The heads
| Head | Digits in it | Opens with | Full record |
|---|---|---|---|
| 5yymslrt | 1 of 8 | a digit | 5yymslrt |
| 77x6lmfa | 3 of 8 | a digit | 77x6lmfa |
| 7iaj3wjp | 2 of 8 | a digit | 7iaj3wjp |
| atmqbitg | 0 of 8 | a letter | atmqbitg |
| dgkozv5m | 1 of 8 | a letter | dgkozv5m |
| evwigej4 | 1 of 8 | a letter | evwigej4 |
| fr6bvsrc | 1 of 8 | a letter | fr6bvsrc |
| h3h66vql | 3 of 8 | a letter | h3h66vql |
| jcyjjcu4 | 1 of 8 | a letter | jcyjjcu4 |
| ncmebaso | 0 of 8 | a letter | ncmebaso |
| otw35cxf | 2 of 8 | a letter | otw35cxf |
| torzon4v | 1 of 8 | a letter | torzon4v |
What varies and what does not
Ten of the twelve open with a different character from every other address in the set. The two exceptions both open with the same digit and diverge at the second character, which is the entire content of the shared prefix analysis.
Digit density in the head varies from none at all to three out of eight. Two addresses have heads made entirely of letters. Those are the ones most likely to be misremembered, because a run of eight letters reads as a word and words get recalled approximately.
None of this variation is a signal. It is what eight draws from 32 symbols produce twelve times over. The reason the heads get their own page is not that they differ interestingly, but that they carry a burden they cannot bear.
The burden the head carries
Every abbreviation in this space keeps the head. Directory listings show it. People quote it in conversation. Bookmarks get named after it. When somebody says an address checks out, what they nearly always mean is that the opening characters matched what they remembered.
And the head is the part of a string that costs the least to imitate. Grinding until a key produces a chosen four or five character opening takes minutes on ordinary hardware. Grinding for eight is a serious job but not an impossible one. So the eight characters that carry the whole weight of informal recognition are the eight an attacker can most easily control.
This site shortens addresses in listings by keeping the first eight and the last eight, with the middle removed. That is the standard explorer treatment for a hash and it is better than showing the head alone, because it puts two anchors on screen instead of one. It is still an abbreviation and it still proves nothing. The only check that means anything compares all 56 characters, and the reasoning behind that is on the forgery page.
Questions
How many characters of an onion address are enough to identify it?
For a casual reference, eight are conventional. For deciding whether to trust an address, none. Any prefix short enough to compare by eye is short enough to be ground for deliberately.
Why do listings show the ends and hide the middle?
Because the ends are what people recognise and the middle is too long to display. It is a display convention borrowed from hashes, not a security measure.