A descriptor is a signed data record used by a Tor onion service to publish the information clients need to find and reach it. It typically includes routing details such as introduction points and metadata tied to the service’s identity. Because it is signed, clients can verify that the record was created by the legitimate service and was not altered in transit.
In cyber security, descriptors matter because they sit at the boundary between anonymity and trust. If an attacker can forge, replace, or influence descriptor data, they may redirect users to a malicious service or break access to the real one. Defenders therefore treat descriptor generation and publication as sensitive control-plane activity: protect the service’s private keys, verify signature integrity, and monitor for unexpected descriptor changes or publication failures.