OnionHost

Version 1.0.3 · Android 8.0+ · Tor v3 Onion Services

OnionHost lets you host a small website, document, archive, or media file from an Android device through a Tor v3 .onion address. It also includes Onion Messenger for private, encrypted one-to-one messages and invite links.

Download

OnionHost lets you host static websites, documents, archives, and media files directly from an Android device over Tor v3 Onion Services. It also includes Onion Messenger for private, end-to-end encrypted messaging, invite links, and QR code sharing.

📥 Download Latest OnionHost APK (v1.0.3) (Debug APK for Android 8+)
📁 Repository Release Mirror (v1.0.3 APK)

Android may ask you to allow installation from your selected file manager. Install only APKs obtained from this repository or a trusted release source.

Proof of concept

Features

• Host a folder, ZIP archive, HTML page, PDF, image, or other single file.
• Run an embedded local HTTP server behind a Tor v3 Onion Service.
• Copy and share an onion URL or QR code after Tor confirms that the service is live.
• Serve a generated homepage for single files, so the root onion URL does not return 404.
• Local-only visitor statistics without IP-address logging.
• Optional authenticated, loopback-only WebDAV plugin.
• Onion Messenger with encrypted one-to-one messages, anonymous invite links, copy/share controls, QR export, and encrypted local backup.
• Website Manager support for start, stop, rename, duplicate, and delete. Duplicating a website copies its hosted files too.

Software architecture

OnionHost follows a practical MVVM-style Android architecture. Compose screens render state from ViewModels; ViewModels coordinate repositories and services; repositories isolate database and storage access; and the hosting service owns long-running HTTP/Tor work.

flowchart TD
    UI[Jetpack Compose screens] --> VM[ViewModels]
    VM --> REPO[Repositories]
    VM --> HOST[OnionHostingService]
    REPO --> DB[(Room databases)]
    REPO --> STORAGE[Private app storage]
    HOST --> HTTP[Loopback HTTP server]
    HOST --> TOR[Tor daemon and Onion Service]
    HOST --> MSG[Messenger listener]
    TOR --> HTTP
    TOR --> MSG

Loading

Main components:

• ui/ — Compose screens, navigation, and ViewModels.
• hosting/ — Foreground-service lifecycle and boot handling.
• tor/ — Tor binary installation, configuration, bootstrap state, and descriptor publication.
• http/ — Static-file HTTP server, range requests, authentication, and directory handling.
• storage/ — Safe import, ZIP extraction, private storage, and website duplication.
• repository/ and database/ — Website, analytics, logs, and settings persistence.
• messenger/ — Encrypted one-to-one messaging, invites, and backups.
• webdav/ — Optional authenticated loopback-only WebDAV server.

Dependency injection is provided through Hilt, and asynchronous state uses Kotlin Coroutines and Flow.

Quick start

1. Install the APK on Android 8.0 or newer.
2. Open Home and select a folder, ZIP, or single file.
3. Tap Start Hosting.
4. Keep the phone online and wait for the status Hosting Live on Tor.
5. Only after that status appears, copy the http://…onion/ link or its QR code.
6. Open the link in Tor Browser.

The first Tor connection and hidden-service descriptor publication can take several minutes. Keep OnionHost running and exclude it from aggressive battery optimization while hosting.

Onion Messenger

To invite someone, open Onion Messenger and share My QR code or copy My invite link. The other person opens Add user, pastes the complete invite link, and confirms. Invite links contain the onion address and cryptographic public key required for delivery and authentication; they do not contain a username or public profile.

Current Messenger scope:

• Private one-to-one text messages
• QR-code, link copy, link share, and QR PNG download
• Password-encrypted local backup

Group chat, file sharing, voice/video calls, and contact discovery are not currently implemented.

Privacy and security

• Tor is used for Onion Service reachability.
• The embedded HTTP and WebDAV servers listen only on the device loopback interface; Tor is the intended network exposure.
• Message bodies are encrypted before local storage using an Android Keystore-backed key.
• Messenger does not create an account, use phone-number discovery, or include a username in new invite links.
• The app does not intentionally log visitor IP addresses.

Misuse warning and responsibility

This app is provided for lawful, ethical, educational, private-hosting, and personal communication purposes only. Do not use it for illegal activity, harassment, fraud, malware delivery, abuse, copyright infringement, or any harmful purpose.

If anyone misuses this app or uses it for harmful or illegal work, the developer and contributors are not responsible. The person using the app is solely responsible for their own actions, content, data, and compliance with applicable laws.

Build from source

.\gradlew.bat testDebugUnitTest assembleDebug

The debug APK is created at app/build/outputs/apk/debug/app-debug.apk.

Verification status

Version 1.0.3 passes the included unit tests and Android debug build. Tor publication still depends on the device, network, and the Tor network itself; always wait for Hosting Live on Tor before sharing a URL.

License

MIT License. See LICENSE if included with your distribution.