What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To keep the same v3 onion address when moving a service, preserve its existing service identity and restore that data on the destination Tor instance. In practice, back up the complete HiddenServiceDir, configure the new Tor instance to use that directory, restore the files with appropriate permissions, restart Tor, and test the address in Tor Browser.
Copying the text in the hostname file is not enough. The address is derived from the service identity, so a newly initialized directory creates a different identity and therefore a different onion address.
Why the onion address follows the service identity
A v3 onion address is tied to the onion service’s identity public key. The service uses the matching private key to sign its descriptor, allowing Tor clients to verify that they reached the service that owns that address. The Tor Project explains this relationship in its onion-service protocol overview.
The identity material is stored with the service data in HiddenServiceDir. When Tor starts with an empty directory, it generates a new identity. That new identity produces a new hostname even if the web application, port, and server name are unchanged.
#1 Best Overall
- Hardware encrypted drive
- Simple to use pin access. RPM-5400
- Administrator password feature
- Bus powered
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
- Preserved identity directory: the destination can advertise the original onion address.
- New or empty identity directory: Tor creates a new onion service and address.
- Hostname text only: useful for recording and checking the address, but it cannot authenticate the service.
Tor’s setup guidance describes HiddenServiceDir as the location for service information and cryptographic keys. Treat the directory as the asset that must be migrated, not merely as a folder containing configuration output.
What to record before touching the source server
Make an inventory while the existing service is still working. Configuration paths and service-management commands differ by operating system and package, so record the values from the actual host rather than relying on a generic example.
Record the current address and directory
Read the hostname file inside the active HiddenServiceDir and save the complete v3 address in a secure operations record. Also record the exact path of the directory. The hostname file is a verification reference; the directory containing the private identity material is what preserves the address.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRecord virtual-to-local port mappings
Copy every HiddenServicePort line from the Tor configuration. Note both sides of each mapping: the virtual port exposed through the onion service and the local destination address, TCP port, or Unix socket. Tor’s setup example maps virtual port 80 to a local web server and also demonstrates a Unix-socket destination. Reproduce the mapping that your application actually uses.
Record authorization status
Determine whether client authorization is enabled. An authorized onion service has additional service-side and client-side credentials, so a migration plan that covers only the identity directory can leave approved clients unable to connect. The separate credential roles are described in Tor’s client-authorization documentation.
Record the application endpoint
Write down the destination application’s bind address, port or socket path, and any local firewall or service dependency that must be present before Tor is started. This prevents a successful Tor restart from being mistaken for a working website when the backend is not listening.
Back up the service identity safely
Quiesce the source before copying
Use the source host’s normal service-management procedure to stop Tor or otherwise prevent changes to the onion-service directory while the backup is made. The goal is a complete, internally consistent copy of the directory, including private identity material and supporting files. If your operating system or package has a documented maintenance procedure, follow it; there is no single cross-platform stop command that applies to every installation.
Free tools Windows power users keep installed
One-click scans. No signup required.
Copy the complete HiddenServiceDir
Make a protected copy of the existing directory rather than recreating files from notes. At minimum, the copy must include the private identity key; in practice, preserving the complete directory avoids omitting service metadata or authorization files that the installation expects.
Tor specifically recommends retaining a backup copy of the private_key file for an onion service intended to remain available over the long term. A leaked service key can allow another party to impersonate the service, so store the backup where only the administrators who need it can read it. Do not put it in a public repository, attach it to an unprotected ticket, or include it in routine logs.
Rank #2
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
- Super fast USB 3.0 Connection - Data transfer speeds up to 10X faster than USB 2.0
- Software Free Design - With no admin rights needed
- Sealed from Physical Attacks by Tough Epoxy Coating
- Brute Force Self Destruct Feature
Choose protection appropriate to the key
Encryption, access controls, and storage location are operational choices. An encrypted external drive is one possible implementation, but Tor does not mandate a particular medium or require offline storage. Whichever medium you use, limit access, retain the original directory until the destination has been verified, and keep at least one protected recovery copy.
Check that the backup is usable
Before changing the source, compare the backup’s file list with the original and confirm that the saved hostname value matches the address you recorded. Do not alter private-key contents while copying. If your backup system supports integrity checks, use them to detect an incomplete transfer; the check protects the copy, but it does not replace the need to keep the key confidential.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Prepare the destination host
Bring up the local application first
Install or restore the website or application on the destination and verify that it responds at the local endpoint you recorded. Test the backend directly from the destination host before adding Tor. An onion address can remain correct while the service behind it returns a connection error, a blank response, or an application-level failure.
Configure the preserved service directory
Set the destination Tor configuration’s HiddenServiceDir to the path where you will restore the protected copy. Recreate each required HiddenServicePort mapping. A minimal pattern looks like this:
HiddenServiceDir /path/to/preserved-service-directory
HiddenServicePort 80 127.0.0.1:8080The values above illustrate the relationship only: virtual port 80 is forwarded to a local web server on port 8080. Use your recorded mappings, including any Unix-socket endpoint, rather than copying these example values blindly.
Check the Tor process account and permissions
The configured directory must be readable and writable by the Tor process, while the private files must remain inaccessible to unrelated users. Determine the actual service account used by the destination package and apply permissions consistent with that installation. Ownership and mode commands vary between distributions, containers, and manually installed Tor builds, so do not assume the source host’s account name or numeric user ID exists on the destination.
Keep configuration paths distinct
Some systems place Tor configuration under distribution-specific directories, while others use a custom instance or container layout. Confirm that the configuration file you edited belongs to the Tor instance you will restart. Pointing one instance at the restored directory while restarting another is a common way to produce an apparently unchanged or newly generated address.
Move and restore the protected directory
Transfer it through a controlled channel
Use a transfer method approved for private keys and remove or secure temporary copies created along the way. Avoid shared staging directories, world-readable archives, and shell history or logs that expose the key path or archive contents. If a third-party backup service is involved, verify its access policy before placing the service directory there.
Restore at the configured path
Extract or copy the directory exactly where HiddenServiceDir points. Preserve the files and subdirectories expected by the installation; do not create a second empty directory with the same intended name and leave the restored data elsewhere. After restoration, verify that the destination Tor account can access the directory and that other users cannot read the private identity material.
Rank #3
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Keep the source available during the cutover
Do not delete the source directory immediately. Retain it in a protected state until the destination has started successfully and the onion address has been tested. Running both instances as active publishers for an extended period can create operational confusion, so coordinate the handoff according to your deployment procedure, but preserve the source as a rollback copy while you validate the move.
Restart Tor and verify the original address
Restart the correct Tor instance
Use the service command appropriate to the destination platform. Tor’s setup page gives this Debian-like example:
sudo systemctl restart torThis command is an example, not a universal service name. A different distribution, container, or custom instance may use another unit or supervisor. Confirm that the restart targeted the instance configured with the preserved directory.
Read the logs immediately
If Tor does not start, inspect its service logs and configuration output before changing files. Tor’s setup guidance identifies typographical errors and directory-permission problems as common causes. Check the spelling and path of HiddenServiceDir, every HiddenServicePort line, the existence of the restored files, and access by the actual Tor process account.
Compare the hostname
Read the destination’s hostname file and compare it with the address recorded from the source. A matching value is an important identity check. If the value differs, stop treating the destination as a successful migration and investigate whether Tor was pointed at an empty directory, the wrong path, or a different instance. This diagnosis follows from the documented relationship between the service identity directory and the onion address.
Test through Tor Browser
Open the preserved address in Tor Browser and confirm that the intended application responds. Test the application behavior that matters to users, not only whether a TCP connection occurs: load representative pages, sign in if appropriate, and check any service-specific endpoint that should be available. Keep the test focused on the onion service; do not expose the private key or diagnostic files through the application.
Restore client authorization separately
Client authorization is an additional access-control layer, not a replacement for the service identity. Tor’s authorization model uses public authorization keys on the service side and private authorization files on clients. Those credentials must be preserved and deployed according to their roles.
Service-side files
When restoring the service, include the authorization data expected by the configured onion-service instance. Protect it with the same care as the identity directory, while remembering that service-side authorization material can have a different public/private role than the identity key.
Client-side credentials
Authorized users need their client-side private authorization files in the location and format expected by their Tor Browser or Tor configuration. A client that worked before the move may fail afterward if only the service was restored and the client credential was lost, renamed, or placed in a different profile.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #4
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Test an authorized and an unauthorized client
Use an approved client to confirm that access still works. If your policy permits, also test from a client without credentials to verify that the authorization boundary remains in effect. This checks a different failure mode from an address mismatch: the service may have the correct identity but an incomplete authorization configuration.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshoot the common migration failures
The onion address changed
Likely cause: Tor generated a new identity because it started with an empty or incorrect HiddenServiceDir.
- Stop the destination Tor instance according to the platform’s service procedure.
- Confirm the configured directory path character by character.
- Check that the restored private identity files are actually under that path, not in a nested extraction directory.
- Verify that the restarted instance is the one using that configuration.
- Restore the protected copy again if the directory was overwritten, then restart and compare the
hostnamefile.
Do not try to repair the address by editing the hostname text. The address is authenticated by the identity key, not by a manually chosen filename or string.
Tor fails to start
Likely causes: a typo in the configuration, a missing directory, or permissions that prevent the Tor process from reading or writing the service data.
- Read the Tor service log for the first configuration or filesystem error.
- Validate every
HiddenServiceDirandHiddenServicePortentry. - Confirm that the destination path exists and contains the restored files.
- Check the service account’s read and write access without making the directory broadly readable.
- Confirm that the local application endpoint exists if Tor reports a backend connection problem.
The address is correct but the site does not respond
Likely cause: Tor is using the preserved identity, but the application or port mapping was not migrated correctly.
- Test the local application directly at the destination endpoint.
- Compare each
HiddenServicePortmapping with the source inventory. - Check whether the application now listens on a different interface, port, or Unix-socket path.
- Review host firewall rules and local service dependencies.
- Retest through Tor Browser after the backend responds locally.
Previously authorized clients are denied
Likely cause: authorization credentials were omitted or placed under a different client profile.
Confirm that the service-side authorization data was restored with the service configuration and that each client still has its private authorization file. Compare the configured locations rather than assuming that restoring the identity directory also restores every client credential.
The destination appears to be running the wrong configuration
If logs show a different directory, port, or instance than expected, identify all installed Tor services, containers, or custom instances on the host. Stop the unintended instance, associate the intended configuration with its service definition, and repeat the hostname and browser checks. Multiple instances can make a correct backup appear ineffective when the wrong process is being inspected.
Recommended Free Tools
What this migration does not move automatically
Preserving HiddenServiceDir preserves the onion service identity and its address. It does not, by itself, migrate the rest of the host.
- Website files and application code must be deployed separately.
- Databases and uploaded content require their own consistent backup and restore process.
- Application secrets, environment variables, and API credentials are separate from Tor’s identity files.
- TLS certificates or other application-layer security settings need independent handling.
- Firewall rules, reverse-proxy configuration, scheduled jobs, monitoring, and operating-system policies are not contained in the onion-service directory.
Plan and test those dependencies independently, then use the Tor migration checks to confirm that the preserved address reaches the restored application.
Quick Recap
Final migration checklist
- Record the source
hostname, exactHiddenServiceDirpath, allHiddenServicePortmappings, backend endpoint, and authorization status. - Quiesce the source and make a complete, protected copy of the service directory.
- Keep the private identity material confidential and retain a recovery copy.
- Restore the application and verify its local endpoint on the destination.
- Configure the destination Tor instance to use the restored directory and matching port mappings.
- Set permissions for the actual Tor process account without exposing private files to other users.
- Transfer the directory through a controlled channel and remove unsafe temporary copies.
- Restart the intended Tor instance using the destination platform’s service procedure.
- Read logs if startup fails, then verify the destination
hostnamematches the source. - Open the address in Tor Browser and test the application.
- Restore and test client-authorization credentials separately when authorization is enabled.
- Retain the protected source backup until the destination and dependent application services are stable.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
