Dark Web: definition, how it works, and complete guide 2026

The dark web — often spelled darkweb or mistakenly confused with the deep web — refers to all sites accessible only through specific anonymization networks, primarily Tor. Behind the alarming headlines and sensationalist imagery lies a far more nuanced reality: a technological infrastructure born in US Navy laboratories, today used as much by investigative journalists, whistleblowers, and privacy-conscious citizens as by criminal actors. This comprehensive guide explains what the dark web actually is, how it works, who uses it, what its legitimate and criminal uses are, how to access it safely, and what the law says. The goal: to give you a factual, documented, and demystified picture.

What is the dark web?

The dark web is a collection of websites whose access requires specific software capable of routing connections through an anonymization network. The most widely used of these networks is Tor (The Onion Router), but others exist such as I2P (Invisible Internet Project) and Freenet. These sites use addresses ending in .onion (for Tor), .i2p (for I2P), or cryptographic identifiers for Freenet. Unlike regular sites with .com or .fr domains, they are not indexed by Google or Bing and are not accessible from a standard browser like Chrome or Firefox.

The central feature of the dark web is bidirectional anonymity: neither the user knows who operates the site they visit, nor can the site operator identify their visitors. Onion routing (hence the name "onion") passes each connection through several relays spread around the world, each one knowing only the previous and next step. This architecture makes it practically impossible to correlate a user with their destination, provided the software is used correctly.

The term "dark web" appeared in the technical literature in the early 2000s, at the time of Tor's public launch. It spread widely in mainstream media from 2013, when Silk Road, the first major illegal marketplace hosted on Tor, was seized. Since then, the term has become synonymous in the public imagination with criminal activities, even though its technical and sociological reality is far more nuanced.

Dark web, deep web, clear web: the 3 layers of the Internet

The most common confusion in mainstream media concerns the distinction between the dark web, the deep web, and the clear web. These three layers refer to different realities, and confusing them leads to major errors about the size and content of each. For a thorough analysis, see our complete guide to the deep web and our detailed dark web vs deep web comparison.

The clear web (or surface web)

The clear web, also called the surface web, encompasses all pages freely accessible and indexed by search engines. Google, Bing, DuckDuckGo, Qwant, and Yandex index these pages and make them available in search results. This is the visible tip of the Internet iceberg: news sites, blogs, online stores, public social networks, Wikipedia. The clear web represents roughly 4 to 10% of the total Internet content according to estimates.

The deep web

The deep web encompasses all online content not indexed by search engines, for various reasons: password-protected pages (your online banking, your Gmail account, your Google Drive documents), databases accessible only via specific queries (university library catalogs, municipal archives), corporate intranets, payment pages, dynamically generated URLs. The deep web represents the vast majority of the Internet: often estimated at 90-96% of the total content. This is the figure that sensationalist media wrongly attribute to the dark web.

The dark web

The dark web is a microscopic sub-part of the deep web, accessible only through dedicated anonymization networks. While the deep web exists for practical reasons (authentication, personal data protection), the dark web exists for anonymity and resistance to censorship. Estimates put between 60,000 and 100,000 active .onion services at any given time, which is a tiny fraction of the billions of pages on the global web. It is therefore a frequent error to claim that the "dark web represents 96% of the Internet": that figure applies to the deep web, not the dark web.

Actual size of the dark web

Several academic studies have attempted to estimate the real size of the dark web. A major piece of work published by researchers at King's College London in 2016 identified around 5,000 active English-language .onion sites at the time. More recent estimates from the Onionoo project (official Tor Project metrics) indicate that in 2024-2025, between 600,000 and 900,000 unique .onion addresses are published on the Tor network, but only a small fraction correspond to truly accessible websites: the majority are automated services, mirrors, or addresses generated for testing.

The Tor network itself has approximately 8,000 relays spread across some sixty countries, and serves 2 to 3 million unique daily users. The vast majority of these users do not access .onion services but use Tor to reach clear web sites anonymously.

History and origins of the dark web

Contrary to the misconception that associates the dark web with criminality, the technologies that make it possible originate from military and academic institutions. For a detailed account, see our complete article on the history of Tor.

Military origins (1995-2004)

The first research on onion routing began in 1995 at the US Navy's Naval Research Laboratory (NRL), led by Paul Syverson, David Goldschlag, and Michael Reed. The initial goal was military: to allow US intelligence agents to communicate anonymously on the Internet without revealing their identity or location. The project was later taken up in 2002 by Roger Dingledine and Nick Mathewson, who founded the Tor Project in 2006, a non-profit organization based in Seattle.

Opening to the public (2004-2011)

For anonymity to work, a critical mass of users is needed: a network used only by spies would be trivial to monitor. The Tor Project therefore decided to open the network to the general public, with initial financial support from the Electronic Frontier Foundation. Progressively, the network attracted journalists in authoritarian countries, activists, and ordinary users concerned about their privacy. The first legitimate .onion services appeared (WikiLeaks, technical forums), but also the first criminal uses.

The Silk Road era and media coverage (2011-2013)

In 2011, Silk Road opened its doors: the first major .onion marketplace selling mainly drugs, operated by Ross Ulbricht under the pseudonym "Dread Pirate Roberts". The site reached several thousand vendors and an estimated volume of $1.2 billion over two years, until the site was seized and Ulbricht arrested by the FBI in October 2013. This moment brought the dark web into the public consciousness, for better and for worse. Ross Ulbricht was eventually pardoned by Donald Trump in January 2025 after more than 11 years of imprisonment.

Maturity (2014-2026)

Since then, the dark web has become a commonplace topic: major international media (BBC, New York Times, Radio Free Europe) maintain official .onion versions; encrypted messaging services like ProtonMail and Riseup offer .onion access; journalists use SecureDrop to communicate with their sources. Illegal marketplaces continue to exist and renew themselves after each seizure (AlphaBay, Hansa, Empire, Dream, Wall Street, White House, Versus, DarkMarket), but they represent only part of the network's total activity.

How the dark web works

The technical workings of the dark web rest on three pillars: a client application (Tor Browser, I2P Router), a network of volunteer relays, and an anonymizing routing protocol. Let us explore the main mechanisms, without getting into the cryptographic details that would warrant a dedicated technical article.

Onion routing

When you ask Tor to access a site, your software builds a circuit through at least three relays: an entry node (which knows your real IP but not your destination), a middle node (which knows neither your IP nor the final destination), and an exit node (which sees the destination but not your IP). Your request is encrypted in three successive layers, each relay decrypting one layer before passing it on. This image of layered onion skins gives onion routing its name.

To access a .onion site, the logic is even more elaborate: the circuit has six relays in total (three on the user side, three on the service side), and no exit node exists since traffic stays entirely within the Tor network. This explains why .onion sites are slower and more resistant to censorship than clear web sites accessed via Tor.

.onion v3 addresses

Modern .onion addresses (version 3, deployed from 2017 and mandatory since October 2021) consist of 56 alphanumeric characters followed by .onion. Those 56 characters are the cryptographic fingerprint of the service's public key, meaning the address is not a name but a signature. This architecture makes addresses almost impossible to guess or spoof, but also impossible to memorize — hence the value of verified directories like OnionDir for finding legitimate addresses.

Hidden services

A .onion site is technically called a hidden service or onion service since 2018. Hosting a hidden service does not require a dedicated server: any machine with an Internet connection and the Tor software installed can run one, even from a home computer. To learn how to create one, see our technical guide to hosting a .onion site.

How to go on the dark web

Going on the dark web requires neither particular technical skills nor specific equipment. If you know how to install Firefox or Chrome, you can install Tor Browser. For a step-by-step guide with screenshots and detailed explanations, see our reference article on how to go on the dark web in 2026. Here are the main steps.

1. Download Tor Browser from torproject.org (never from anywhere else: unofficial copies are regularly compromised).
2. Install like a regular browser: executable on Windows, .dmg file on macOS, .tar.xz archive on Linux, official application on Android via Google Play or F-Droid.
3. Launch Tor Browser and click "Connect". The first connection takes between 10 and 60 seconds.
4. Type a .onion address into the URL bar or browse verified directories like OnionDir.
5. Adjust your security level (shield icon) based on context: Standard for everyday use, Safer or Safest for exploring unknown sites.

On iPhone and iPad, the official Tor Browser is not available because Apple requires the use of WebKit. The alternative recommended by the Tor Project is Onion Browser, available free on the App Store. On Android, Tor Browser is official and fully functional, optionally complemented by the Orbot application to route other apps through Tor.

Legitimate uses of the dark web

The legitimate uses of the dark web are numerous and address very real needs that no other technology can meet at the same scale.

Investigative journalism and whistleblowing

Major media outlets maintain official .onion versions to protect their sources and readers: the BBC, the New York Times, ProPublica, Deutsche Welle, Mada Masr (Egypt), Radio Free Europe. The tool SecureDrop, developed by the Freedom of the Press Foundation, is used by more than 70 international newsrooms to receive confidential documents from whistleblowers while preserving their anonymity. Edward Snowden himself used Tor to communicate with journalists during the 2013 revelations. To explore tools used by journalists worldwide, see our dedicated category.

Circumventing censorship

In countries that heavily censor the Internet (China, Iran, Russia, Belarus, Saudi Arabia, North Korea), Tor is often the only reliable way to access free information. Bridges and pluggable transports (obfs4, Snowflake, meek) disguise Tor traffic as ordinary HTTPS traffic, making blocking costly for authorities. During the war in Ukraine, in Iran after the death of Mahsa Amini, in Hong Kong in 2019-2020, the number of Tor users surged in the affected regions.

Privacy and protection from surveillance

Tor allows ordinary citizens to browse the web without leaving traces exploitable by advertisers, Internet service providers, or profiling systems. The privacy tools available on the dark web include specialized VPNs, anonymous messaging, amnesic operating systems such as Tails, and search engines that do not track.

Encrypted messaging

ProtonMail, Tutanota, Riseup, Disroot, and other encrypted email services offer .onion access to strengthen the confidentiality of communications. Accessing your email via .onion prevents your ISP and intermediate networks from seeing which service you are connecting to. For an analysis of VPN combination options, see our VPN and Tor guide.

Forums and communities

.onion forums bring together communities that discuss technology, privacy, philosophy, current events — without accounts linked to a civil identity. Dread, the largest English-language dark web forum, operates on the Reddit model but without mandatory email or phone number. Hidden Answers offers an anonymous Q&A format. The official Tor Project forum hosts technical discussions with developers.

Illegal uses and limits

It would be dishonest to overlook the criminal dimension of the dark web. Academic studies estimate that between 30% and 57% of active .onion sites contain illicit material, depending on methodology. These activities include mainly: drug marketplaces (primarily cannabis, MDMA, cocaine), sale of stolen data (credit cards, login credentials, hacked databases), exchange of child sexual abuse material (actively tracked by Europol and the FBI), cybercrime (malware, ransomware-as-a-service, DDoS services), firearms sales (many scams, few real transactions).

All these activities are illegal and actively prosecuted. International operations (Onymous in 2014, Bayonet in 2017, Operation DisrupTor in 2020, Operation Dark HunTor in 2021) led to hundreds of arrests, thousands of kilograms of seized drugs, and the closure of major marketplaces. Since the seizure of Hydra (the main Russian-language marketplace) in 2022, criminal dark web volumes have permanently declined.

Dangers and precautions

Browsing the dark web presents no particular danger for a cautious user. Most problems encountered by beginners result from behavioral errors, not technical flaws. For a complete guide to risks and protections, see our dedicated article on the real dangers of the dark web.

The real risks

• .onion phishing: the 56-character addresses make imitation easy. Always verify through multiple independent sources (OnionDir, trusted directories).
• Malware in downloads: never open files from unknown sources. Use Tails or a virtual machine if you need to examine sensitive files.
• Scams: marketplaces host many fraudulent vendors. Guarantees (escrow, multisig) do not always work as advertised.
• Tor Browser vulnerabilities: 0-day flaws have historically been exploited against Tor users. Keep Tor Browser strictly up to date.
• Opsec mistakes: mixing your civil identity with your Tor pseudonym is the error that brought down 90% of criminals arrested on the dark web.

Popular myths debunked

The dark web has accumulated over the years an extensive mythology, fueled by clickbait YouTube videos and sensationalist articles. For a systematic fact-check of fifty common myths, see our complete pillar on dark web myths. Here are the most persistent ones.

"Mariana's Web" and hidden levels

The legend of a "Mariana's Web" accessible only via a quantum computer is a construct that originated on 4chan around 2011. Technically impossible, narratively compelling, it continues to circulate despite a complete absence of evidence. The Tor network has no "layered" architecture: a .onion site is either accessible or it is not.

"Red Rooms" of torture

Red Rooms — alleged virtual torture rooms streamed live — are a myth compounded by documented scams. Tor's bandwidth does not support quality live video streaming, and all "evidence" invoked by YouTube videos consists of screenshots of scams (such as Besa Mafia) or staged content.

"The dark web represents 96% of the Internet"

Classic confusion with the deep web. The dark web is a tiny fraction of the Internet: fewer than 100,000 active .onion sites out of more than one billion websites worldwide. The 96% figure refers to the deep web, meaning all content not indexed by Google (emails, databases, intranets).

Legality

Using Tor and browsing the dark web is perfectly legal in most democracies. No provision of law sanctions the use of anonymization tools as such. The right to privacy and freedom of expression are protected in democratic societies. Strong encryption has been liberalized for ordinary use. National cybersecurity agencies do not advise against the use of Tor, and their own experts use these types of tools professionally.

What remains obviously illegal are unlawful activities conducted via Tor or elsewhere: purchasing illicit products, incitement to hatred, viewing child sexual abuse material, terrorism glorification. The applicable law is exactly the same as on the regular web. For a comprehensive analysis of the legal framework, consult local legislation and official cybersecurity guidance.

Statistics and figures 2026

Here are the key documented figures for understanding the real scope of the dark web in 2026, sourced from official Tor metrics (metrics.torproject.org), recent academic studies, and Europol reports.

• 2 to 3 million daily users of the Tor network worldwide
• 8,000 active relays, spread across approximately 60 countries
• 60,000 to 100,000 active .onion services at any given time
• Approximately 10% of Tor traffic is directed toward .onion services; the remaining 90% uses Tor to access the clear web anonymously
• Less than 1% of .onion traffic involves illegal marketplaces according to recent studies
• Annual Tor Project budget: approximately $10 million, funded ~80% by US government grants (open-source, no backdoor)

FAQ: your questions about the dark web