Tor network architecture, what a hidden service actually is

Nexus Market is a hidden service on the Tor network. It cannot be reached through a normal browser because a normal browser cannot resolve .onion addresses. This dossier explains what Tor is doing under the hood and why hidden services work the way they do.

The three-relay circuit

When Tor Browser connects to any destination, it builds a circuit through three relays. Each relay knows only its adjacent hops, never the full path from you to the destination.

The first relay is your guard. Tor uses the same guard for months to reduce the risk of anonymity attacks. The guard knows you are using Tor but does not know what you are doing.

The second relay is a middle. It sees encrypted traffic passing through and knows neither the source nor the destination.

The third relay is an exit. It sees your traffic in the clear (unless the destination itself uses HTTPS or is a hidden service, in which case the exit sees encrypted traffic even to the destination).

For a hidden service like Nexus, there is no exit in the traditional sense. Both the client and the service build their own circuits and meet at a rendezvous point inside the Tor network.

Hidden service descriptors

Every hidden service publishes descriptors to the Tor network directory. The descriptors tell clients which introduction points to use to reach the service. When you type an onion address, Tor Browser looks up the descriptors, contacts an introduction point, and negotiates a rendezvous.

Descriptors are re-uploaded periodically. If a hidden service's descriptors go stale, clients temporarily cannot reach the service until fresh descriptors propagate. This is one reason why a mirror can appear temporarily down and then return without any actual change to the storefront.

Why onion addresses are Tor-only

The public key encoded in an onion address is meaningful only inside the Tor network. There is no clearnet DNS record for it. There is no clearnet HTTP path that returns anything at that address. The address is a Tor-network-internal identifier, and only Tor Browser (or another Tor-aware client) can resolve it.

This is why anyone claiming Nexus has a clearnet address is either lying or confused. The storefront is definitionally Tor-only.

Guard node stability

Your Tor Browser picks a guard on first use and keeps it for approximately three months. This is deliberate: shuffling guards frequently increases the probability that you will eventually pick a hostile guard, which reduces your anonymity. Long-lived guards reduce this risk.

The practical implication for readers: if a particular Nexus mirror always seems slow for you, it may be your guard's fault. New Identity in Tor Browser will pick fresh circuits but not a fresh guard. To fully replace the guard, you would need to reset Tor Browser state.