All good points (though to me, option 1 is more preferable to option 3 :)<p>I&#x27;d like to point out, if you&#x27;re not aware already, that tor additionally supports authentication for hidden services on the network layer. You can put a &quot;HidServAuth&quot; line in your torrc, which will then create a key line you must place into your clients torrc. Only clients with the key can connect to the hidden service. You could use that either in place of or in addition to bespoke web app auth and SSL. That way you also prevent people enumerating tor hidden services from knowing what&#x27;s running behind your service.