Reading an address
The cheapest improvement available here, and it takes about five seconds longer than what most people already do.
How people actually read one
Shown fifty six characters of unpredictable text, almost everybody reads the first four or five, glances at the end, and accepts it. That is not laziness, it is how reading works. Long random strings get sampled, and the samples people take are the boundaries.
Forgery is built around that. Matching a recognisable opening is cheap, matching the middle is not worth the compute, and matching everything is impossible. So the differing characters sit exactly where sampling does not reach.
The one exception
Something on your own machine replacing an address between the copy and the paste replaces the whole string rather than resembling it. That is caught immediately by checking the first and last several characters of what actually landed in the field, and it is the only situation here where the quick check is the right one.
| Situation | Which part to compare |
|---|---|
| An address from a page or a message | The middle. A forgery resembles the original. |
| What appeared after you pasted | The ends. A substitution replaces everything. |
| Either, done properly | Paste both strings somewhere that reports an exact match. Human comparison of random characters is unreliable however careful you are. |
Things that are not the problem
- Confusable characters. The alphabet used here excludes visually ambiguous pairs by design, so an address that looks slightly off genuinely is off. Never a font issue.
- Case. Onion addresses are case insensitive, so mixed case is formatting rather than a different address.
- Length. Always fifty six characters before the suffix. A sixteen character one is from a retired version of the protocol that stopped resolving years ago, which tells you everything about whatever published it.
What the string can never tell you
Who runs it, where it is, or whether it is safe. Identifiers carry no reputation, and there is no property of the characters that separates a market from an imitation of it. This is where habits from ordinary browsing mislead, because a domain name carries at least a hint about who registered it. An onion address carries exactly one claim, which is that whoever answers holds the key, and only a signature turns that into evidence.