Defining the Dark Web: What You Need to Know

What the Dark Web Is (and Is Not)

The dark web is a small portion of the deep web that has been intentionally hidden and requires specific software—most commonly Tor—to access[1][2]. You cannot reach it through Chrome, Firefox, or Safari in their default configuration, and standard search engines like Google will not index its content.

People often confuse the dark web with the deep web, but they are not the same. The surface web contains indexed content easily accessible with a traditional search engine[1][4]. The deep web contains unindexed content that cannot be accessed with a simple search—your email inbox, online banking portal, and password-protected documents all sit in the deep web[1][5]. Germany's Federal Office for Information Security states that the deep web makes up approximately 90% of the entire web[6]. The dark web is a subset of the deep web: deliberately encrypted and anonymized, not just unindexed.

Key Technical Distinctions

The dark web differs from other parts of the internet in two ways:

• Encryption and routing: All connections use multiple layers of encryption, routing your traffic through a sequence of volunteer-run relays—typically three—so that no single relay knows both your identity and your destination[7][8].

• Deliberate concealment: Sites use special addresses (such as .onion domains) that standard browsers cannot resolve, and hosting locations are hidden by design.

The dark web is not a single 'place' or website. It is an overlay network—a collection of services running on top of the regular internet infrastructure—that you access through specific software[2]. Tor is the most widely used tool; according to Tor Metrics data for 2024, Germany had 1,051,434 daily users and the United States had 438,368[9].

Legality and Use

Accessing the dark web is not illegal[2][3]. The Congressional Research Service notes that the dark web may be used for legitimate purposes as well as to conceal criminal or otherwise malicious activities[1]. Journalists, whistleblowers, and activists use it to communicate securely; organizations like The Guardian and The New York Times operate SecureDrop servers on the dark web for anonymous tips. At the same time, the European Parliament Research Service notes that the dark web contains websites providing access to illegal content and services such as drugs, firearms, stolen data, and child sexual abuse material[3]. Germany's BSI emphasizes that what is illegal offline remains illegal online, regardless of whether it happens on the clear web or the dark net[6].

The distinction matters: using Tor or similar anonymity tools does not indicate wrongdoing[3], but the activities you engage in while using them are subject to the same laws that apply everywhere else.

Surface Web, Deep Web, and Dark Web: The Core Distinction

The internet has three layers, and most people use only one of them every day. The surface web contains indexed content easily accessible with a traditional search engine such as Google[1][4]—news sites, Wikipedia, public company pages, and most of what you reach by typing a query into a search bar. The deep web contains unindexed content that cannot be accessed with a simple search[1][5]: your Gmail inbox, online banking portal, medical records behind a login, and subscription content on sites like The Times or Netflix. Germany's Federal Office for Information Security states that the deep web is by far the most extensive part of the web, making up approximately 90% of the entire web[6]. The dark web is a segment of the deep web that has been intentionally hidden and that you generally cannot access without using special software[1].

Comparison of the Three Layers

The deep web is not mysterious or dangerous—it is mostly mundane private content that you access every day. Your NHS patient portal, university library database, and work intranet all sit in the deep web because they require authentication and are not meant to be indexed. The dark web is a tiny fraction of the deep web, deliberately encrypted and anonymized[1][2]. You need specific software to reach it, and its sites use special addresses like .onion domains that standard browsers cannot resolve.

Most of the internet you cannot Google is simply password-protected or paywalled, not hidden for anonymity. The dark web stands apart because it actively conceals both the location of its servers and the identity of its users through onion routing and encryption[7][8].

How the Dark Web Works Technically

The dark web relies on onion routing: your connection passes through a sequence of relays—typically three—and every relay in the circuit knows only its predecessor and successor, but no other relays in the circuit[7]. Each relay removes one layer of encryption, like peeling an onion, until the final relay (the exit node) sends your request to the destination. This design means no single point in the network knows both who you are and what you are accessing.

Encryption at Every Step

All connections in Tor use TLS link encryption, and the client establishes an ephemeral encryption key with each relay in the circuit[8]. When you visit a .onion site, the entire path—from your device to the hidden service—remains encrypted end-to-end. Only the exit relay can read the relay cells if you are accessing a regular website, but .onion addresses never leave the Tor network, so even the exit relay cannot see the final destination[8].

Standard browsers cannot reach .onion addresses because those domains do not exist in the public Domain Name System. A .onion address is a cryptographic identifier that Tor resolves internally, routing your request through the network to a hidden service whose physical location and IP address remain concealed[1][2]. You need the Tor Browser or another tool configured to use the Tor network.

The Scale and Structure of Tor

Tor Metrics describes the Tor network as one of the largest deployed anonymity networks, consisting of thousands of volunteer-run relays and millions of users[10]. According to Tor Metrics data for 2024, Germany had the highest mean number of directly connecting Tor users at 1,051,434 daily users, ahead of the United States at 438,368[9]. These relays are operated by volunteers around the world; no single organization controls the entire network.

Other overlay networks exist—I2P and Freenet offer similar anonymity—but Tor dominates dark web access because of its user base, active development, and the number of .onion services hosted on it. Each network uses a different addressing scheme and routing protocol, so a site on one network cannot be reached from another without additional software.

This architecture provides anonymity for both users and site operators, which is why journalists and whistleblowers use it—and why law enforcement agencies find it challenging to trace illegal activity back to individuals.

What Is Actually on the Dark Web

The dark web hosts a mix of legitimate privacy tools, community forums, and illegal marketplaces. Most public discussion focuses on criminal activity, but journalists, activists, and whistleblowers rely on the same infrastructure to communicate securely in countries where free speech is restricted or surveillance is pervasive.

Privacy-Focused Communication and Whistleblowing Platforms

News organizations operate SecureDrop servers on the dark web so that sources can submit documents anonymously without revealing their identity or location. The Guardian, The New York Times, and other outlets maintain .onion addresses specifically for this purpose. You access these platforms through Tor Browser, upload files or messages, and the journalist retrieves them without any direct connection between you and the newsroom.

Encrypted email services and messaging platforms also run on the dark web, offering end-to-end encryption and no requirement to provide a phone number or recovery email. These services appeal to people who need confidentiality—human rights workers, investigative reporters, or individuals living under authoritarian regimes—but they function like any other email provider once you create an account.

Forums and Communities

The dark web hosts discussion boards and forums on topics ranging from privacy advocacy and software development to niche hobbies. Some communities exist on the dark web simply because participants value anonymity, not because the content is illegal. Others discuss topics that are legal to talk about but sensitive in certain jurisdictions, such as political dissent or LGBTQ+ rights in countries where those identities are criminalized.

You will also find forums dedicated to hacking, data breaches, and cybersecurity research. Not every discussion in these spaces involves illegal activity—security researchers share findings, and system administrators exchange advice—but the anonymity of the platform means that criminal actors use the same forums to trade stolen credentials or exploit kits.

Illegal Marketplaces and Content

The European Parliament Research Service notes that the dark web contains websites providing access to illegal content and services such as drugs, firearms, stolen data, and child sexual abuse material[3]. Marketplaces operate like e-commerce sites, with product listings, user reviews, and escrow systems, but they trade goods and services that are illegal in most jurisdictions.

Silk Road, which launched in 2011 and was shut down by the FBI in 2013, remains the most widely cited example of a dark web marketplace. It sold narcotics, fake IDs, and hacking tools, and its closure marked the first major law enforcement operation targeting a dark web platform. Since then, other marketplaces have appeared, been taken down, and been replaced. The Congressional Research Service notes that the dark web may be used for legitimate purposes as well as to conceal criminal or otherwise malicious activities[1].

Germany's BSI emphasizes that what is illegal offline remains illegal online, regardless of whether it happens on the clear web or the dark net[6]. Accessing the dark web does not grant immunity from prosecution. If you engage in illegal activity—buying controlled substances, trading stolen data, or distributing prohibited material—you are subject to the same laws that apply everywhere else[2][6].

What You Will Not Find

The dark web is not a separate internet with fundamentally different rules. You will not stumble upon illegal content by accident; most .onion sites require you to know the address in advance or find it through a directory. The architecture provides anonymity, not a lawless zone. Law enforcement agencies monitor dark web activity, infiltrate marketplaces, and prosecute individuals who use the platform for crime[2].

If you are considering exploring the dark web out of curiosity, understand that the majority of content is mundane—forums, text-based sites, and mirrors of surface web services—but the presence of illegal material and scams is real. You should know what you can find on the dark web before you decide to access it.

Is the Dark Web Illegal? Legal Status and Common Misconceptions

Accessing the dark web is not illegal in most countries. The DOJ Office of the Inspector General states that accessing the dark web is not illegal, although dark web sites are often used to engage in illegal activities[2]. The European Parliament Research Service confirms that accessing and using Tor or similar anonymity tools is not illegal and does not indicate any wrongdoing[3]. You can download Tor Browser, connect to the network, and visit .onion sites without breaking the law in the United Kingdom, the United States, most of Europe, and many other jurisdictions.

What matters is what you do once you are there. Buying controlled substances, trading stolen credit card data, accessing child sexual abuse material, or hiring someone to commit a crime remains illegal regardless of the platform you use[3][6]. Germany's BSI emphasizes that what is illegal offline remains illegal online, regardless of whether it happens on the clear web or the dark net[6]. The anonymity of the dark web does not create a legal safe harbor; it simply makes investigation more difficult for law enforcement.

Legal Status by Activity

Some countries restrict or ban Tor entirely. China, Russia, and Iran have attempted to block access to the Tor network through technical measures, and using circumvention tools in those jurisdictions may carry legal risk. If you live in or travel to a country with restrictive internet laws, check local regulations before installing Tor or accessing the dark web.

Common Misconceptions

Many people believe that simply visiting the dark web puts you on a government watchlist. This is not supported by evidence. The European Parliament Research Service states that using Tor does not indicate wrongdoing[3], and Tor Metrics data shows over a million daily users in Germany alone[9]—far too many for blanket surveillance. Law enforcement agencies focus on individuals who engage in illegal activity, not on everyone who uses privacy tools.

You will not accidentally break the law by browsing the dark web. Most illegal content and services require you to know the .onion address in advance or actively search for them in directories and forums. Stumbling upon a marketplace or illegal material by chance is extremely unlikely. The architecture of the dark web does not expose you to criminal content unless you seek it out.

Another misconception is that the dark web guarantees anonymity and protection from prosecution. It does not. Law enforcement agencies have successfully infiltrated marketplaces, seized servers, and arrested operators and buyers[2]. The FBI's takedown of Silk Road in 2013 and subsequent operations against other marketplaces demonstrate that anonymity is not absolute. If you engage in illegal activity, you remain subject to investigation and prosecution.

If you are considering accessing the dark web for legitimate reasons—research, privacy, or secure communication—you are within your rights in most jurisdictions. If you are considering it to buy illegal goods or access prohibited content, you are subject to the same laws that apply everywhere else, and the dark web does not protect you from consequences.

Risks and Threats for Everyday Users

The dark web is not a safe place by default. While accessing it is legal[2][3], the platform hosts malware, phishing sites, scams, and illegal content that pose real risks to anyone who visits. Anonymity protects both legitimate users and criminals, which means you cannot assume that a site is trustworthy simply because it exists on the dark web. Curiosity alone is not a sufficient reason to explore.

Malware and Phishing

Many .onion sites distribute malware disguised as legitimate software, leaked documents, or pirated media. You download a file expecting one thing and receive ransomware, spyware, or a keylogger instead. Phishing sites mimic well-known dark web marketplaces or services to steal login credentials, cryptocurrency wallet keys, or personal information. Because search engines do not index .onion addresses and no central authority verifies site authenticity, you have no reliable way to confirm that a site is what it claims to be.

Tor Browser provides some protection by isolating each site and blocking many scripts by default, but it does not prevent you from voluntarily downloading a malicious file or entering credentials into a fake login page. If you access the dark web from a device that also holds personal files, banking apps, or work documents, a single mistake can compromise everything on that machine.

Scams and Fraud

Marketplaces on the dark web operate without consumer protection, refund policies, or legal recourse. If you send cryptocurrency to a vendor and receive nothing in return, you have no way to recover your money. Exit scams—where a marketplace operator disappears with all funds held in escrow—are common. Even marketplaces with user reviews and reputation systems are vulnerable to fraud, because reviews can be faked and vendors can vanish after building trust.

You will also encounter scams that promise hacking services, fake identification, or access to restricted databases. Many of these offers are designed to take your money without delivering anything. Others are law enforcement honeypots set up to identify and prosecute individuals attempting to buy illegal services.

Exposure to Illegal Content

The European Parliament Research Service notes that the dark web contains websites providing access to illegal content and services such as drugs, firearms, stolen data, and child sexual abuse material[3]. While you will not stumble upon this content by accident, directories, forums, and search engines on the dark web may link to it. Viewing, downloading, or distributing such material is illegal in most jurisdictions[3][6], and law enforcement agencies actively monitor dark web activity[2].

If you accidentally encounter illegal content, close the browser immediately and do not download or share anything. Accessing certain types of material—particularly child sexual abuse material—is a criminal offense even if you claim it was unintentional. Germany's BSI emphasizes that what is illegal offline remains illegal online, regardless of the platform[6].

False Sense of Anonymity

Tor provides strong anonymity, but it is not absolute. Law enforcement agencies have successfully de-anonymized users through traffic analysis, server seizures, and mistakes made by individuals who reuse identities or reveal personal information[2]. If you log into a personal email account, use your real name in a forum, or connect to the dark web without additional operational security measures, you can be identified.

Many people assume that using Tor alone makes them untraceable. This is incorrect. If you engage in illegal activity, you remain subject to investigation and prosecution. The DOJ Office of the Inspector General confirms that dark web sites are often used to engage in illegal activities and that accessing the dark web does not grant immunity[2].

What Not to Do

If you choose to explore the dark web, follow these rules to reduce risk:

• Do not download files from .onion sites unless you know exactly what they are and have a way to verify their integrity.

• Do not enter personal information, real email addresses, or payment details linked to your identity.

• Do not buy illegal goods or services; doing so is a crime regardless of the platform[3][6].

• Do not reuse usernames, passwords, or identities from the surface web.

• Do not access the dark web from a device that contains sensitive personal or work data.

• Do not assume that Tor makes you invisible; operational security requires more than software.

The dark web is a tool, not a safe space. If you do not have a specific, legitimate reason to use it—secure communication, research, or privacy in a high-risk environment—the risks outweigh any benefit. For more detail on what you might encounter, see what you can find on the dark web.

How to Verify What You Read About the Dark Web

Most articles and news reports about the dark web contain errors, outdated information, or deliberate exaggeration. You cannot assume that a claim is accurate simply because it appears in a mainstream publication or on a technology blog. Sensational headlines generate clicks, and many journalists repeat statistics and anecdotes without checking primary sources. If you want to understand what the dark web actually is and how it works, you need to verify claims yourself.

Start with primary sources: official documentation from the Tor Project, academic papers published in peer-reviewed journals, court records from prosecutions, and reports from government agencies such as the U.S. Congressional Research Service[1], the European Parliament Research Service[3], and national cybersecurity authorities like Germany's BSI[6]. Security vendor reports can provide useful data, but treat them with caution—many are designed to promote products and may overstate threats to justify their services.

When you encounter a specific claim about the dark web, ask yourself: where did this information come from? If the article does not cite a primary source, search for the original data. If it cites another news article, follow the chain back to the first publication and check whether that publication provides evidence. If the trail ends without a verifiable source, treat the claim as unverified.

Four Common Reporting Errors

Conflating Deep Web and Dark Web

Many articles use 'deep web' and 'dark web' interchangeably or claim that the dark web is 90% of the internet. This is incorrect. The Congressional Research Service defines the deep web as unindexed content that cannot be accessed with a simple Google search, and the dark web as a segment of the deep web that requires special software[1]. Germany's BSI states that the deep web makes up approximately 90% of the entire web[6], but the dark web is a tiny fraction of that. The deep web includes password-protected email accounts, online banking portals, and subscription databases—none of which are part of the dark web.

This matters because conflating the two creates the false impression that most of the internet is hidden and dangerous. It is not. Most of the deep web is mundane and legal. When you read a statistic about the 'dark web', check whether the source is actually describing the deep web instead. If the article does not cite a definition from a government or technical authority, the claim is likely incorrect.

To verify: check the Congressional Research Service report[1] or the BSI explainer[6] for the correct definitions.

Citing Outdated Marketplaces as Current

Articles frequently mention Silk Road, AlphaBay, or other defunct marketplaces as if they are still operating. Silk Road was shut down by the FBI in 2013[2], and many subsequent marketplaces have been seized or exit-scammed since. Reporting that treats these sites as current examples misleads readers about the state of the dark web today.

This matters because it suggests that specific threats or services are still available when they are not. If you are trying to assess risk or understand what exists on the dark web now, outdated examples do not help. When you see a marketplace named in an article, check the date of the article and search for news of law enforcement action or closure. Court records and DOJ press releases are reliable sources for confirming takedowns.

To verify: search for the marketplace name plus 'seized' or 'shut down' and look for official statements from the DOJ, FBI, or Europol.

Repeating Unverified Statistics

You will often see claims such as '80% of dark web traffic is illegal' or 'thousands of hitmen for hire operate on .onion sites'. These figures are rarely sourced, and when they are, the source is often another unsourced article or a security vendor report with no methodology disclosed. Tor Metrics provides verified data on user numbers and relay distribution[10][9], but it does not measure the proportion of traffic that is illegal, because that data is not observable without breaking anonymity.

This matters because unverified statistics shape public perception and policy without evidence. If you base your understanding of the dark web on false numbers, you will either overestimate or underestimate real risks. When you encounter a statistic, check whether the article links to a primary source with a clear methodology. If it does not, discard the claim.

To verify: visit Tor Metrics for user and relay data[10][9]. For claims about illegal activity, check whether the article cites a court record, academic study, or government audit[2].

Treating All Dark Web Activity as Criminal

Many reports present the dark web as exclusively a platform for crime, ignoring legitimate uses such as whistleblowing, secure communication, and privacy in authoritarian countries. The Congressional Research Service notes that the dark web may be used for legitimate purposes as well as to conceal criminal or otherwise malicious activities[1], and the European Parliament Research Service confirms that accessing Tor is not illegal and does not indicate wrongdoing[3].

This matters because it discourages people who have legitimate reasons to use the dark web—journalists, activists, researchers—from doing so. It also creates the false impression that anyone using Tor is engaged in illegal activity, which is not supported by evidence. Tor Metrics data shows over a million daily users in Germany alone[9], and most of them are not criminals.

To verify: check government reports that acknowledge legitimate use[3][1] and compare them to the article's framing. If the article does not mention legal applications, it is incomplete.

How to Check a Claim

When you read something about the dark web, follow this process:

1. Identify the specific claim (a statistic, a description of how Tor works, a statement about legality).

2. Check whether the article cites a primary source. If it does, follow the link or search for the document.

3. If the source is another news article, follow the chain back to the original publication.

4. If you reach a dead end or a source that does not support the claim, treat the information as unverified.

5. For technical claims about Tor, check the Tor Project's official documentation and specifications[7][8].

6. For legal claims, check government reports from the Congressional Research Service[1], the European Parliament[3], or national authorities[6].

7. For claims about law enforcement activity, search for court records, DOJ press releases, or official audit reports[2].

You do not need to verify every sentence in every article, but if a claim shapes your decision about whether to use Tor or how to assess risk, check it before you act on it. The dark web is widely misunderstood, and most of what you read is wrong in at least one significant way. Primary sources are your only reliable guide.

Common Mistakes and Misconceptions

Most people form their understanding of the dark web from headlines, TV shows, and secondhand summaries. Those sources compress a technical topic into a few dramatic images, and the compression creates predictable errors. You have probably absorbed at least one of the misconceptions below without realizing it. Each one changes how you assess risk, legality, and whether the dark web matters to you.

‘The dark web and the deep web are the same thing’

This is the most common error, and it appears even in articles that claim to explain the difference. The Congressional Research Service defines the deep web as unindexed content that you cannot reach with a simple Google search, while the dark web is a specific segment of the deep web that requires special software to access[1]. Germany's BSI estimates that the deep web makes up roughly 90% of the entire web, but the dark web is a tiny fraction of that figure[6].

The conflation matters because it makes the internet seem far more dangerous than it is. Your online banking portal, private email inbox, and subscription news archive are all part of the deep web, and none of them are hidden or criminal in any meaningful sense. When you see a statistic about the ‘dark web’ being enormous, check whether the source is actually describing the deep web instead.

The correct mental model is a hierarchy: surface web at the top, deep web below it, and the dark web as a small, deliberately hidden layer inside the deep web[1][6].

‘Accessing the dark web is illegal’

Many people assume that simply opening Tor and visiting an .onion site breaks the law. That assumption is wrong. The U.S. Department of Justice Office of the Inspector General states directly that accessing the dark web is not illegal, even though dark web sites are often used for illegal activities[2]. The European Parliament Research Service makes the same point: using Tor or similar anonymity tools is not illegal and does not indicate wrongdoing[3]. Germany's BSI also confirms that browsing the dark net alone is not illegal[6].

This misconception has real consequences. It discourages journalists, researchers, and activists from using privacy tools they may legitimately need, and it makes ordinary users feel like they have committed a crime just by being curious. What is illegal offline remains illegal online, regardless of whether it happens on the clear web or the dark net[6]. The tool is not the crime; the activity is.

If you are considering using Tor for a legitimate purpose, the legal risk is not in the access itself but in what you do once you are there[2][3][6].

‘The dark web is entirely criminal’

The opposite misconception is equally common: that every .onion site sells drugs, weapons, or stolen data. The dark web does contain websites offering illegal content and services, including drugs, firearms, stolen data, and child sexual abuse material[3]. But the Congressional Research Service notes that the dark web may also be used for legitimate purposes, such as concealing criminal or malicious activities on one side and protecting privacy or secure communication on the other[1].

The balanced view is that the dark web hosts a mix of content, and the proportion of illegal material is not reliably measurable. Tor Metrics shows over a million daily users in Germany alone[9], and most of those users are not engaged in crime. Whistleblowing platforms, secure email services for journalists, and privacy resources for people in authoritarian countries all operate on the dark web[3][1].

When you read a report that treats the dark web as a single criminal marketplace, you are reading a simplification that ignores documented legitimate uses[3][1].

‘Tor makes you completely anonymous’

Tor provides strong anonymity, but it is not absolute. The Tor Project explains that a circuit typically uses three relays, and each relay knows only its immediate predecessor and successor, not the full path[7]. All connections use TLS link encryption, and only the exit relay can read the relay cells[8]. That architecture hides your IP address from the destination site and hides your destination from your entry relay.

However, anonymity fails when users make mistakes. The DOJ Office of the Inspector General audit documents cases where individuals were identified not by breaking Tor's encryption but through operational errors—reusing usernames, logging into personal accounts, or revealing identifying details[2]. Law enforcement has also used compromised or malicious exit relays to observe traffic leaving the Tor network.

The correct assumption is that Tor protects your anonymity only as long as your behavior does not leak identifying information. Software alone cannot protect you from your own operational mistakes[2][7][8].

‘Everything you read about the dark web is accurate’

Media coverage of the dark web is frequently wrong in at least one significant way. Articles repeat outdated marketplaces as if they were still operating, cite statistics without primary sources, and conflate deep web with dark web. Silk Road was shut down in 2013, yet it still appears in reports as a current example[2]. Claims about the percentage of dark web traffic that is illegal are rarely sourced, because that data is not observable without breaking anonymity[10][9].

This matters because you make decisions based on what you read. If you believe the dark web is 90% of the internet, you will overestimate the threat. If you believe Tor is illegal, you will avoid a tool that might protect your privacy. If you believe Tor guarantees anonymity, you may take risks that expose you.

The correct approach is to verify claims against primary sources before acting on them. Check the Congressional Research Service for definitions[1], the European Parliament Research Service for legality[3], Tor Metrics for user data[10][9], and court records or DOJ audits for law enforcement outcomes[2]. If an article does not cite a primary source, treat its specific claims as unverified.

Conclusions

• The dark web is a small, software-specific slice of the deep web, not the 90% of the internet that headlines sometimes imply[1][6].

• Accessing it with Tor is not illegal by itself; the activity you choose determines legal risk[2][3][6].

• Tor reduces anonymity but does not guarantee it; reusing usernames or personal details can expose you[2][7].

• We treat media claims about the dark web as unverified until a primary source confirms them[2][10][9].

• If you browse, treat every .onion site as untrusted and avoid entering any identifying information[2].

For a concrete first step, see our guide to the Google Dark Web Report and check what it can and cannot tell you.