Vanity .onion

Customer-supplied v3 hidden-service keys with chosen prefixes (e.g., myname...onion). Available on Pro and Business.

Status: skeleton

Full content lands in a follow-up pass.

Generating the key

Use mkp224o on a machine you control. Mining time scales with prefix length:

Prefix	Approx. time on a modern laptop
4 chars	seconds
6 chars	minutes
8 chars	hours-to-days

mkp224o -d ./keys -n 1 myname

You get a directory myname...onion/ containing hs_ed25519_secret_key and hs_ed25519_public_key.

Uploading

1. In the portal: Sites → your site → Delivery tab → Vanity .onion
2. We display a signed URL valid for 5 minutes
3. Upload hs_ed25519_secret_key to that URL
4. Done. The portal validates the key, stores it in Azure Key Vault, and never displays it again. Edge picks it up on next reconcile.

What we never see

• The mining process (you do this on your machine)
• The private key in plaintext after upload (encrypted at rest in Key Vault)
• The key in any portal UI ever again (only "uploaded ✓" indicator)

OnionBalance (Business only)

Multiple backend hidden-service replicas behind a single front .onion. See the Business tier on the pricing page.