Stuck on the checking screen
Almost always boring. There is exactly one variant worth stopping over and it is easy to recognise.
What it is doing
A hidden service cannot see who is connecting. No source address, no geography, no reputation, no history. Every connection arrives looking identical to every other one, which removes the entire toolkit a normal site uses to separate people from scripts.
What is left is asking the connecting client to do a small amount of work and proving it did. For one person opening a page that is invisible. For somebody opening a hundred thousand connections it is the difference between cheap and not worth doing. That asymmetry is the whole mechanism.
A captcha would not work here, because captchas need to tell repeat visitors apart, which requires the identity signal that does not exist. They also break at the highest browser security setting, and telling people to lower their security to pass a security check is an obviously bad trade.
How long is normal
| Duration | Meaning |
|---|---|
| A few seconds | Normal. Most of what you are waiting on is circuit latency, not computation. |
| Twenty or thirty seconds | Congestion or a slow circuit. Annoying, not meaningful. A new circuit usually helps more than waiting. |
| Stuck indefinitely | Usually a dead circuit rather than a stuck check. Get a new one instead of continuing to wait. |
| Loops back repeatedly | Sometimes scripting settings, sometimes heavy filtering during a flood. If it persists across all three doors, wait it out. |
The one version to stop at
It works as a disguise precisely because people have been trained to wait passively through this screen and then click whatever appears next. If something presented as a check asks for input, that is the moment to verify where you are rather than to comply because the page looks familiar.
What it does not do
It does not identify you, does not track you between visits, and leaves nothing persistent about your machine. It also provides you no protection whatsoever. It protects the service from automated load, which is a different thing from protecting you, and the thing that protects you is the signature check on the page after it.