Nexus Link Desk Provenance, not popularity
Link Desk / How a link ages

Current Nexus addresses

Three nodes, one platform behind them. Copy, never retype, and verify the signature when you arrive.

Node 01 nexusb2l7fmqnefwphyy7m5zjhlkytlbo7qbb5lu5dlczr3azgii2gyd.onion
Node 02 nexusma2iqgauqqvjcgds4ckv5xbf272tkfagq4epojjhsgleqpwxiqd.onion
Node 03 nexusabcd6tyfhdwilyitaqiri6tisj2v2hueyjuj6qkvd6azvi5tuqd.onion

An address that loads is not an address that is genuine. The check that settles it takes under a minute.

How a link is made

Understanding where an address comes from explains almost everything else about how they behave, including why forgery takes the exact shape it does.

Nobody hands them out

A v3 onion address is fifty six characters of base32 plus the suffix, and those characters are computed rather than assigned. Generate a keypair, take the public half, add a checksum and a version byte, encode it. The address falls out of the key.

There is no registrar in this process. Nobody applies, nobody approves, nobody keeps a list. That has two consequences pointing in opposite directions. No authority can take an address away, which is the property the whole design exists for. And no authority can confirm one belongs to whoever claims it, which is the problem this entire site is about.

The whole thing in one lineThe address is the key. That single sentence explains why they are long, why they look random, why they cannot be seized, and why nothing about a string tells you who holds it.

Why they are that long

Because the length is the security. Fifty six characters of base32 encode enough to make guessing a specific address impossible with any amount of computing. Shorter addresses were tried in an earlier version of the protocol and retired, partly for exactly this reason.

The length also creates the usability problem that produces every attack in this catalogue. Nobody can memorise one, nobody wants to compare one carefully, and everybody copies them from somewhere. The copying is where the risk enters, and it enters because the security property that makes addresses unguessable makes them unreadable.

Vanity generation, the part that matters

You cannot choose an address, but you can keep generating keypairs until one starts with characters you want. This is ordinary and legitimate, and it is why real Nexus addresses begin recognisably.

Four or five charactersSeconds to minutes on a laptop. Cheap enough that anyone can do it.
Seven or eight charactersHours to days. Still entirely practical for someone motivated.
Twelve or moreNot feasible. The search space grows too fast.
The whole addressImpossible, and this is the property everything rests on.

Read that table and the forgery model writes itself. An attacker can match the recognisable opening for nothing. They cannot match the whole thing at any price. So every forged address has a familiar start and a different middle, which is precisely the region a human reader skips.

What happens after generation

  1. The keypair is generated and the private half is stored wherever the service runs. Whoever holds it can serve traffic at that address and nobody else can, ever.
  2. The service publishes a signed descriptor into the Tor directory system so clients can find it. This repeats regularly and is the most common thing to fail.
  3. The address is signed under the platform key and added to the published roster, which is the only step that makes it verifiable to you.
  4. It is published, and from that moment it begins spreading beyond anyone's control.

Step three is the one worth noticing. Generation makes an address exist. Signing is what makes it possible for you to establish it belongs to the platform, and an address that exists without being signed into a roster is just a string somebody produced.