Dark Web: What You Should Know

What the Dark Web Is (and What It Is Not)

The dark web is a deliberately hidden overlay network that requires specific software to access — primarily the Tor browser[1]. It is not a single website, app, or 'secret browser'; it is a collection of services designed to anonymize both publishers and visitors. These services use the special-use top-level domain .onion and do not appear in standard search engines or resolve through the normal Domain Name System[1][2]. When you visit a .onion address, Tor routes your connection through a random series of volunteer-run relays, encrypting your traffic at each hop so that no single relay knows both where you are and where you're going[5].

People often confuse the dark web with the deep web, but they are not the same. The deep web is simply any content not indexed by search engines: your email inbox, a company's internal database, a paywalled newspaper article, or a private photo album. The dark web is a small subset of the deep web — the portion that is intentionally anonymized and accessible only through tools like Tor[1]. To put it in context: the surface web (what Google indexes) is a fraction of the internet; the deep web is the vast majority of everyday online content; and the dark web is a tiny, encrypted corner within that majority.

The dark web itself is not illegal. Accessing it is lawful in the United Kingdom and most other countries[3]. It hosts legitimate resources: SecureDrop and OnionShare help journalists communicate with sources without exposing metadata; activists in repressive regions use it to bypass censorship; and privacy-conscious individuals rely on it for metadata-free chat and file sharing[2]. At the same time, dark web sites are frequently used for illegal activities — trafficking drugs, firearms, malware, and child sexual abuse material[3]. Law enforcement agencies focus their resources on the most harmful criminal organizations and marketplace infrastructure, not on individual users simply browsing[6].

Understanding this distinction matters because sensational headlines often imply that the dark web is a monolithic criminal underworld. In reality, it is a tool: what you find there depends on where you choose to go and what you choose to do. For a deeper explanation of how .onion addresses work and what they reveal about your activity, see our dedicated guide.

How the Dark Web Works: Onion Routing and Anonymity

When you load a .onion site in Tor Browser, your request does not travel directly to the destination. Instead, Tor's onion routing protocol wraps your traffic in multiple layers of encryption — like the layers of an onion — and bounces it through at least three volunteer-run relays: an entry (guard) node, a middle relay, and an exit node[5]. Each relay decrypts one layer to learn only the next hop in the chain, so no single node ever knows both your IP address and the site you are visiting. The entry node sees your real IP but not your destination; the exit node sees the destination but not your origin; the middle relay sees neither[5].

This architecture is why .onion addresses exist. A .onion domain is not a normal web address registered with a domain registrar; it is a cryptographic identifier generated by the hidden service itself[1][2]. Because these addresses do not use the Domain Name System, search engines like Google cannot index them, and you cannot reach them with a standard browser[1]. Onion services provide end-to-end encryption between visitor and website even without HTTPS, meaning your connection remains encrypted all the way from your device to the server hosting the .onion site[2]. For a practical guide to finding and verifying dark web onion links, see our separate article.

Anonymity Is Relative, Not Absolute

Tor hides your location and browsing habits from most observers, but it does not guarantee total anonymity. Exit nodes — the final relay before your traffic reaches a clearnet site — can observe any data you send without additional encryption[5]. If you log in to a personal account over Tor or use the same username across clearnet and dark web forums, you create links that can deanonymize you. Misconfigured software, browser plugins, or scripts can leak your real IP address. Law enforcement agencies have successfully identified users by correlating traffic patterns, exploiting software vulnerabilities, and operating honeypot marketplaces[6].

Alternative Networks

Tor is the dominant dark web protocol, but it is not the only one. I2P (Invisible Internet Project) and Freenet are alternative anonymity networks with different design goals: I2P focuses on peer-to-peer communication within the network, while Freenet emphasizes censorship-resistant publishing. Both are smaller and less accessible than Tor, so most dark web services and marketplaces run on .onion addresses[1][2]. For everyday privacy-conscious users, Tor remains the most practical and widely supported option.

The key takeaway: onion routing distributes trust across multiple relays so that no single party can trace your activity, but your anonymity depends on correct configuration and cautious behavior.

What People Actually Use the Dark Web For

The dark web serves two overlapping communities: people seeking privacy and anonymity for legitimate reasons, and criminals exploiting that same anonymity to break the law. Neither group is a caricature. Activists in authoritarian states use Tor to access blocked news sites and organize without surveillance; at the same time, marketplaces on .onion domains facilitate the sale of stolen credit cards, narcotics, and forged documents. Both realities coexist, and understanding each helps you assess the actual risks to your data and identity.

Legitimate Uses

Many users turn to the dark web because standard internet infrastructure exposes too much metadata or because their government censors information. Journalists rely on SecureDrop — a .onion-based submission system — to receive documents from whistleblowers without revealing the source's IP address or location[2]. OnionShare lets individuals share files directly, peer-to-peer, without uploading them to a third-party server that could log access or be compelled to hand over records[2]. Privacy researchers test new anonymity techniques, and software developers distribute updates through .onion mirrors to prevent man-in-the-middle attacks[2]. Even mainstream organizations run onion services: Facebook maintains a .onion address so users in countries that block facebook.com can still log in[2].

According to the U.S. Department of Justice Office of the Inspector General, many users access the dark web for legitimate purposes, including discussing socially sensitive matters or countering censorship in oppressive areas of the world[3]. Across the first ten months of 2024, the mean number of daily Tor users in the United States was 430,054 — about 13.7% of the global total[7]. Germany accounted for the largest share at 37.7%, followed by Finland (3.7%), the Netherlands (3.5%), and India (2.7%)[7]. These figures reflect both privacy-conscious individuals in liberal democracies and people circumventing state censorship elsewhere.

Illicit Uses

The same anonymity that protects journalists also shields criminal marketplaces. Dark web sites are often used to engage in illegal activities such as trafficking drugs, firearms and weapons of mass destruction, child sexual abuse material, and malware[3]. Marketplaces on .onion domains function like e-commerce platforms: vendors list products, buyers leave reviews, and escrow systems mediate transactions. Stolen data — credit card numbers, login credentials, national insurance numbers — appears for sale alongside counterfeit passports, hacking tools, and services like distributed denial-of-service attacks or money laundering[3].

Law enforcement agencies have repeatedly dismantled major marketplaces. Silk Road, launched in 2011, was the first large-scale dark web drug market; the FBI seized it in 2013 and arrested its operator. AlphaBay, which grew to become one of the largest successors, was taken down in a coordinated international operation in 2017. Hydra, a Russian-language marketplace that dominated Eastern European drug trafficking, was shut down by German authorities in April 2022. Each seizure demonstrated that anonymity is not impenetrable: investigators correlate blockchain transactions, infiltrate administrator teams, and exploit operational security mistakes[6]. The FBI focuses its dark web enforcement resources not on individual criminals but on the most egregious criminal organizations and activities, targeting buyers, sellers, marketplace administrators, and the technical infrastructure of the marketplaces themselves[6].

What This Means for You

If you have never visited the dark web, your main exposure is indirect: your stolen credentials or payment card details may end up listed on a marketplace after a data breach. For a detailed look at what types of content and services exist on .onion sites, see our guide on what you can find on the dark web. The dark web is not a place most people need to visit, but understanding its dual nature — both tool for privacy and venue for crime — helps you make informed decisions about your own security and recognize when a 'dark web monitoring' service is offering real value or simply trading on fear.

Is the Dark Web Illegal? Legal Status and Enforcement

Accessing the dark web is legal in the United Kingdom, the United States, the European Union, and most other democracies[3]. Simply downloading Tor Browser and visiting a .onion site does not break any law. What triggers criminal liability is the activity you engage in once you are there: purchasing illegal goods, accessing child sexual abuse material, facilitating fraud, or trafficking weapons and narcotics are crimes regardless of whether you commit them on the surface web or the dark web[3]. The technology itself is neutral; the law judges your actions, not your choice of browser.

This distinction matters because many people assume that using Tor or browsing .onion addresses automatically places them under suspicion. It does not. The U.S. Department of Justice Office of the Inspector General confirmed that many users access the dark web for legitimate purposes, including discussing socially sensitive matters or countering censorship in oppressive areas of the world[3]. Journalists, activists, researchers, and privacy advocates rely on the same infrastructure that criminals exploit, and law enforcement agencies recognize this overlap.

How Law Enforcement Operates

Police and intelligence services do not ignore the dark web. The FBI focuses its dark web enforcement resources not on individual criminals but on the most egregious criminal organizations and activities, targeting buyers, sellers, marketplace administrators, and the technical infrastructure of the marketplaces themselves[6]. Investigators infiltrate marketplaces, operate honeypot sites to gather evidence, analyze blockchain transactions to trace payments, and exploit operational security mistakes made by administrators and vendors. High-profile takedowns — Silk Road in 2013, AlphaBay in 2017, Hydra in 2022 — demonstrate that anonymity is not absolute and that persistent investigation can identify and prosecute those running or profiting from illegal platforms.

If you visit a .onion site out of curiosity or for research, you are not committing a crime. If you purchase stolen credit cards, download child sexual abuse material, or hire someone to commit a felony, you are — and law enforcement has the tools and legal authority to pursue you[3][6].

Jurisdictions Where Anonymity Tools Are Restricted

Not every country permits unrestricted use of Tor and similar networks. China, Russia, and Iran have enacted laws or deployed technical measures to block Tor traffic or criminalize the use of anonymity tools. In these jurisdictions, simply installing Tor Browser or accessing a .onion site can expose you to legal risk, surveillance, or prosecution. If you live in or travel to a country with restrictive internet policies, check local regulations before using the dark web. The fact that Tor is legal in the UK does not mean it is legal everywhere, and ignorance of local law is not a defense.

What 'Legal' Does Not Mean

Legality of access does not imply safety or ethical neutrality. You can legally visit a dark web marketplace, but if you browse listings for stolen data or illegal drugs, you are one click away from criminal activity. You can legally read a forum discussing hacking techniques, but participating in or facilitating an attack is a crime. The line between observation and participation is clear in law, even if it feels blurry in practice. For a clearer picture of the types of content hosted on .onion sites and the risks each category poses, see our guide on what you can find on the dark web.

The key point: the dark web is a legal tool in most of the world, but what you do with it determines whether you stay on the right side of the law.

How People Access the Dark Web Safely

'Safe' access to the dark web means reducing risk, not eliminating it. No configuration guarantees anonymity if you make operational mistakes, and no software protects you from legal consequences if you break the law. What follows is a practical reference for cautious readers who want to minimize exposure to surveillance, malware, and accidental disclosure of their identity.

Step-by-Step Access Method

1. Use a dedicated device or live operating system. Install Tails OS on a USB drive and boot from it, or set aside an old laptop that you never use for personal accounts. Tails routes all traffic through Tor by default and leaves no trace on the host machine after shutdown. If a dedicated device is impractical, create a separate user account on your computer and never log into email, social media, or banking while using Tor.

2. Connect through a reputable VPN before launching Tor. A VPN hides the fact that you are using Tor from your internet service provider and adds a layer of separation between your real IP address and the Tor entry node. Choose a provider with a documented no-logs policy and servers in a jurisdiction with strong privacy protections. Connect to the VPN first, then open Tor Browser.

3. Download Tor Browser only from the official Tor Project website. Third-party app stores, torrent sites, and 'dark web browser' apps often bundle malware or modified versions that log your activity. Verify the download signature if you know how; if not, at least confirm the URL is torproject.org.

4. Avoid logging into personal accounts. Do not check your Gmail, post on Facebook, or use any service tied to your real identity while Tor is running. A single login can link your .onion browsing session to your real-world identity, defeating the purpose of anonymity.

5. Disable JavaScript unless absolutely necessary. Tor Browser's 'Safest' security level blocks JavaScript by default. Many .onion sites will not function without it, but JavaScript is the primary vector for browser exploits that deanonymize users. Enable it only for sites you trust, and understand that 'trust' on the dark web is provisional at best.

Threat Models: Who Faces What Risk

A journalist in a repressive country and a curious individual in the United Kingdom face different threat models. The journalist may be targeted by state surveillance, so operational security must be flawless: no reused passwords, no personal devices, no correlation between Tor sessions and daily internet use. The UK resident browsing out of curiosity faces lower risk of targeted surveillance but higher risk of stumbling into illegal content or scams. Both should follow the same technical steps, but the journalist cannot afford a single mistake, while the casual visitor's main danger is accidental exposure to criminal material or malware.

Common Mistakes That Compromise Safety

• Using a work device or shared computer. Your employer or family members may monitor activity, and forensic traces persist even after you close the browser.

• Downloading 'dark web browsers' from app stores. Legitimate Tor Browser is not available on the Apple App Store or Google Play Store for mobile devices in most regions. Apps claiming to offer 'dark web access' are often scams, data harvesters, or malware.

• Enabling JavaScript on untrusted sites. Exploits targeting Tor Browser almost always rely on JavaScript. The FBI has used browser vulnerabilities to reveal the real IP addresses of users visiting illegal marketplaces.

• Reusing passwords or usernames from the surface web. If a .onion site is compromised or operated by law enforcement, any credential you reuse can link your dark web activity to your real identity.

• Trusting .onion sites by default. Phishing, exit scams, and honeypot operations are common. Verify addresses through multiple independent sources, and assume that any marketplace or service could disappear overnight with your money or data.

For guidance on recognizing and navigating legitimate .onion addresses, see our guide on dark web onion links.

Reducing risk requires both technical precautions and behavioral discipline. The technology protects you only if you use it correctly and avoid the mistakes that have exposed others.

Risks of Accessing the Dark Web: Malware, Scams, and Exposure

The dark web's lack of regulation creates an environment where fraud, malware, and legal hazards are routine. Unlike the surface web, where payment processors, consumer protection laws, and reputation systems provide some recourse, dark web marketplaces operate by design without oversight[3]. If a seller takes your cryptocurrency and never ships the product, you have no chargeback option, no customer service desk, and no legal remedy. If you download a file from a .onion site and it installs ransomware, you cannot report the host to a domain registrar or internet service provider — the site exists outside those systems[1].

Malware and Phishing

Malicious .onion sites deliver malware through fake marketplace login pages, trojanized software downloads, and exploit kits that target outdated browsers. Phishing pages mimic legitimate dark web marketplaces down to the URL structure, tricking users into entering credentials or sending payment to a fraudulent address. Because .onion addresses are long strings of random characters, verifying authenticity is difficult; a single transposed letter can land you on a clone site operated by scammers or law enforcement[2].

Conditional example: you find a .onion link in a forum thread claiming to host a privacy tool. You click it, the site prompts you to download an installer, and you run it without checking the file hash. The installer is a keylogger that captures your passwords and cryptocurrency wallet keys. You have no way to trace the attacker, and the forum moderators — if they exist — have no obligation to vet links.

Law Enforcement Honeypots

Police agencies operate honeypot sites that mimic illegal marketplaces or forums to collect evidence on visitors and vendors. The FBI's takedown of AlphaBay in 2017 and similar operations demonstrate that investigators can run a .onion site for months, logging user activity and building cases before making arrests[6]. Visiting a honeypot is not itself illegal, but if you create an account, make a purchase, or post content that reveals criminal intent, you have provided evidence that can be used against you.

Unregulated Marketplaces and Exit Scams

Dark web marketplaces have no consumer protection by design[3]. Vendors can disappear with your payment; marketplace administrators can shut down overnight and steal all escrowed funds in what is known as an exit scam. You cannot file a complaint with a regulator, dispute the transaction with a bank, or leave a review that warns others — the entire ecosystem relies on pseudonymous reputation, which is easily gamed or abandoned. If you send cryptocurrency to a seller and receive nothing, your money is gone.

Psychological and Legal Exposure to Illegal Content

Stumbling onto child sexual abuse material, extreme violence, or other illegal content is both traumatic and, in some jurisdictions, legally problematic to report without involving yourself in an investigation[3]. Possessing or viewing such material is a crime in the UK and most other countries, even if you accessed it accidentally. Reporting it to police may require you to explain how you found it, and forensic analysis of your device could reveal other browsing history. The safest approach is to close the site immediately, clear your browser, and avoid random exploration of .onion links from untrusted sources.

For a broader overview of the types of content hosted on .onion sites and how to recognize high-risk categories, see our guide on what you can find on the dark web.

What You Can Do

• Never click random .onion links from forums, chat rooms, or social media. Verify addresses through multiple independent sources before visiting any site.

• Assume every marketplace is a potential scam or honeypot. Use only well-documented addresses, check community feedback across multiple platforms, and never send payment until you understand the risk of total loss.

• Do not download files unless you can verify their integrity. Check cryptographic hashes, use a sandbox or virtual machine, and assume that any executable could be malware.

• If you encounter illegal content, close the site immediately. Do not screenshot, save, or attempt to report it yourself; contact law enforcement through official channels if you believe you have information about a serious crime, but understand that doing so may require you to explain your presence on the dark web.

The dark web's risks are not theoretical. Scams, malware, and legal exposure are common outcomes for users who browse without caution or who assume that anonymity protects them from consequences.

What to Do If Your Information Is on the Dark Web

Finding out that your email, password, or other personal data appears on the dark web does not mean you are being actively targeted. Most leaked credentials come from old data breaches and are sold in bulk to other criminals who use automated tools to test them across many sites[4]. Your immediate risk depends on what data is exposed and whether you still use the same passwords elsewhere.

Verify the Breach

Check whether your information is part of a known breach using Have I Been Pwned (haveibeenpwned.com), a reputable service that aggregates breach data without storing your passwords. Enter your email address to see which breaches have included it and what types of data were compromised. The FTC recommends using official breach-notification tools rather than trusting unsolicited emails claiming your data is for sale, as these are often phishing attempts[8].

Determine What Data Is Exposed

Different types of data require different responses:

• Email address and password: Change the password immediately on the affected site and on any other account where you reused it. Enable two-factor authentication wherever possible[4].

• Social Security number or National Insurance number: Place a fraud alert with one of the three UK credit reference agencies (Experian, Equifax, TransUnion) or the equivalent in your country. In the United States, the FTC advises freezing your credit at all three bureaus to prevent new accounts from being opened in your name[4].

• Financial account numbers or card details: Contact your bank or card issuer to close the compromised account and issue a replacement. Monitor statements for unauthorized transactions.

• Username without password: Lower immediate risk, but consider changing the username if the service allows it, and ensure the associated password is strong and unique[4].

Take Immediate Action

1. Change compromised passwords. Use a long, randomly generated password for each account. A password manager simplifies this and prevents reuse.

2. Enable multi-factor authentication (MFA). Even if a criminal has your password, MFA blocks access without a second verification step.

3. Check your credit report. In the UK, you can request a statutory credit report from each agency; in the United States, visit AnnualCreditReport.com for a free report from all three bureaus[4].

4. Freeze your credit if financial data is involved. A credit freeze prevents lenders from accessing your credit file, blocking new account applications. You can lift the freeze temporarily when you need to apply for credit yourself[4].

5. Monitor for identity theft. Set up alerts for new account activity, review bank statements regularly, and watch for unexpected mail or calls from creditors.

Understand the Difference Between Credential Exposure and Identity Theft

Credential exposure means your email and password are listed in a breach database, which criminals may use to attempt logins on other sites — a tactic called credential stuffing. Identity theft means someone is using your personal information to open accounts, file tax returns, or commit fraud in your name. The first is common and manageable with password changes and MFA; the second requires more extensive remediation, including fraud alerts, credit freezes, and possibly a police report[4][8].

If you discover unrecognized accounts or transactions, report identity theft at IdentityTheft.gov (in the United States) or Action Fraud (in the UK) to receive a personalized recovery plan[8]. Data on the dark web is a warning, not a crisis, but it requires you to act quickly to close the vulnerabilities criminals could exploit.

Common Misconceptions About the Dark Web

Popular culture and sensational media coverage have created a set of persistent myths about the dark web that distort what it actually is and how it works. Correcting these misconceptions helps you assess real risks without overestimating or underestimating the technology.

The Dark Web Is Not '90% of the Internet'

You may have read that the dark web represents the vast majority of online content, hidden beneath the surface web that search engines index. This is false. The figure conflates the dark web with the deep web — all content not indexed by search engines, including password-protected email accounts, subscription databases, corporate intranets, and medical records. The deep web is large, but most of it is mundane and has nothing to do with Tor or .onion sites[1]. The dark web itself — the subset of the deep web accessible only through Tor or similar anonymity networks — is a tiny fraction of total internet traffic. According to Delft University of Technology research, the number of .onion services grew from roughly 0.5 million in 2021 to about 0.8 million in 2024[9]. By comparison, there are hundreds of millions of surface web domains. The dark web is a niche ecosystem, not the hidden majority of the internet.

The Dark Web Is Not Only for Criminals

Illegal marketplaces and forums receive the most attention, but many users access the dark web for legitimate purposes. The U.S. Department of Justice Office of the Inspector General found that users rely on .onion services to discuss socially sensitive matters, counter censorship in oppressive regions, and protect their privacy from surveillance[3]. Journalists use SecureDrop to receive documents from sources without exposing metadata; activists in authoritarian countries use Tor to bypass internet filters; and privacy-conscious individuals use .onion versions of mainstream sites like Facebook to avoid tracking[2]. The technology itself is neutral. It enables both illegal activity and protected speech, and law enforcement focuses resources on the most egregious criminal organizations rather than all dark web users[6].

The Dark Web Is Not Anonymous by Default

Using Tor does not make you anonymous automatically. Tor protects your IP address by routing traffic through volunteer relays, but it does not hide your identity if you log into accounts tied to your real name, reuse usernames across platforms, or provide personal information in messages[2]. Law enforcement has arrested dark web marketplace operators and users by correlating activity across multiple sources, exploiting operational security mistakes, and using forensic techniques that Tor cannot prevent. Anonymity requires discipline: you must avoid linking your Tor activity to your real identity, use separate accounts and devices, and understand that any mistake can undo the protection Tor provides. The network gives you tools, not guarantees.

The Dark Web Is Not the Same as the Deep Web

These terms are often used interchangeably, but they describe different things. The deep web is all content not indexed by search engines — your email inbox, online banking portal, and university library database are all part of the deep web, and you access them through ordinary browsers[1]. The dark web is the subset of the deep web that uses anonymity networks like Tor and special addressing systems like .onion to hide the location and identity of both visitors and publishers[1]. Every dark web site is part of the deep web, but the vast majority of the deep web is not part of the dark web. Conflating the two creates confusion about scale and purpose.

The Dark Web Is Not Disappearing

Despite high-profile law enforcement takedowns of marketplaces like Silk Road, AlphaBay, and Hydra, the dark web continues to grow. The number of .onion services increased by roughly 50% from 2021 to 2024, and onion-service traffic nearly tripled in the same period, from 6 Gbit/s to 17 Gbit/s[9]. Mean daily Tor users worldwide fluctuate — Statista recorded 1.95 million on 26 October 2024, with a peak of over nine million on 21 October 2023[10] — but the network remains active and widely used. Law enforcement operations disrupt individual marketplaces and arrest operators, but new sites appear to replace them, and the underlying technology is decentralised and resilient. The dark web is not a temporary phenomenon; it is a persistent feature of the internet ecosystem, shaped by ongoing tension between privacy advocates, criminals, and authorities.

Understanding what the dark web is not helps you evaluate the real risks and benefits without relying on myths. The technology is smaller, more varied, and more complex than popular accounts suggest, and your safety depends on accurate knowledge rather than exaggerated fears.

Common Mistakes and Misconceptions

Most people first hear about the dark web through news stories about drug markets or data leaks. That framing creates a distorted picture: you overestimate the danger in some areas and underestimate it in others. This section separates the persistent myths from what the documented record actually shows.

Assuming the dark web is illegal to visit

The idea persists because so much reporting focuses on arrests and marketplaces. Accessing the dark web itself is not illegal in the United States or the United Kingdom, though sites on it are often used for illegal activities such as trafficking drugs, firearms, and malware[3]. Law enforcement does not target people simply for running the Tor browser. What creates legal risk is what you do once you are there: buying prohibited goods, downloading illegal material, or participating in criminal forums. Treat the network like any public space — legal to enter, but your actions inside determine your exposure.

Believing Tor makes you completely anonymous

Tor hides your IP address by routing traffic through a random series of volunteer relays rather than a direct path to the destination[5]. That protects your location from the website you visit, but it does not hide your identity if you log into an account tied to your real name, reuse a username from the surface web, or type personal details into a form. Investigators have identified dark web users by correlating small operational mistakes across multiple sources. Anonymity is a practice, not a feature you switch on: separate accounts, separate devices, and no real identifying information.

Conflating the dark web with the deep web

This is the most common error in articles and videos about the topic. The deep web is everything search engines do not index — your email inbox, online banking portal, and subscription databases — and you access it through an ordinary browser[1]. The dark web is a small subset of that: sites using the .onion special-use top-level domain, reachable only through Tor, with end-to-end encryption between visitor and website[1][2]. Every .onion site is part of the deep web, but almost none of the deep web is the dark web. Understanding the distinction prevents you from imagining a vast hidden internet when the documented number of onion services is around 0.8 million as of 2024[9].

Assuming everyone on the dark web is a criminal

The most publicized cases involve marketplaces and illegal forums, but that is not the whole population. A U.S. Department of Justice audit found that many users access the dark web for legitimate purposes, including discussing socially sensitive matters and countering censorship in oppressive regions[3]. Journalists use onion services like SecureDrop to receive documents from sources without exposing metadata, and activists rely on Tor to bypass internet filters[2]. The FBI itself focuses enforcement on the most egregious criminal organizations rather than individual users[6]. The technology is neutral; the user base is mixed.

Thinking your data on the dark web means identity theft has already happened

Finding your email address or password in a dark web listing is alarming, but it describes credential exposure, not confirmed fraud. Credential exposure means your login details appear in a breach database and criminals may attempt to use them on other sites; identity theft means someone has actually opened accounts or committed fraud in your name[4][8]. The first is common and often manageable by changing the password and enabling multi-factor authentication[4]. The second requires credit freezes, fraud alerts, and a recovery plan. Treat a dark web data listing as a warning to act, not proof that the worst has already occurred.

Assuming the dark web is shrinking because marketplaces get shut down

High-profile takedowns create the impression that law enforcement is closing the network down. The opposite is documented: the number of onion services grew roughly 50 percent from about 0.5 million in 2021 to about 0.8 million in 2024, and onion-service traffic nearly tripled from 6 Gbit/s to 17 Gbit/s in the same period[9]. Individual marketplaces disappear, but replacements appear, and the underlying Tor infrastructure remains decentralized and resilient. Mean daily Tor users worldwide reached 1.95 million on 26 October 2024, with a recorded peak above nine million a year earlier[10]. The dark web is a persistent part of the internet, not a fading anomaly.

What to Remember

• Accessing the dark web is legal in the United States and the United Kingdom; your actions there determine your legal exposure[3].

• Tor hides your IP address, not your identity if you log into real-name accounts or reuse surface-web usernames[5].

• The dark web is a small subset of the deep web: only .onion sites reachable through Tor, around 0.8 million as of 2024[1][2][9].

• A dark web data listing means credential exposure, not confirmed fraud — change the password and enable multi-factor authentication[4][8].

• The network is growing, not shrinking: onion services rose roughly 50 percent from 2021 to 2024[9].

Start with the one action that reduces your real risk today: check whether your email appears in a known breach database, then change that password before exploring anything else. For a plain-language breakdown of what the dark web actually is, read Dark Web Definition: What You Should Know.