This guide explains Bitcoin Core Tor v3 onion services in plain English. It summarises the important changes, who they affect and what should be checked before an upgrade.
TL;DR
- What it is: Bitcoin Core 0.21 added Tor v3 hidden-service support and BIP 155 address relay. When automatic onion listening was enabled, Core created a v3 service by default and stored its key in onion_v3_private_key, leaving an existing Tor v2 key untouched.
- Why it matters: Tor v3 support modernised Core’s onion reachability in 0.21. Operators still needed to protect the new identity key, validate proxy and inbound paths independently and plan the privacy effects of continuity, rotation and downgrade.
- Current position: Require a second reviewer and explicit rollback or expiry, and pause payments, signing or network-dependent services until post-change evidence is complete.
Bitcoin Core Tor v3 onion services in simple English
Bitcoin Core Tor v3 onion services: Core 0.21 supported Tor v2 and v3 but default automatic creation moved to v3. Pin Tor and Core versions and distinguish local proxy use from advertising an inbound onion service.
Simple example
A node operator is checking Bitcoin Core Tor v3 onion services. Keep versioned backups and expect peer discovery to rebuild after downgrade. Older Core releases cannot understand every new peers.dat address record and may start with an empty peer database.
Key terms in plain English
- BIP:
- Bitcoin Improvement Proposal: a document describing a proposed rule, standard or process. Its status must be checked separately.
- Bitcoin Core:
- Widely used software that validates Bitcoin and can provide wallet, network and operator tools.
- Node:
- A computer running Bitcoin software that checks data and communicates with other peers.
Version boundary
Core 0.21 supported Tor v2 and v3 but default automatic creation moved to v3. Pin Tor and Core versions and distinguish local proxy use from advertising an inbound onion service.
Address relay
BIP 155 addrv2 enables peers to gossip Tor v3 and other longer network addresses. Receiving an address does not establish reachability, identity or trust.
Key files
The old onion_private_key remained untouched, while the v3 private key was stored as onion_v3_private_key. Protect ownership and mode, back up only under an explicit identity-retention policy and never expose either key.
Migration
Create and verify the v3 service, test inbound reachability through independent Tor paths, update authorised peer and monitoring records, then retire old references deliberately.
Rollback
Older Core releases cannot understand every new peers.dat address record and may start with an empty peer database. Keep versioned backups and expect peer discovery to rebuild after downgrade.
Privacy
A stable onion key is a persistent network identity. Decide whether continuity or rotation best fits the threat model, keep clearnet and onion correlations out of public logs and review DNS and proxy fallbacks.
How specialists test it
Node operators test the release on a representative non-production system. They check startup, normal operation, failure handling and restart before changing a live node. Connected wallets, monitoring and mining services should also be checked.
Frequently asked questions
What is the main point of Bitcoin Core Tor v3 onion services?
Bitcoin Core Tor v3 onion services: Core 0.21 supported Tor v2 and v3 but default automatic creation moved to v3.
For Bitcoin Core Tor v3 onion services, what should a beginner know about version boundary?
Core 0.21 supported Tor v2 and v3 but default automatic creation moved to v3.
For Bitcoin Core Tor v3 onion services, what should a beginner know about address relay?
BIP 155 addrv2 enables peers to gossip Tor v3 and other longer network addresses.
For Bitcoin Core Tor v3 onion services, what should a beginner know about key files?
The old onion_private_key remained untouched, while the v3 private key was stored as onion_v3_private_key.
Conclusion
Tor v3 support modernised Core’s onion reachability in 0.21. Operators still needed to protect the new identity key, validate proxy and inbound paths independently and plan the privacy effects of continuity, rotation and downgrade.
Primary sources
Check the current specification status and the documentation for the exact implementation you operate before moving production funds or changing a mining node.
Join the ASIC Mining Discussion
Members can read and join the discussion
Log in to read comments from other miners. Create a free account if you would like to ask a question or share your experience.
Membership helps us protect the discussion from spam and keep answers useful.