An open-source, privacy-enhancing web browser for iOS, utilizing the Tor anonymity network

Last update: Dec 30, 2022

Overview

Onion Browser

Official Site | Support | Release History | Donate
© 2012-2020, Tigas Ventures, LLC (Mike Tigas)

This is the Onion Browser 2.X branch, based on Endless. The old version of Onion Browser can be found here.

Onion Browser is a free web browser for iPhone and iPad that encrypts and tunnels web traffic through the Tor network. See the official site for more details and App Store links.

Please see the LICENSE file for usage and redistribution terms.

Onion Browser: 2.7.6 - See official release history and changelog.
Tor.framework: 405.10.1
Tor: 0.4.5.10
libevent: 2.1.12
OpenSSL: 1.1.1l
liblzma: 5.2.5

Notable 2.X Features

The following features are new to Onion Browser, by way of the upstream work on Endless:

Multiple tab support
Search from URL bar
Ability to configure security and privacy settings (script blocking, etc) on a per-site basis
Per-site cookie handling
HTTPS Everywhere support
HTTP Strict Transport Security (HSTS) support, pre-loaded with the Chromium ruleset
Ability to view SSL certificate information, to allow manual verification of SSL certificates

Acknowledgements

These people helped with translations. Thank you so much, folks!

Albanian: Besnik, Kristina_Millona, alter2000, elioqoshi, vilisuli, marianaballa
Arabic: AboShanab, mada19, BNasr, Hujairi, MissPeace, ahmedessamdev, Bild96, Israel.K
Bengali: codesmite, Al_Shahrior, BNasr, hasan_md_rakib, nr072
Catalán: Ecron, pau.selles, Aetheria, Fitoschido, jmontane
Chinese (Simplified): Selinaf, feeblebiscuit, tsaizb, Lafrenze, ff98sha, 99yongliu, Lafrenze, chrisx8_, jxtsai
Chinese (Traditional): Selinaf, s8321414, jxtsai, MengPangWang, tsaizb, austinchang
Croatian milotype, paranatox
Czech: Plarome, Lumeriol, hernikplays
Dutch: SilverXp, biancahey, kwadronaut, pljmn, Meteor0id, ChillT, lucasz10
French: yahoe.001
German: Atalanttore, beonex1, nautilusx, ChristophSchulz, L10N, LordExtra, m_rey
Greek: dmaroulidis, KAUTH, pappasadrian, ssk1, apapac, arammos, beonex1, giormatsis
Hebrew: IONIL
Hindi: balapandu222, drashti4, umkdikshit, josprachi, libregeekingkid, philo_math, sonusandeep, suremak
Hungarian: benewfy, vargaviktor
Icelandic: anarchodin, sveinki
Italian: EllipticSet, Rhaal, RickDeckard, ryuw
Irish: kscanne
Korean: MinGyu19, jmj050716, sector429
Japanese: Naofumi, Songbogong, TokumeiNanashi, pluto987, jpanonowl, TENCO, kiririn
Macedonian: Liljana_Ackovska, Zarko_Gjurov, MatejMecka
Norwegian (Bokmål): kingu, eirik174
Persian: ariaa, arminoza, nariman, sabs, magnifico, Gilberto1, Zaefarani, alinbipr, hamidreza_yazdani, mo.hoseini, noneck, voxp, gonjayesh, koofi, nonecknoel
Polish: GEEZET1, Pihjun, tenderloin, weegoor, wiktoriatomzik
Portuguese (Brazil): flaviove, CypherZnnb, Bk__13, CRCF, darkcrystal, eduaddadbr, leovasone, nopum, vmattos, Communia
Portuguese (Portugal): manuelarodsilva, Bk__13, mrBatsu
Russian: anm, dianazryn, emedvedev, Ifti, foxing29, neocaching
Spanish: arielbarbosa, Maria_Jose, emmapeel, strel, zakooch, Aetheria, Fabiola.mauriceh, Fitoschido, kodachi, lenazun, nosense, supermigue2000, vareli, antonela_
Thai: bact'
Turkish:
falcontr06, kayazeren, ali_demirtas
Ukrainian: Herenko, lyubomyr, MykolaBubelich
Vietnamese: AshCopper, PMinhDuc, Shinigami

Contributors

This project exists thanks to all the people who contribute.

Backers

Thank you to all our backers! 🙏 [Become a backer]

How to build yourself

Build instructions can be found in BUILD.md.

Comments

Allow file download or opening rich content in other apps

Hi there! Good work in The Browser! i'd love to take my PDFs and stuff with me. If you dont want/cant add a filemanager, an "open in..." button would be nice.
enhancement

opened by s-ol 18
Tor stuck on "Connecting to directory server" using IPv6

Hi, Tor doesn't connect at all when using IPv6 network. It's stuck on Connecting to directory server.

This was the console log, BOOTSTRAP PROGRESS=5 TAG=conn_dir SUMMARY="Connecting to directory server" WARNING="Network is unreachable" REASON=NOROUTE

opened by al-ht10 16
iOS seems to be leaking OCSP outside of Onion Browser
UPDATE, JUNE 15 2019: See advisory note & summary about this leak:
2019-178: sites with EV HTTPS certificates leak information via OCSP

Original GitHub issue:

Onion Browser on iOS is leaking data about some visited sites (both onion services and clearnet hosted servers). This happens because the browser checks for certificate revocations with OCSPv1 over non tor transport.

OCSP requests and responses made by Onion Browser goes via regular network, and since these are HTTP requests, any party with enough access to network can sniff it and identify the domains user is visiting.

Steps to reproduce

Consider a scenario where user is connected to an evil access point running tcpdump, and tries visiting “www.nytimes3xbfgragh.onion” in Onion Browser.

As you can see, the OCSP request is going via non TOR transport in HTTP and we can dump and Identify the domain.

We were also able to reproduce it for other OCSPv1 services - we tested

https://www.grindr.com

https://check.torproject.org

https://nytimes.com

https://flixbus.com/

We can also provide the packet dumps if you need.

Decoding an OCSP response =========================

Since the request payload is small OCSP spec allows it to be encoded in request URI. We got the http requests from browser on regular transport from tcpdump.

for e.g, this is the one from nytimes onion service. [Full request URI: http://ocsp.digicert.com/MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFEn0vYoYv3YGmMXeQC1oO3Fq5OaGBBQ901Cl1qCt7vNKYApl0yHU%2BPjWDwIQATXM5lnIy5Cdngkc9hmitg%3D%3D]

Reversing the encodings and parsing with ocsptool from gnuTLS.

echo MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFEn0vYoYv3YGmMXeQC1oO3Fq5OaGBBQ901Cl1qCt7vNKYApl0yHU%2BPjWDwIQATXM5lnIy5Cdngkc9hmitg%3D%3D | python -c "import sys, urllib.parse as ul; print(ul.unquote(sys.stdin.read()));" | base64 -d | ocsptool -i OCSP Request Information: Version: 1 Request List: Certificate ID: Hash Algorithm: SHA1 Issuer Name Hash: 49f4bd8a18bf760698c5de402d683b716ae4e686 Issuer Key Hash: 3dd350a5d6a0adeef34a600a65d321d4f8f8d60f Serial Number: 0135cce659c8cb909d9e091cf619a2b6

Looking this serial up in cert logs, you can see this is an OCSP request for nytimes onion services.

https://crt.sh/?serial=0135cce659c8cb909d9e091cf619a2b6

X509v3 Subject Alternative Name: DNS:nytimes3xbfgragh.onion DNS:graylady3jvrrxbe.onion DNS:.graylady3jvrrxbe.onion DNS:.dev.graylady3jvrrxbe.onionDNS:.stg.graylady3jvrrxbe.onion DNS:.nytimes3xbfgragh.onionDNS:.api.nytimes3xbfgragh.onion DNS:.api.dev.nytimes3xbfgragh.onionDNS:.api.stg.nytimes3xbfgragh.onion DNS:.blogs.nytimes3xbfgragh.onionDNS:.blogs.stg.nytimes3xbfgragh.onion DNS:.blogs5.stg.nytimes3xbfgragh.onionDNS:.dev.nytimes3xbfgragh.onion DNS:.dev.blogs.nytimes3xbfgragh.onionDNS:.newsdev.nytimes3xbfgragh.onion DNS:.prd.nytimes3xbfgragh.onionDNS:.sbx.nytimes3xbfgragh.onion DNS:.stg.nytimes3xbfgragh.onionDNS:.stg.blogs.nytimes3xbfgragh.onion DNS:.stg.newsdev.nytimes3xbfgragh.onionDNS:www.bestsellers.nytimes3xbfgragh.onion DNS:www.homedelivery.nytimes3xbfgragh.onion
opened by r3ckd 15
[1.X][2.X] Connection occasionally times out and does not recover → app becomes unable to load sites

Workaround: Force quit app (tap home to quit app, double-tap home, hold down on app icon in tray, and "delete" app) and then restart app.

Hard to recreate issue when running app for more than a few minutes.

Seems to happen regardless of if app has gone into background or if network has gone up/down. (In fact, app does send HUP to Tor in those circumstances, causing Tor to reload & build new connections.) #3 would help (and is related), but this is a more specific issue than that.
bug

opened by mtigas 15
Connecting to Linkedin SSL error

Connecting to https://linkedin.com gives an SSL error (see screenshot). It works with desktop Tor browser, so i suppose it's not a Linkedin issue?

I tried to reduce security levels to 1 and also downgrade TLS in the settings, but nothing helped.

iOS 13.3.1 OnionBrowser 2.5.0

opened by ikonkere 14
Onion Browser 2.0 may be leaking DNS requests
When using Onion Browser 2.0, I'm seeing that non-onion domains are appearing in my DNS' log (using pi-hole). When using the Tor Browser on Mac, those same domains aren't appearing.

Environment & Steps: iPhone X, iOS 11.2.2

Connect to my VPN (passes through a pi-hole)

Visit a non-Onion URL using Onion Browser 2.0

Notice that the site and the calls from that site are appearing in the pi-hole log
opened by Cauchon 14
[2.X] Prompt for automatic use of bridges after 15 seconds

Possible new feature:

After 15 seconds of stalled initialization, automatically prompt user to try to use bridges (using obfs4 by default?)

Cuts out step where user has to wait and get frustrated that app isn't working, and then go into the bridge prompt and then have to figure out what to do.
enhancement

opened by mtigas 14
Allow some manual torrc configuration (for things like HidServAuth)

Hi!

following the tutorial for hass https://home-assistant.io/cookbook/tor_configuration/ I got the Onion browser but can't find the way to add my authentication cookie, is this a missing feature?

opened by bigzaqui 14
Javascript is still on with gold

Hello, Thank you for the app. I left a tip. Some onion sites block me because it say javascript is still on even though I have it on the gold setting with no javascript selected. Please help

opened by 232qwer 13
Finalize security level language
Is it:

Insecure / Moderate / Secure

or

Low / Moderate / Maximum

The website currently shows the 2nd, versus the App shows the 1st option.

Should we match Tor Browser?

Standard / Safer / Safest?

There is concern that our "Standard" on Tor Browser is not equivalent

Let's find a way to survey, review, wordsmith what we need.
opened by n8fr8 13

Examine why tor is opening many (20+) circuits; is this correct behavior?

(example output from @tladesignz testing; i've added newlines before each BUILT output line)

24
BUILT $E135D5384EA42B4A771268CDA139D73D1C16A2C4~yutu,$1CB6DB698C49965D3C75A09B8D9EBFDD0E3B5603~kleinbus,$7BFB908A3AA5B491DA4CA72CCBEE0E1F2A939B55~sofia BUILD_FLAGS=NEED_CAPACITY PURPOSE=GENERAL TIME_CREATED=2019-12-10T12:34:01.39164748
BUILT $E135D5384EA42B4A771268CDA139D73D1C16A2C4~yutu,$F6E26FDF3A14117372856476339F878EEB8C2BB8~Nozel10,$DE465B3D36877D578627120DEF61C166D653FC4E~yuicat11 BUILD_FLAGS=IS_INTERNAL,NEED_CAPACITY PURPOSE=GENERAL TIME_CREATED=2019-12-10T13:26:44.03221327
BUILT $E135D5384EA42B4A771268CDA139D73D1C16A2C4~yutu,$EE4AF632058F0734C1426B1AD689F47445CA2056~angeltest7,$1297DB025DDDC46ADCB9D232E15B02E65272FE72~TPC2 BUILD_FLAGS=NEED_CAPACITY PURPOSE=GENERAL TIME_CREATED=2019-12-10T13:26:08.91619749
BUILT $E135D5384EA42B4A771268CDA139D73D1C16A2C4~yutu,$C4673051AF84961E55BAA1D25655CE5168BD70BE~Piratenpartei4,$EC80EECFCD599612C9A74678C8001146450141E8~fr0akatala BUILD_FLAGS=IS_INTERNAL,NEED_CAPACITY PURPOSE=GENERAL TIME_CREATED=2019-12-10T13:26:45.03660450
BUILT $E135D5384EA42B4A771268CDA139D73D1C16A2C4~yutu,$A4C83C2BEB4F1B31D40E80D5524C66A117D77C50~kiwirelay,$395D293263E9DEEC1874503D45B8543DABACC694~snukafly BUILD_FLAGS=IS_INTERNAL,NEED_CAPACITY PURPOSE=GENERAL TIME_CREATED=2019-12-10T13:26:46.03676530
BUILT $E135D5384EA42B4A771268CDA139D73D1C16A2C4~yutu,$511F66E40495E3B45EA21F0023DF714DB487257A~MLTorNode02,$0FB2EDAB99D10A2B708370E625323C76EB895FA2~niftyhazelmouse BUILD_FLAGS=NEED_CAPACITY PURPOSE=GENERAL TIME_CREATED=2019-12-10T13:26:22.68372531
BUILT $E135D5384EA42B4A771268CDA139D73D1C16A2C4~yutu,$A6E0F950CAC74AF867CA21976069529D6D4D3E30~HRMB,$4031460683AE9E0512D3620C2758D98758AC6C93~niftyeuropeanrabbit BUILD_FLAGS=NEED_CAPACITY PURPOSE=GENERAL TIME_CREATED=2019-12-10T13:26:22.95912532
BUILT $E135D5384EA42B4A771268CDA139D73D1C16A2C4~yutu,$0C3D5E19E3C75B505C8ACD26F89DCA2DF970553E~HORUS1,$DE847D94E78B2E560AB87D272DC90192D3144F17~kohlrabi BUILD_FLAGS=NEED_CAPACITY PURPOSE=GENERAL TIME_CREATED=2019-12-10T13:26:23.95957433
BUILT $E135D5384EA42B4A771268CDA139D73D1C16A2C4~yutu,$F65990C23AB017AC37226EB2AD3DA5A8EAE55D0C~binaery,$3A65D7E0FA8FC92AF99FB54CD8CA3276FBA33F03~Unnamed,$B5506D8E03F7BEAFA1A955DD3C39B38F830B2F4E~tor4kryptonit BUILD_FLAGS=IS_INTERNAL,NEED_CAPACITY PURPOSE=HS_CLIENT_HSDIR HS_STATE=HSCI_CONNECTING TIME_CREATED=2019-12-10T13:26:30.89451634
BUILT $E135D5384EA42B4A771268CDA139D73D1C16A2C4~yutu,$73F89EF2EE0F5C54064AC52BE9C111349CD9E8C4~bbtrotro,$3DC748C2DFF1F8E9DA5626BB3CBAAFF31D706C10~Fussy BUILD_FLAGS=IS_INTERNAL,NEED_CAPACITY PURPOSE=HS_CLIENT_REND HS_STATE=HSCR_JOINED REND_QUERY=3g2upl4pq6kufc4m TIME_CREATED=2019-12-10T13:26:30.98581735
BUILT $E135D5384EA42B4A771268CDA139D73D1C16A2C4~yutu,$066735D43FB476FA64578C5D829E176DF53E5A00~FreifunkIbbenbueren,$9E1E4F5B5F94812D02C4D18CB4086CE71CA5C614~torpidsDEhetzner1 BUILD_FLAGS=IS_INTERNAL,NEED_CAPACITY PURPOSE=HS_CLIENT_REND HS_STATE=HSCR_ESTABLISHED_IDLE REND_QUERY=3g2upl4pq6kufc4m TIME_CREATED=2019-12-10T13:26:31.98795137
BUILT $E135D5384EA42B4A771268CDA139D73D1C16A2C4~yutu,$25990FC54D7268C914170A118EE4EE75025451DA~TotorBE1,$A1B7C1F83E5DA4376FD2E1DBA7AC28A71AB332AD~arnall,$03910F285A33F365838EC66EF2C2EF754D046760~operator BUILD_FLAGS=IS_INTERNAL,NEED_CAPACITY PURPOSE=HS_CLIENT_INTRO HS_STATE=HSCI_CONNECTING REND_QUERY=3g2upl4pq6kufc4m TIME_CREATED=2019-12-10T13:26:32.98894139
BUILT $E135D5384EA42B4A771268CDA139D73D1C16A2C4~yutu,$3239007CE1FB2ECDFDF2067DF23B949295DC5EF6~TOR2DFN01a,$645DE9BF7A2E858F8A6B45F1F530371176D0238A~coco BUILD_FLAGS=IS_INTERNAL,NEED_CAPACITY PURPOSE=GENERAL TIME_CREATED=2019-12-10T13:26:34.99110940
BUILT $E135D5384EA42B4A771268CDA139D73D1C16A2C4~yutu,$066735D43FB476FA64578C5D829E176DF53E5A00~FreifunkIbbenbueren,$F248E8CEC8EAEA46E658DCA43500958FF21F4F46~manningisfree BUILD_FLAGS=IS_INTERNAL,NEED_CAPACITY PURPOSE=GENERAL TIME_CREATED=2019-12-10T13:26:35.99241141
BUILT $E135D5384EA42B4A771268CDA139D73D1C16A2C4~yutu,$F0C9513539800F762ECAE37F16370D7CBA5E52C2~Scrubs,$96DCD1D17C1F0FA4DED207C148E54C0A55553076~Honkler BUILD_FLAGS=IS_INTERNAL,NEED_CAPACITY PURPOSE=GENERAL TIME_CREATED=2019-12-10T13:26:36.99352842
BUILT $E135D5384EA42B4A771268CDA139D73D1C16A2C4~yutu,$5B1F0DAF378A1FAFCFD5FA9CDC66D1023DC0276E~fastlane,$0AD3B16ADF3EED3E5962FA944CD501352E790814~ritirong BUILD_FLAGS=IS_INTERNAL,NEED_CAPACITY PURPOSE=GENERAL TIME_CREATED=2019-12-10T13:26:37.99832043
BUILT $E135D5384EA42B4A771268CDA139D73D1C16A2C4~yutu,$303509AB910EF207B7438C27435C4A2FD579F1B1~Ukko,$13BC57BE4A6287D5C9AB970E94823BCAF7B5FFB2~OneTwoThree BUILD_FLAGS=IS_INTERNAL,NEED_CAPACITY PURPOSE=GENERAL TIME_CREATED=2019-12-10T13:26:39.00017044
BUILT $E135D5384EA42B4A771268CDA139D73D1C16A2C4~yutu,$16AE2704B794C6C0013C7E47AF11DCABA808A0B9~torreyporrey,$8ABC4D5F6182C7E79B087D1ED9E5CF652C83E52C~UDEtor BUILD_FLAGS=IS_INTERNAL,NEED_CAPACITY PURPOSE=GENERAL TIME_CREATED=2019-12-10T13:26:40.00053745
BUILT $E135D5384EA42B4A771268CDA139D73D1C16A2C4~yutu,$D8837125F99559B5385B4A09DD7007951DD17B92~Garados,$8A7F6489F82D564CB1EAD6A6762402696FCFF859~LapTor BUILD_FLAGS=IS_INTERNAL,NEED_CAPACITY PURPOSE=GENERAL TIME_CREATED=2019-12-10T13:26:41.00185046
BUILT $E135D5384EA42B4A771268CDA139D73D1C16A2C4~yutu,$F2DFE5FA1E4CF54F8E761A6D304B9B4EC69BDAE8~AlleKochenKaffee,$E00A55B52B7C933E715E30A892E1B27C7CC87EFF~rawpower BUILD_FLAGS=IS_INTERNAL,NEED_CAPACITY PURPOSE=GENERAL TIME_CREATED=2019-12-10T13:26:42.02174247
BUILT $E135D5384EA42B4A771268CDA139D73D1C16A2C4~yutu,$FFA72BD683BC2FCF988356E6BEC1E490F313FB07~Lule,$7C22E89AB620E77DF1B4A33787A5EC3F2AB4A8D1~ZKP1984 BUILD_FLAGS=IS_INTERNAL,NEED_CAPACITY PURPOSE=GENERAL TIME_CREATED=2019-12-10T13:26:43.026957"

perhaps we're doing some circuit isolation accidentally?

just opened up this ticket for me to track my research on it. going to see what circuit logic is like for Tor Browser desktop as well.

bug

opened by mtigas 12

Updating BBC logo on landing page as per new branding/visual identity

Hi,

The BBC logo have changed since mid-2022. Could you please update the one on the browser's landing page?

The logos/visual identities can be found here: https://www.bbc.co.uk/branding/

opened by abdallahalsalmi 0
BBC logo on landing page not loading

Hi, we noticed the BBC logo (and other logos) on the landing page of Onion Browser (iphone SE, iOS: 16.2) do not appear.

The problem seems to vary from one device to another on the same model.

Sometimes the logo of Deutsche Welle doesn't appear either.

opened by abdallahalsalmi 0
Toolbar Blues

The bottom toolbar required to access tabs hides itself and there’s no way to get it back except to scroll way back to the top of an often very long forum thread. On the Dread site and I assume others, the browser lacks any inertial scrolling so scrolling is always 1:1 and thus laborious. Since I can’t set a font size either, some forum threads collapse into one a few characters as they become repeatedly indented. That makes scrolling back to the top just to close a tab very frustrating. Then the tabs gallery page lacks any useful highlighting to indicate which the current tab is, so I must check the tab title to find it. Really I’d just like an option for normal tabs instead of a silly gallery view. And that I can keep it from ever being hidden. Like a normal browser!

opened by VectorABC 1
[feat] Clear Cache

Was working with a user that could not access an onion site that was known to be online. A blank white page came up, suggesting perhaps a caching issue? Lowered security settings to lowest, rebooted phone, reinstalled app, turned off VPN, and the problem persisted. Another iOS Tor Browser showed the onionsite as live on the same device. Trying another known live onionsite produced an all black screen.

Perhaps a "Clear Cache" button would be useful, although I'm not sure if it is the root of this particular issue

Thanks for your hard work :)

opened by kn0wmad 4

Releases(v2.8.3)

v2.8.3(Dec 14, 2022)
Updated to Tor.framework 407.11.1 containing Tor 0.4.7.11.

Support custom search engines.

Translation updates.

Added setting to control background-hiding.

Source code(tar.gz)
Source code(zip)
OnionBrowser.ipa(188.85 MB)
v2.8.2(Sep 29, 2022)
Updated to Tor.framework 407.10.2 containing Tor 0.4.7.10.

Updated Snowflake to version 2.3.0.

Fixed crash when editing a bookmark URL.

Minor translation updates.

Source code(tar.gz)
Source code(zip)
OnionBrowser.ipa(188.23 MB)
v2.8.1(Jul 11, 2022)
Updated to Tor.framework 407.8.2 containing Tor 0.4.7.8.

Source code(tar.gz)
Source code(zip)
v2.8.0(Jul 11, 2022)
Updated to Tor.framework 407.7.1 containing Tor 0.4.7.7 and OpenSSL 1.1.1o.

Updated to Snowflake 2.2.0.

Updated Spanish and Ukranian translation.

Added Romanian translation.

Fixed behaviour around Onion-Location redirects.

Improved tab overview. Use snapshots instead of small webviews. Big thanks to Alexey Kosylo!

Source code(tar.gz)
Source code(zip)
v2.7.9(Jul 11, 2022)
Updated to Tor.framework 406.10.1 containing Tor 0.4.6.10 and OpenSSL 1.1.1m.

Updated Ukrainian, Russian and traditional Chinese translations.

Updated NYT onion address.

Added DW and Twitter onion address to default bookmarks.

Updated HSTS list for automatic rewrites to HTTPS.

Source code(tar.gz)
Source code(zip)
v2.7.8(Feb 8, 2022)
Improved app icon.

Introduced BartyCrouch tool for localization consolidation.

Translation updates.

Updated to Tor.framework 406.9.2 containing Tor 0.4.6.9 and OpenSSL 1.1.1m.

Fixed build on Apple Silicon.

Moved shared proxy config code to IPtProxyUI library.

Updated IPtProxy to 1.5.0 containing latest fixes to Snowflake and Obfs4proxy.

Added Khmer translation.

Source code(tar.gz)
Source code(zip)
v2.7.7(Nov 18, 2021)
Finally added Greek to app translation. Not complete, yet, but mostly.

Actively migrate v2 onion default bookmarks to v3.

Added feedback, when bridge settings were changed during startup.

Source code(tar.gz)
Source code(zip)
v2.7.6(Oct 25, 2021)
Updated Tor to version 0.4.5.10.

Added support for onion service v3 authentication.

Fixed handling of received URLs. Will now work better with other apps, regardless of the state Onion Browser is in.

Added feature: "Disable Bookmarks on Start Page".

Now contains some popular User Agent strings for users to choose.

Translation updates.

Source code(tar.gz)
Source code(zip)
v2.7.5(Oct 25, 2021)
Updated Arabic, Irish and Macedonian translations.

Updated Tor to version 0.4.5.9.

Updated Snowflake to version 1.1.0.

Fixed a bug, where no tab was shown after restart and toolbar was also hidden.

Added "Very Strict" content policy to really switch off JavaScript. Breaks context menu, but needed for some rare sites.

Source code(tar.gz)
Source code(zip)
v2.7.4(Oct 25, 2021)
Added Polish translation.

Improved wording.

Fixed app crashes on short pause/resume cycles.

Fixed app start when Snowflake bridges are configured.

Fixed issue when changing custom bridges and trying to connect immediately.

Updated Tor to version 0.4.5.8.

Source code(tar.gz)
Source code(zip)
v2.7.3(Oct 25, 2021)
Updated translations.

Added Korean translation.

Updated dependencies.

Fixed issue with iframes in conjunction with Universal Link Protection.

Make automatic redirects to addresses advertised in Onion-Location headers configurable.

Fixed issue on iOS 14, where security level badges weren't tappable anymore.

Removed Meek Azure bridge, since Microsoft announced starting to block it.

Updated Moat (Obfs4 bridge service) and Snowflake configuration.

Updated Tor to 0.4.5.7 and OpenSSL to 1.1.1k.

Source code(tar.gz)
Source code(zip)
v2.7.2(Jan 26, 2021)
Fixed a problem with the meek-azure bridge and the MOAT service to fetch new bridges.

Updated Thai translation.

Please update in the App Store.
Source code(tar.gz)
Source code(zip)
v2.7.1(Jan 26, 2021)
Fixed Snowflake stop and restart.

Added Albanian translation.

Small updates to Croatian, Hebrew, Japanese and Spanish.

Fixed issue with Content Security Header. (Thanks DuckDuckGo team!)

Updated Tor to 0.4.4.6.

Please update in the App Store.
Source code(tar.gz)
Source code(zip)
v2.7.0(Jan 26, 2021)
Use the dedicated Meek bridge of the MOAT service directly without Tor as originally intended.

Added Snowflake bridge support.

Added support for the "Onion-Location" HTTP header. (See https://community.torproject.org/onion-services/advanced/onion-location/)

Small bugfixes.

Small translation updates to French, Japanese, Dutch, Thai, Catalan and Gaelic.

Replaced link to https://onionbrowser.com/donate on start page with display of In-App-Purchase scene.

Fixed issue on iOS 14, where users couldn't store documents to "Files" app anymore.

Updated Tor to 0.4.4.5.

Please update in the App Store.
Source code(tar.gz)
Source code(zip)
v2.6.2(Jan 26, 2021)
Added Italian translation.

Updated Arabic translation.

Updated Tor to 0.4.3.6.

Please update in the App Store.
Source code(tar.gz)
Source code(zip)
v2.6.1(Jan 26, 2021)
Updated Tor to 0.4.3.5.

Updated translations.

Fixed DuckDuckGo behaviour (and probably other sites'!) in gold security level.

Fixed app lock when no biometry available.

Please update in the App Store.
Source code(tar.gz)
Source code(zip)
v2.6.0(Jan 26, 2021)
Rephrased security levels and improved their description.

Added Nextcloud Bookmarks support.

Added optional biometric/device passcode app lock.

Added MOAT implementation: Automatic retrieval of OBFS4 bridges via Meek.

Fixed memory leaks, where RAM usage would increase over time, because tabs were never really removed from memory.

Empty all background tabs on memory warning signal from iOS.

Fixed race condition with accidentally deleted start page.

Fixed links to onionbrowser.com.

Updated translations.

Small bug fixes.

Tor updated to 0.4.1.6.

Please update in the App Store.
Source code(tar.gz)
Source code(zip)
v2.5.0(Feb 26, 2020)
Updated translations.

Fixed issues with persistent cookies.

Fixed issues on iPad where scene was scrolling away when keyboard showed.

Refurbished app start UI. Don't show error page, instead prompt user to configure bridges.

Improved bridge configuration UI.

Improved popups on iPad.

Add bookmark from share sheet.

Increased X button on tab overview for easier close.

Added swipe up to close tabs in tab overview.

Fixed hidden toolbar when viewing PDFs, images and other files.

Fixed share sheet options.

Added advanced Tor configuration option.

Added explanation about security levels.

Improved dark mode support.

Fixed crash when showing Tor circuits.

Fixed app shortcuts. (On long tap on app icon.)

Updated OBFS4 bridge list.

Fixed bug when changing bridge settings.

Fixed problems with injected JavaScript.

Please update in the App Store.
Source code(tar.gz)
Source code(zip)
v2.4.0(Feb 26, 2020)
January 7, 2020

New browsing chrome

Improved iPad support

New landing page

Bookmarks with favicons

New Tor circuit display

Security level presets

New tab overview

Tor updated to 0.4.0.6

Updated OBFS4 server list

Fixed issue with Content-Security-Header nonce and hash values which broke a lot of sites.

Localization updates

Source code(tar.gz)
Source code(zip)
v2.3.0(Feb 26, 2020)
October 31, 2019

Tor updated to 0.4.0.5

Localization updates.

FIXED OCSP leak by adapting code from Psiphon's Endless fork and their OCSPCache. (#178)

Now able to share downloaded PDFs and other binary files with other apps.

Completely overhauled bookmark management UI.

Completely overhauled settings UI.

Replaced own dark mode with iOS 13 dark mode support.

Onion Browser now registers for http and https URL schemes, so is able to be the default browser on the device.

Dropped special 1Password support in favor of system-wide password manager support.

Load bridges from a stored QR code photo.

Licensing change of Endless, the upstream browser chrome project.

Fixed context menu in "Content Policy: strict" mode.

Source code(tar.gz)
Source code(zip)
v2.2.1(Jun 18, 2019)
New "start up in last state" feature, which remembers open tabs. (#134)

New "open in background tab" feature (#154, #158)

FIXED: Fixed behavior of content blocking; "strict" should now properly allow static images. (#123)

FIXED: Corrected display issues on iPad. (#169)

FIXED: The documented in-app purchase has been missing for a few versions.

Updated localizations for many languages. Updated some App Store localizations and screenshots. (#163, #189, #197)

Source code(tar.gz)
Source code(zip)
v2.2.0(Mar 19, 2019)
Tor updated to 0.3.5.8.

When the app goes to background, the preview in the app switcher is now obscured. (Issue #138)

Improved tor stop / restart behavior when going to background. Tor now completely shuts down on background and a fresh Tor launched when the app is resumed.

FIXED: Websites with self-signed certificates may be accessed again, after warning the user of the security implications. (#111)

FIXED: Editing bridges after first launch works again. (#121, #140)

FIXED: Using camera to import bridges from QR code works again. (#142)

Localizations now available in Turkish. Updated localizations for most languages.

Source code(tar.gz)
Source code(zip)
v2.2.0-rc.1(Mar 5, 2019)

To be TestFlight'd and possibly released to App Store if things look clear.
Source code(tar.gz)
Source code(zip)
v2.2.0-beta.1(Mar 5, 2019)

Source code(tar.gz)
Source code(zip)
v2.0.1(Jan 24, 2018)

Source code(tar.gz)
Source code(zip)
v2.0.0(Jan 24, 2018)

Source code(tar.gz)
Source code(zip)
v1.6.1(Aug 19, 2016)
See onionbrowser.com and onionbrowser.com/security for official announcements and notes.

Changes:

See changelog for full details.

iObfs rebuilt with Go 1.7 (was 1.7rc3). Fixes crash-on-launch in iOS 10 Beta.

See 1.6.0 changelog for more changes in the Onion Browser 1.6 series.

Verification:

(App bundle hash verification is coming soon.)
Source code(tar.gz)
Source code(zip)
v1.6.0(Aug 8, 2016)
See onionbrowser.com and onionbrowser.com/security for official announcements and notes.

Changes:

See changelog for full details.

iObfs: Onion Browser now supports "pluggable transports" like obfs4 and meek, which improve connection support in locations that try to block Tor. For more info about iObfs (an iOS framework build of obfs4proxy), please visit: https://github.com/mtigas/iObfs (Special thanks to the Onion Browser beta testers for their feedback on this new feature. Extra special thanks to The Guardian Project for supporting work on iObfs!)

"One-click" bridge UI: Onion Browser now comes with built-in bridges for obfs4, meek-amazon, and meek-azure -- same the official Tor Browser Bundle and Orbot.

User-agent spoofing strings updated to the most recent browser versions.

Tor updated to 0.2.8.6, the first stable release in the 0.2.8 series. This version contains several performance and security improvements. https://blog.torproject.org/blog/tor-0286-released https://gitweb.torproject.org/tor.git/tree/ChangeLog?h=tor-0.2.8.5-rc

OpenSSL updated to 1.0.2h. https://www.openssl.org/news/secadv/20160503.txt https://openssl.org/news/changelog.html

Minimum required iOS version is now iOS 8.2.

Source code(tar.gz)
Source code(zip)
v1.5.13(Oct 30, 2015)
See onionbrowser.com and onionbrowser.com/security for official announcements and notes.

Changes:

Minimum required iOS version is now iOS 8.0 (was iOS 6.1). Users running iOS 8.0 and 8.1 will be warned about HTTPS insecurity in these older versions (due to FREAK exploit). iOS 8.2 will be required by the end of 2015.

Update HTTP errors. The "HTTPS Connection Failed" error was displaying in situations where the error had nothing to do with SSL failure.

Allow navigating to "about:blank" and allow setting the homepage to that URL. (#62)

Update bridge handling to make it difficult to enter in an unsupported bridge type, such as "obfs4" or "scramblesuit" via text entry or the QR Code scanner. (Prevents a situation where a user ends up with an "unusable" Onion Browser.)

Tor updated to 0.2.6.5-rc. https://gitweb.torproject.org/tor.git/plain/ReleaseNotes?h=release-0.2.6

OpenSSL updated to 1.0.2d. https://openssl.org/news/changelog.html

Source code(tar.gz)
Source code(zip)

v1.5.12(Mar 20, 2015)

Changes:

Allow pasting in the bridges.torproject.org text blob to set bridges, like the Tor Browser launcher. #55
Allow scanning QR code from bridges.torproject.org to set bridges. #56
On first run, allow user to configure bridges before trying to launch Tor. Once Pluggable Transports are working, this will be useful for users where Tor traffic looks suspicious. #57
Tor updated to 0.2.6.5-rc. https://gitweb.torproject.org/tor.git/tree/ChangeLog?h=tor-0.2.6.5-rc
OpenSSL updated to 1.0.2a. https://openssl.org/news/secadv_20150319.txt https://openssl.org/news/openssl-1.0.2-notes.html
Redesigned "Connecting..." prompt when opening the app.

Verification:

You can check that your version of Onion Browser matches a known copy of the app. This is helpful for safety reasons, if you are not confident that your copy of Onion Browser has been tampered with.

You'll need to have this version of Onion Browser (1.5.12) downloaded and available in iTunes. Go into iTunes and make sure that Onion Browser appears in the "My Apps" tab. Since this is the most recent version of Onion Browser, ensure that the app is updated. (If it has an "Update" flag, you can right-click the app and select "Update App" to download 1.5.12.)

If you don't have Onion Browser on your computer, you can retrieve this version by syncing your iPhone/iPad to your computer or by searching for Onion Browser in iTunes with the same Apple account that you used to buy it on your iPhone/iPad.

If you get a hash that's different than cc31dad8ec3aa4f72b1de09557d5840b2039c585328098973b3cb1a7ad3205d521c95a21288443dd8eef86028800db0895b1e47b20e131054947685c5161fc44, please report it in this thread immediately, or e-mail me.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

If you have installed Onion Browser via the App Store, you can
double-check the authenticity of your copy of Onion Browser by doing
something like the following and ensuring that the resultant SHA512
hash is identical. 

Sync your phone (& sync the apps over to your computer) or download
Onion Browser via the App Store in iTunes on your computer. Then:

$ mkdir /tmp/ob1512
$ cd /tmp/ob1512
$ unzip -o "$HOME/Music/iTunes/iTunes Media/Mobile Applications/Onion Browser 1.5.12.ipa"
$ rm -fr "Payload/OnionBrowser.app/SC_Info"
$ find Payload -type f -print0 | xargs -0 shasum -a512 | shasum -a512
cc31dad8ec3aa4f72b1de09557d5840b2039c585328098973b3cb1a7ad3205d521c95a21288443dd8eef86028800db0895b1e47b20e131054947685c5161fc44  -

It'll tell you that your copy of the Onion Browser app package is
the same as everyone else's. (But of course that doesn't help if
there's fishiness in Xcode or in the App Store submission process.)

Per [1][2], although the App Store-hosted ".ipa" bundle of the app
changes from user-to-user (because the ".ipa" zip file contains
user-specific SC_Info), the remainder of the app contents should be
the same from user to user. See [3] & [4] for further work on this.

[1]: https://github.com/WhisperSystems/Signal-iOS/issues/641#issuecomment-77376731
[2]: https://github.com/WhisperSystems/Signal-iOS/issues/641#issuecomment-78202740
[3]: https://github.com/OnionBrowser/iOS-OnionBrowser/issues/58
[4]: https://github.com/WhisperSystems/Signal-iOS/issues/641
-----BEGIN PGP SIGNATURE-----

iQEcBAEBCgAGBQJWKYVjAAoJEGQdTjqn+ftyZXoIAJI0iCd0Ok3zy5w5YMtLlYOn
Ii9RQ0p9DGQPOeMrvjK4TmcKapniP43VSIxsxYvSvlezVjBwx8LLkHQ7aC5NK7JA
jJglZUukdbX/5FhFof9SSRwCCVhC7jrJGNMzpB+sNP54WVsT8/sVsxSSvGEQdtvO
yqb/B7Ipv6eOMUGDUP/JsQzHExzN82eF90+8UZ2QS29WUq0esHl8zLB0D00WdLlo
oSkGtSPeNi+m3R5/hQ/MxD9hWkGRYn1hKm6rlT6yS9/tFt1jGyXsjOKhYD2Lo8ql
1+fvhObM999nVBgf9/PcOcaS5oi4zLBMFc+nuUcvrGGaJ/gAN56qtSjFRv4hwg4=
=w6XH
-----END PGP SIGNATURE-----

Source code(tar.gz)
Source code(zip)