XAMPP
Run: 

C:\xampp\xampp-control.exe

Click "Start" on Apache (and MySQL if you need a database)
Create Your Website
Your web root is: 

C:\xampp\htdocs

Delete or rename 

C:\xampp\htdocs\index.php

 and create your own index.html.
Configure Tor for XAMPP
Edit your torrc file: 

C:\tor\torrc

HiddenServiceDir C:\tor\hidden_service
HiddenServicePort 80 127.0.0.1:80

  
Note: Change port to 8080 if you configured Apache on 8080.
Start Tor and get your .onion address (same as before)

---

LINUX - XAMPP INSTALLATION
 

cd ~
wget https://www.apachefriends.org/xampp-files/8.2.12/xampp-linux-x64-8.2.12-0-installer.run
chmod +x xampp-linux-x64-8.2.12-0-installer.run
sudo ./xampp-linux-x64-8.2.12-0-installer.run

  
Note: Check apachefriends.org for the latest version number.
Follow the installer prompts. Install to: 

/opt/lampp

 (default)
Start XAMPP
 

sudo /opt/lampp/lampp start

  
Create Your Website
Your web root is: 

/opt/lampp/htdocs

sudo rm /opt/lampp/htdocs/index.html
sudo nano /opt/lampp/htdocs/index.html

Set permissions:
  

sudo chmod -R 755 /opt/lampp/htdocs
sudo chown -R daemon:daemon /opt/lampp/htdocs

Configure Tor for XAMPP
 

sudo nano /etc/tor/torrc

Add:

HiddenServiceDir /var/lib/tor/hidden_service/
HiddenServicePort 80 127.0.0.1:80

Restart Tor and get your .onion address
 

sudo systemctl restart tor
sudo cat /var/lib/tor/hidden_service/hostname

XAMPP SECURITY HARDENING
XAMPP is NOT secure by default. It's designed for development, not production. Here's how to lock it down:
1. CHANGE DEFAULT PASSWORDS
Access phpMyAdmin: http://localhost/phpmyadmin
Login: root (no password by default - FIX THIS IMMEDIATELY)
Change root password through the interface.
2. DISABLE UNUSED MODULES
Edit httpd.conf and comment out modules you don't need by adding # before the LoadModule lines.
3. DISABLE DIRECTORY LISTINGS
In httpd.conf, change 

Options Indexes

 to 

Options -Indexes

4. DON'T EXPOSE PHPMYADMIN
Only access phpMyAdmin from localhost, never expose it to your hidden service.

---

PHP EXAMPLE
Save this as 

test.php

 in your htdocs folder:

<?php
// test.php - Simple PHP test for hidden service
?>
<!DOCTYPE html>
<html>
<head>
    <title>PHP Test</title>
    <style>
        body { background: #000; color: #0f0; font-family: monospace; padding: 20px; }
    </style>
</head>
<body>
    <h1>PHP is Working!</h1>
    <p>Server Time: <?php echo date('Y-m-d H:i:s'); ?></p>
    <p>PHP Version: <?php echo phpversion(); ?></p>
</body>
</html>

Visit: 

http://your-onion-address.onion/test.php

If you see the current time and PHP version, you're golden.

---

SECURITY & OPSEC - READ THIS CAREFULLY
CRITICAL - DO THIS:

• BACKUP YOUR HIDDEN_SERVICE FOLDER REGULARLY. This folder contains your private keys. Lose it = lose your .onion address forever. No recovery. No customer support. No reset button.
  
• USE FULL DISK ENCRYPTION (BitLocker on Windows, LUKS on Linux). If someone gets physical access to your machine, encryption is your last line of defense.
  
• KEEP TOR UPDATED. Old versions have known vulnerabilities.
  
• SEPARATE YOUR IDENTITIES. Your Tor persona should be completely separate from your clearnet identity. Different usernames, email addresses, writing style, and personal details.
  
• STRIP EXIF DATA FROM IMAGES. Your camera embeds GPS coordinates, camera model, and timestamp in every photo. Linux: 
  exiftool -all= image.jpg
• USE STRONG PASSWORDS. Linux: 
  pwgen -s 32 1
• MONITOR YOUR LOGS REGULARLY for suspicious activity.
  

CRITICAL - DON'T DO THIS:

• NEVER SHARE YOUR HIDDEN_SERVICE FOLDER. Anyone with your private keys can impersonate your hidden service.
  
• NEVER REVEAL PERSONAL INFORMATION. No real names, locations, or identifying details.
  
• NEVER UPLOAD PHOTOS WITH EXIF DATA. Your phone's camera is a tracking device that happens to take pictures.
  
• NEVER ACCESS YOUR HIDDEN SERVICE FROM YOUR REAL IP. Always use Tor Browser to access your .onion site.
  
• NEVER REUSE USERNAMES across clearnet and Tor.
  
• NEVER HOST ILLEGAL CONTENT. Don't be stupid. This guide is for legal purposes.
  
• NEVER MIX TOR AND VPN INCORRECTLY. Tor → VPN can break your anonymity. If you must use a VPN, do VPN → Tor.
  

---

TROUBLESHOOTING
Windows Issues:
Q: "Unable to connect" in Tor Browser?
A: Check that Tor is running and showing "Bootstrapped 100%", your web server is running, wait 30-60 seconds, check Windows Firewall.
Q: Python not found?
A: Install Python from python.org and check "Add Python to PATH" during installation.
Q: Port already in use?
A: Use a different port (e.g., 8001) and update your torrc to match.
Linux Issues:
Q: Permission denied on /var/lib/tor/?
A: Always use sudo: 

sudo cat /var/lib/tor/hidden_service/hostname

Q: Tor won't start?
A: Check logs: 

sudo journalctl -u tor -n 50

Q: Port 8000 already in use?
A: Use a different port and update torrc, then restart Tor.
General Issues:
Q: Lost my .onion address?
A: If you didn't backup your hidden_service folder, it's gone forever. This is why you BACKUP YOUR KEYS.
Q: Site is really slow?
A: Tor is inherently slower than clearnet. Optimize by minimizing image sizes and enabling compression.
Q: Want to move to a new machine?
A: Copy your entire hidden_service folder to the new machine. Your .onion address will stay the same.

---

FAQ
Q: Is this legal?
A: Yes. Hosting a Tor hidden service is legal in most countries. What you choose to host might not be, so stay legal.
Q: Do I need to keep my computer on 24/7?
A: Yes, if you want 24/7 availability. Consider a dedicated server or cheap VPS for always-on hosting.
Q: How do I get a custom .onion address?
A: Use vanity address generators like mkp224o or Eschalot. Warning: generating custom addresses takes time. 4-5 character prefix takes minutes, 6-7 characters takes hours to days, 8+ characters takes weeks to months.
Q: Can people find my real IP?
A: Not through Tor itself if configured correctly. Don't access your hidden service from clearnet and don't leak identifying info in your content.
Q: Can I use a domain name instead of .onion?
A: No. .onion addresses are the whole point. The .onion address IS your domain.
Q: Should I use a VPN with Tor?
A: VPN → Tor hides Tor usage from your ISP and is generally safe. Tor → VPN can break anonymity. For most users, Tor alone is fine.

---

Resources
Official Documentation:

• Tor Project: https://www.torproject.org/
  
• Hidden Service Manual: https://community.torproject.org/onion-services/
  

Software Downloads:

• Python: https://www.python.org/downloads/
  
• XAMPP: https://www.apachefriends.org/
  

Learning Resources:

• r/onions: https://www.reddit.com/r/onions/
  
• r/TOR: https://www.reddit.com/r/TOR/
  
• EFF Surveillance Self-Defense: https://ssd.eff.org/
  

---

Final Words
You now have everything you need to host your own .onion site. Whether you're setting up a simple page with Python or a full production service with XAMPP, the technology is in your hands.
What you do with it is up to you.
Some final wisdom:

• Start small, learn as you go
  
• Security is a process, not a destination
  
• Always have backups (encrypted)
  
• Test everything before going live
  
• Stay updated on Tor developments
  
• Help others learn
  
• Respect privacy - yours and others'
  

Every hidden service you run is a small act of resistance against centralization. You're taking back control. You're proving that the technology of freedom works.
The powers that be want you to think privacy is for criminals. It's not. Privacy is for everyone. Privacy is necessary for freedom.
Stay curious. Stay safe. Help others learn.
Knowledge should be free.

---

Greets & Shoutouts
To the Tor Project developers - for building the tools of freedom
To the hidden service operators keeping the dream alive
To the privacy advocates fighting the good fight
To the hackers, makers, and tinkerers who refuse to accept limits
To everyone running a node, contributing bandwidth, supporting Tor
To the newbies reading this right now - welcome to the underground
Special thanks to the Electronic Frontier Foundation, the Tor Project, and everyone who believes knowledge should be free.

---

Final thought: host responsibly, stay anonymous, and help others learn.
GLHF
<3