The best Tor hosting for your project supports the application you want to run, the people who should reach it and a recovery plan you can use. A publication open to Tor visitors has different requirements from a private team workspace. A familiar web panel and an app platform with AI operations are also different choices.
Impreza offers Tor hosting on a VM, dedicated Tor hosting on bare metal and native onion operations for eligible Impreza Agent apps. Start with the workflow, then choose the capacity. An onion address does not by itself decide the hardware, restrict visitors or authorize an AI assistant.
Match the hosting workflow to your project
| Your project | A practical starting point |
|---|---|
| You prefer a web panel to manage a site and its onion publication | Tor Hosting with aaPanel, Tor Manager and Onion Guard |
| You prefer that panel workflow and need exclusive physical hardware | Dedicated Tor Hosting on bare metal |
| You want supported catalog or custom apps with portal, REST and MCP operations | An eligible Impreza Agent deployment; follow the onion publication guide |
| Only approved Tor clients should reach the application | Private onion app hosting with client authorization |
| You already administer a compatible server at another host | Bring that server to Impreza and check eligibility for each operation |
The aaPanel workflow and the Agent workflow have separate requirements and controls. Choosing a product with Tor in its name does not enable every Agent feature. Confirm the application, runtime and capabilities before ordering or changing a live server.
Public onion site or restricted workspace?
A public onion service can suit an independent publication, a community or a customer-facing application for Tor visitors. Keep normal application authentication for accounts and private actions.
For a team-only workspace, eligible Agent apps support Tor client authorization. Approved clients need a configured key to connect, while application login and roles still decide what they can do inside. Follow the access-control guide when adding or removing clients; access changes can briefly interrupt onion connections, and removing the final client makes the service public again.
- Choose the audience first. Public reachability and restricted access solve different needs
- Keep application security. An onion endpoint does not replace secure code, login or roles
- Review protection options. Eligible Agent capabilities determine the available Tor profiles
- Protect the identity. App data and the keys behind an onion address need separate recovery plans
Manage supported apps through MCP, with your permissions
The platform adds a way to publish and operate supported onion apps from My Apps or an authorized assistant. Connect a compatible client through OAuth and grant the operations needed for the task. Review narrower delegated access before letting a helper make changes.
The useful difference is control over a workflow: supported publication, access settings, protection and identity operations sit alongside app deployment and inspection. MCP exposes authorized platform operations; it is not unrestricted SSH or an approval to change everything on the machine.
Where supported, human approvals let the owner review protected actions. Impreza Shield adds supported HTTP controls for eligible apps. It is separate from Tor protection profiles and is not a guarantee against every network or application attack.
VM or dedicated: size the app, not the address
A modest onion site does not automatically need bare metal. Estimate the app’s CPU, memory, storage and database needs, then test representative use. Tor network conditions can affect response times independently of server capacity.
Dedicated hardware fits workloads needing exclusive physical resources or sustained capacity. A VM can be a practical starting point when it covers the app’s needs. Use the VPS versus dedicated comparison for the hardware decision and the jurisdiction guide for the location decision.
Prepare recovery before publishing the address
Back up the data your application needs and verify a restore on a suitable destination. For eligible apps, Impreza S3 app backups cover supported data; plan separately for external databases and storage outside that coverage.
The keys behind an onion address are a different asset. Review encrypted identity backup and recovery for supported export/import, retrieval limits and existing address reservations. Rotating an identity changes the address. Keeping the same address during a move needs a separate supported plan.
Publishing over Tor and reaching Impreza over Tor
Your app’s onion address and your connection to the platform are separate. For the official portal, REST API, hosted MCP and documentation onion endpoints, use the MCP over Tor connection guide. Your client must route those connections through Tor.
Account ID signup is available without a personal email address. Account, billing and support records can still exist, and an app or AI service can record what you send it. Review the privacy policy and your app’s public routes, external services and logs.
Choose your starting point
For the panel workflow, explore Tor Hosting on a VM or Dedicated Tor Hosting. For native app operations with AI, start with the Agent publication guide and confirm eligibility.
The best choice is the one you can operate, protect and recover for your intended audience.