Home / Onion Explained / Network defences
Does a Torzon onion need HTTPS?
The http in an onion address bar is not the warning sign it would be on the regular web.
Encryption is built in
Traffic to an onion service is encrypted between your Tor Browser and the service itself, so http is not sent in the clear across the internet.
Why few use certificates
Certificates for onion addresses are available but rare. Most services, including market sites, rely on the onion layer alone.
The address is the identity
On the regular web a certificate links a name to a server. On an onion service the address itself plays that role.
What to check instead
Rather than the padlock, check that the full torzon onion address matches the one you verified.
For a Torzon onion the address itself is the identity check, so compare the address, not the padlock.