# Generate a Vanity Onion Address

> Generate a vanity onion address with mkp224o: build the tool, search a prefix, and install the v3 key into your Tor service.

- **URL:** https://hackindex.io/blog/vanity-onion-address-mkp224o
- **Authors:** [Joshua](https://hackindex.io/authors/joshua.md)
- **Published:** 2026-09-12
- **Updated:** 2026-09-12

A vanity onion address puts a chosen word at the start of your v3 hostname, so visitors recognise the service at a glance. This page builds the generator, searches for a prefix, and installs the key into the Tor service from the [hardened onion service](https://hackindex.io/blog/hardened-onion-service-ubuntu) build. Generate the key on a separate machine and keep it offline.

## How a vanity onion address works

A v3 address is the base32 encoding of the service public key, a checksum, and a version byte. That gives 56 characters, always ending in d. You cannot pick the whole address, only grind keypairs until the encoded public key starts with your string.

The alphabet is base32, so the digits 0, 1, 8, and 9 never appear. Each extra character multiplies the work by about 32, which is why short prefixes are the only practical target.

> [!WARNING]
> A vanity prefix is cosmetic, not authentication. An attacker can grind the same first characters for a lookalike address. Tell visitors to verify the full string, never just the prefix.

## Build mkp224o

mkp224o is the standard generator for v3 addresses. Build it from source on the machine that will grind the key, ideally an offline workstation with a fast CPU. Install the build dependencies, then compile with the architecture flag for faster key generation.

```bash
sudo apt install -y git gcc libc6-dev libsodium-dev make autoconf
git clone https://github.com/cathugger/mkp224o
cd mkp224o
./autogen.sh
./configure --enable-amd64-51-30k
make
```

> [!NOTE]
> If make fails with an assembler error, the CPU is not amd64. Run `make clean`, configure again without the flag, then make. The default backend needs no flag and is still fast.

## Search for a vanity onion address

Give the tool one or more filters. It writes a directory of keys for each match. Use batch mode for a large speed gain, set the thread count to your cores, and stop after the first hit. On a modern CPU, four or five characters land in seconds and six in about a minute. Seven takes under an hour, and eight around a day. The amd64 backend runs faster still.

```bash
./mkp224o -B -t 4 -n 1 -d ~/onions hack
# set workdir: /root/onions/
# sorting filters... done.
# filters:
# 	hack
# in total, 1 filter
# using 4 threads
# hack7icgei24r3fxrad4ryual2chma6owhevf5upl45pzezbldc67tod.onion
# waiting for threads to finish... done.
```

Pass several filters at once to search for any of them in parallel, or load a long list with the filter file option. Each result directory holds a hostname file, a public key, and the secret key that defines the address.

## Install the key

Stop Tor, replace the service directory with the generated one, and fix the owner. Tor expects the directory to belong to the debian-tor user with 700 permissions. The torrc from the [hardened onion service](https://hackindex.io/blog/hardened-onion-service-ubuntu) build already points HiddenServiceDir at this path. mkp224o named the output directory after the address, so the first command reads it from the hostname file. Read the hostname back to confirm the new address is live.

```bash
ONION_ADDRESS=$(cat ~/onions/*/hostname)
sudo systemctl stop tor
sudo rm -rf /var/lib/tor/site
sudo cp -r ~/onions/$ONION_ADDRESS /var/lib/tor/site
sudo chown -R debian-tor:debian-tor /var/lib/tor/site
sudo chmod 700 /var/lib/tor/site
sudo systemctl start tor
sudo cat /var/lib/tor/site/hostname
# hack7icgei24r3fxrad4ryual2chma6owhevf5upl45pzezbldc67tod.onion
```

> [!CAUTION]
> The secret key is the address, and there is no rotation. Grind it offline, copy only the key to the server, and wipe the workstation copy when you are done. Never use a web based generator, since the operator then holds your key. Keep an encrypted offline backup of hs_ed25519_secret_key.

With the address in place, harden the rest of the stack in the [hardened onion service](https://hackindex.io/blog/hardened-onion-service-ubuntu) guide, or point several names at the same box in [running multiple onion services on one host](https://hackindex.io/blog/multiple-onion-services).

## References

- [mkp224o](https://github.com/cathugger/mkp224o) - Vanity address generator for v3 onion services.
- [Tor rendezvous specification v3](https://spec.torproject.org/rend-spec-v3) - Defines the v3 address encoding and key format.
- [Tor Project onion services](https://community.torproject.org/onion-services/) - Guidance on the service directory and key handling.