Skip to content
HackIndex.io

Generate a Vanity Onion Address

Created September 12, 2026 • Last updated September 12, 2026 • 4 min read • 239 views

Joshua

HackIndex Creator

A vanity onion address puts a chosen word at the start of your v3 hostname, so visitors recognise the service at a glance. This page builds the generator, searches for a prefix, and installs the key into the Tor service from the hardened onion service build. Generate the key on a separate machine and keep it offline.

How a vanity onion address works

A v3 address is the base32 encoding of the service public key, a checksum, and a version byte. That gives 56 characters, always ending in d. You cannot pick the whole address, only grind keypairs until the encoded public key starts with your string.

The alphabet is base32, so the digits 0, 1, 8, and 9 never appear. Each extra character multiplies the work by about 32, which is why short prefixes are the only practical target.

Build mkp224o

mkp224o is the standard generator for v3 addresses. Build it from source on the machine that will grind the key, ideally an offline workstation with a fast CPU. Install the build dependencies, then compile with the architecture flag for faster key generation.

user@host ~ $ sudo apt install -y git gcc libc6-dev libsodium-dev make autoconf
user@host ~ $ git clone https://github.com/cathugger/mkp224o
user@host ~ $ cd mkp224o
user@host ~ $ ./autogen.sh
user@host ~ $ ./configure --enable-amd64-51-30k
user@host ~ $ make
Explain command
--enable-amd64-51-30k Selects a faster ed25519 backend on amd64 CPUs. Drop it on other architectures.

Notice

If make fails with an assembler error, the CPU is not amd64. Run make clean, configure again without the flag, then make. The default backend needs no flag and is still fast.

Search for a vanity onion address

Give the tool one or more filters. It writes a directory of keys for each match. Use batch mode for a large speed gain, set the thread count to your cores, and stop after the first hit. On a modern CPU, four or five characters land in seconds and six in about a minute. Seven takes under an hour, and eight around a day. The amd64 backend runs faster still.

user@host ~ $ ./mkp224o -B -t 4 -n 1 -d ~/onions hack 
set workdir: /root/onions/
sorting filters... done.
filters:
	hack
in total, 1 filter
using 4 threads
hack7icgei24r3fxrad4ryual2chma6owhevf5upl45pzezbldc67tod.onion
waiting for threads to finish... done.
Explain command
-B Uses the batching generator, over ten times faster than the default method.
-t 4 Runs four worker threads. Match this to your core count.
-n 1 Stops after one matching key instead of running forever.
-d ~/onions Writes each found key set into its own directory under this path.

Pass several filters at once to search for any of them in parallel, or load a long list with the filter file option. Each result directory holds a hostname file, a public key, and the secret key that defines the address.

Install the key

Stop Tor, replace the service directory with the generated one, and fix the owner. Tor expects the directory to belong to the debian-tor user with 700 permissions. The torrc from the hardened onion service build already points HiddenServiceDir at this path. mkp224o named the output directory after the address, so the first command reads it from the hostname file. Read the hostname back to confirm the new address is live.

user@host ~ $ ONION_ADDRESS=$(cat ~/onions/*/hostname)
user@host ~ $ sudo systemctl stop tor
user@host ~ $ sudo rm -rf /var/lib/tor/site
user@host ~ $ sudo cp -r ~/onions/$ONION_ADDRESS /var/lib/tor/site
user@host ~ $ sudo chown -R debian-tor:debian-tor /var/lib/tor/site
user@host ~ $ sudo chmod 700 /var/lib/tor/site
user@host ~ $ sudo systemctl start tor
user@host ~ $ sudo cat /var/lib/tor/site/hostname 
hack7icgei24r3fxrad4ryual2chma6owhevf5upl45pzezbldc67tod.onion

With the address in place, harden the rest of the stack in the hardened onion service guide, or point several names at the same box in running multiple onion services on one host.

References