Is the dark web is a mysterious online world full of secrets or the dark underbelly of the internet where criminals are free to go about their illegal activities? Jump into our submarine and join us as we explore its depths, investigate its sinister reputation, and dive even deeper to answer all your questions on: What exactly is the dark web? How do you access it? What is it used for, and is it dangerous or even illegal to surf dark-web sites? But regardless of whether you venture onto the dark side of the web or prefer to tread lightly and stick to the visible web — always protect yourself while surfing with a comprehensive cybersecurity solution like Avira Free Security.
What is the dark web?
The simplest way to understand the web is to picture it as an iceberg. Many of us spend the majority of our time on the internet interacting with the tip of this web iceberg, which makes up roughly 5 to 10 percent of the entire web. This area is called the surface web, visible web, open or normal internet, clear web, or clearnet. It includes all publicly accessible websites, online services, and platforms that you can find using conventional search engines like Google and access using regular browsers like Chrome or Firefox.
But beneath this virtual waterline lies a far bigger, but more opaque area. It’s known as the deep web, and accounts for around 90 to 95 percent of the entire internet. Here you’ll find content that’s reachable via regular browsers, yet is for the most part neither publicly accessible nor indexed. Even though many users don’t know it, they also frequently spend time in this area of the internet — namely whenever they log in to a website using their access credentials or enter a password-protected area.
In turn, the dark web, also referred to as the dark net, accounts for just a small portion of the deep web, making up around 0.01 percent of the internet. It is home to anonymously hosted websites that are only accessible within special virtual overlay networks that run on top of a physical network (like the internet) using appropriate software. This means you can’t access them using regular browsers or find them with conventional search engines.
What’s the difference between the deep web and dark web?
We’re going to dive a little deeper now and take a look at the deep web, which you might also have heard called the hidden or invisible web. This area mainly contains websites and sections of sites that are neither indexed nor publicly accessible because they’re protected by login pages or other access restrictions. This includes databases and archives, corporate intranets, cloud storage services, email accounts, online banking areas, and private profiles and groups on social networks. Even paid services from news portals and streaming providers can be found here.
The deep web also includes content that is publicly accessible but not indexed because it is dynamically generated and does not have fixed URLs. This content can only be accessed via form entries or search masks, such as search results from flight search engines, library catalogs, and price comparison portals.
Diving deeper again, we get to the isolated area of the deep web — which is also known as the dark web. In these mystical depths of the internet, we see a hidden world that attracts swarms of different visitor groups. These include both those seeking protection from political monitoring by authorities as well as criminals who exploit the anonymity provided by the dark web to carry out illegal activities thanks to the high level of privacy that visitors enjoy there.
The largest and most well-known dark web network is the Tor network. It consists of thousands of volunteer-run Tor nodes and uses the principle of onion routing — hence the original name “TOR — The Onion Router”. You can use the associated Tor Browser to access this network and surf there with a high degree of protection and anonymity. That’s because data traffic is routed through several encrypted layers — similar to the layers of an onion — via multiple Tor relays. Each of these nodes only knows the previous and the next node, so your IP address remains hidden and the path through the network cannot be traced.
Tip: If you want to encrypt all the data you send and receive on the normal internet and mask your IP address when surfing, use a VPN like Avira Phantom VPN. You can get it as part of the free cyberprotection solution Avira Free Security.
Besides the Tor network, there are two other, less widely used, networks: I2P and Hyphanet (formerly Freenet).
I2P (Invisible Internet Project) is a fully decentralized network without a central server structure. It uses a peer‑to‑peer architecture and garlic routing to provide anonymity and secure data transmission. Garlic routing is a variant of onion routing, where multiple messages or data packets are bundled into what are called a “clove” and encrypted in multiple layers before being forwarded through several intermediate nodes.
Hyphanet is also an anonymous peer-to-peer network without a central server structure. Each computer in the network becomes a node that accepts requests and data from others, forwards them, and — unlike with I2P — permanently stores them in an encrypted format. Data is exchanged on Hyphanet through a multi-stage routing procedure that uses its own encryption scheme.
Whereas Hyphanet is designed primarily for censorship-resistant, secure storage and content sharing, I2P focuses on anonymous communication in addition to file sharing, along with offering a wider range of services, applications, and websites (called Eepsites).
That said, it’s more technically demanding to access these networks than Tor since you need to set up and configure additional software. This can lead to errors and impair anonymity and security, so we’re going to focus solely on the Tor network in the following.
What does the darknet look like and how can you surf it?
Dark-web pages on the Tor network are broadly similar to those on the surface web, but they tend to be much more minimalist and purely functional in design. You can identify them by the fact that their URLs don’t end with “.com” or a country code like on the clearnet but with “.onion”.
Dark-web sites use cryptographically generated addresses comprising long strings of characters, making them difficult to remember. For example, the URL of the popular dark web platform AlphaBay Market was “alphabaytenkotdfclp4zefetrodusi3neklmeepbxkev57owvsqo7qd.onion” — which doesn’t exactly trip off the tongue. However, it’s often not even worth remembering these URLs since criminals frequently change the addresses of their dark-web sites to avoid being discovered — or authorities shut them down because of their illegal activities. As such, you’ll often find that dark web platforms will suddenly disappear — only to reappear shortly afterwards under a different address.
But how do you find specific pages on the dark web if you don’t know the current URL? You’re in luck as there are special link directories, wikis, and dark web search engines that you can use. But because dark-web sites are often short-lived or intentionally difficult to find — plus the fact that their addresses change regularly — these search engines aren’t as reliable as on the clearnet. On top of that, it’s common for dark-web sites to be temporarily offline and therefore inaccessible. A few providers do display the current status of websites, but this isn’t particularly reliable.
What are onion services?
Dark-web sites that are only accessible via the Tor network are called onion services (formerly hidden services). Because all communication occurs within the Tor network, both users and operators remain anonymous. Layered encryption and multi‑hop onion routing ensure that neither IP addresses nor the route taken are revealed. This keeps all parties largely protected from censorship and surveillance, although of course no system can offer absolute protection — and law enforcement agencies and authoritarian regimes have tools and techniques to identify individuals if they want to.
Website operators can offer their service as an onion service on both the dark web and normal internet. Facebook, for example, has a presence both on the clearnet and on the dark web. This allows users who value anonymity, privacy, and data protection very highly, or whose country blocks certain platforms, to access the content they need via the Tor network.
How do you access the dark web?
Have you ever found yourself thinking: “How can I actually tell if I’m on the dark web?” Don’t worry — you don’t just end up there by chance or accident. That’s because to access the dark web or Tor network, you need special software like Tor Browser, as mentioned earlier, which was specifically developed for the dark web.
To access the dark web, proceed as follows:
- Download and install Tor Browser for Mac, Windows, Linux, or Android. iPhone users can install the Onion Browser app to access the Tor network.
- Start Tor Browser and click Connect.
- Once connected, you can surf using the Tor network.
- To disconnect from the dark web, simply close your browser. If you only close the browser window, the connection may remain active in the background.
By the way, you can access onion services and surf the normal internet anonymously and securely using Tor Browser — although you’ll find it slower as data is routed through several nodes and encrypted multiple times. You’ll also find that some websites block access via Tor for security reasons. You can use the pre-installed search engine DuckDuckGo to browse the clearnet — but you’ll need to use special search engines to search the dark web.
If you want to access dark-web sites using a normal browser, you can also use a Tor2Web service. These services provide proxy servers to accept requests from the clearnet, forward them to the Tor network, retrieve the onion page, and transmit the content back to you. However, we advise against this as it bypasses all of Tor’s protection mechanisms.
The same applies to third-party browser extensions that promise easy access to the Tor network. They don’t offer full or secure Tor access, usually fail to offer anonymity or protect your privacy, and in some cases even pose a security risk.
Some VPN services offer a special “Tor over VPN” or “onion over VPN” feature, allowing you to access the Tor network without using Tor Browser. They work by automatically routing your traffic to the Tor network via a Tor server once the VPN connection is established. However, once again you’ll need to accept compromises in terms of anonymity, speed, and functionality.
Tip: If you’d like to use a VPN and enjoy Tor Browser’s protections and other benefits, you can combine both with Avira Phantom VPN. To do this, first connect to the VPN and then start Tor Browser. This adds another layer of security and allows you to hide your access to the dark web from your internet service provider (ISP). Because the VPN server’s IP address replaces your actual IP address, the first Tor node (the entry node) only sees the VPN server’s IP address.
What is the darknet used for?
Contrary to its bad reputation, the dark web isn’t only used by criminals. Many journalists, activists, dissidents, and opposition figures use the dark web to protect their identity. That’s because the dark web offers a vital means of secure and anonymous communication, data sharing, and access to information, which is especially crucial in countries with heavy internet censorship and surveillance.
But even ordinary users who want to protect themselves from website tracking (including browser fingerprinting) and other data harvesters — and who want to browse anonymously and securely — use Tor Browser. That’s because it not only anonymizes your connection and encrypts your traffic but also blocks many tracking techniques by default and deletes all temporary user data — such as your browsing history, cookies, and website data — when you close the browser.
At its deepest point, the dark web entirely lives up to its reputation as a digital black market for virtually all imaginable illegal goods and services. Terrorists and extremists also use it to network anonymously, spread propaganda, share information, and coordinate illegal activities.
Likewise, hacktivists use the dark web to communicate, publish leaked data, plan campaigns, and draw attention to political or social issues through targeted cyberattacks.
The dark web includes the following platforms and services, among others:
- Dark-web marketplaces and shops: Online marketplaces and specialized online shops for illegal goods and services
- Forums, chat rooms & social networks: Communication platforms for sharing information on a wide variety of topics
- Communication and anonymization services: Tools and services for secure and anonymous communication and data transfer
- Whistleblowing platforms: Services that allow confidential information and documents to be shared anonymously with the press or organizations
- Leak portals: Platforms for publishing sensitive documents and data
- File-sharing and cloud-storage services: Platforms and tools for hosting, sharing, and storing digital content
- Finance and cryptocurrency services: Bitcoin mixers, wallet services, escrow services, and other financial services
- Website hosting services: To create, host, and maintain websites on the Tor network
- Porn platforms: Illegal and legal pornographic content
- News portals and blogs: General and Tor-related news, as well as information about the dark web and other (mostly technical) topics
- Shadow libraries as well as streaming and gaming platforms: Copyrighted books, films, series, music, and games
- Onion versions of clearnet pages: BBC News, ProPublica, Proton Mail, Reddit, Facebook, Twitter, and many more
If you’re interested in facts and figures on the use of the Tor network, like which countries most users come from, check out Tor Metrics.
What is a dark-web marketplace?
Dark-web marketplaces, also called crypto marketplaces, are trading platforms on the dark web that operate much like “regular” online marketplaces. Like their more reputable counterparts eBay and Amazon on the surface web, dark-web marketplaces usually have user rating systems, customer accounts, and payment features. In most cases, these dark-web marketplaces are black markets offering all kinds of illegal goods and services, and they typically only accept cryptocurrencies like Bitcoin or Monero as payment.
This anonymized form of payment is also a key factor behind the huge success of dark-web marketplaces since it conceals the identity of both buyers and sellers. Payments are often made through escrow services — trustee systems where the platform operator holds the money until the buyer confirms receipt of the goods or services. They’re designed to build trust and make fraud more difficult, but they don’t offer complete protection. Physical shipping is often the lone weak spot in an otherwise purely digital chain — and a crucial point for investigative authorities to intervene.
Dark-web marketplaces are often short-lived as authorities worldwide try to shut them down quickly and prosecute operators for illegal activities. The first major dark-web marketplace, the infamous Silk Road, suffered this very fate. Launched in 2011, this marketplace was shamelessly billed as the “Amazon for drugs” and used by criminals for everything from drug trafficking to money laundering. The FBI shut down Silk Road two years after its launch, and its founder, Ross Ulbricht, was handed a life sentence. Its successor, Silk Road 2.0, met the same fate — as did other well-known dark-web marketplaces like AlphaBay, Wall Street Market, and Hansa Market, which authorities also shut down and took offline a few years after their launch.
What can you buy on the darknet?
In short: Practically anything you can think of — including plenty you’d prefer not to. From drugs and prescription medications, forged documents such as passports and driver licenses, to weapons and explosives — despite its relatively small size, the dark web offers almost everything a criminal’s heart desires.
Even illegal digital goods and services are also very popular. These include:
- Stolen data like credit card details and login credentials (for PayPal and bank accounts, crypto wallets, email accounts, cloud storage and streaming services, online shops, etc.), admin logins (for servers and databases), gift card codes, entire customer databases, and complete personal-data records (or “Fullz” in criminal slang, meaning complete identity packages)
- Malware & hacking tools such as keyloggers and other spyware, remote-access Trojans (RATs), exploit kits, password-cracking tools, botnet infrastructures, DDoS-as-a-Service and Ransomware-as-a-Service offerings, and phishing kits
- Hacking services and hackers for hire for the development and distribution of all kinds of malware; phishing, ransomware, and DDoS attacks; network and system hacking; cyberespionage; social engineering services; and much more
- Other digital services for creating fake profiles, deepfakes, and fake reviews; money laundering using cryptocurrencies or money-transfer systems; and cyberstalking
- Stolen or illegally traded software keys and licenses, for example for business software
Is the darknet dangerous?
As is so often the case, there’s a yes and no answer to this question. That’s because it depends on how you use the dark web and which dark-web sites you visit. The dark web itself isn’t dangerous. It offers anonymity and privacy, but it also comes with considerable risks as many areas are unregulated and unmoderated. Anyone who surfs the dark web carelessly can quickly come across illegal, harmful, or disturbing content.
Due to the lack of monitoring and control, the dark web is also home to even more scammers than the regular internet. As such, you enter at your own risk! The dark web remains a breeding ground for criminal and illegal activities and content. Accessing or using it can be dangerous and, depending on the circumstances, potentially unlawful.
Threats on the dark web
- Disturbing and illegal material such as child sexual abuse material (CSAM), extreme depictions of violence, and animal cruelty
- Fraud through fake shops and crypto scams
- Phishing and identity theft through fake login pages that mimic popular onion services
- Malware infections through contaminated pages and infected downloads or ads
- Unsafe onion services due to a lack of TLS/SSL certificates
- Surveillance and prosecution by authorities, also in Western countries
- Misinformation, fake news, conspiracy theories, extremist content, and radical ideologies
How can you protect yourself on the dark web?
- Only use the official Tor Browser to access the dark web. Keep it updated and don’t add any extensions.
- Avoid making purchases on the dark web. There is usually no customer service, no buyer protection, and no refunds.
- Only use reputable and verified onion services like Proton Mail, ProPublica, or OnionShare.
- Only visit websites in HTTPS mode, which enforces the use of secure HTTPS encryption. Also keep an eye out for different onion icons in your browser’s address bar.
- In Tor Browser’s settings, turn on the highest security level and protection against fraudulent content and malicious software.
- Never reveal any personal information or your real name, and never log in with any online accounts you use elsewhere when accessing dark-web pages.
- Use a dark web search engine like Ahmia, which filters out illegal content such as child sexual abuse material. Alternatively, try VormWeb, which grades search results into three security categories. But even if you do use one of those engines, there’s no absolute guarantee you won’t encounter illegal or harmful material.
- Never just go clicking links or banners, and never download any files or software. Although Tor protects your privacy, it won’t defend you from malware. So make sure your device has powerful antivirus protection like Avira Free Security and keep it turned on — not just when browsing the dark web.
Is the dark web illegal?
In most Western democracies, simply visiting the dark web or accessing dark-web sites is generally neither prohibited nor a criminal offense. However, you are of course not allowed to engage in any unlawful activities there — such as offering or purchasing illegal goods or services. Accessing or downloading illegal content is also strictly forbidden.
In some cases, though, merely opening a dark-web page can already constitute a criminal offense. This applies in particular to dark‑web sites containing child sexual abuse material, instructions for committing serious crimes (such as making explosives), terrorist propaganda, or extreme violent content. In Germany, for example, it can be a criminal offense even if such content loads automatically in your browser without any deliberate action on your part.
So, only visit known and reputable sites and never click through lists of links when surfing the dark web. If you want to stay safe online, stick to legal services — or better still, stay on the clearnet.
In authoritarian countries such as China, Russia, or Iran, access to the dark web — especially to the Tor network — is both technically blocked and legally restricted, with violations prosecuted with the full force of the law. In these countries, governments use a mix of censorship, surveillance, repression, and prosecution to prevent people accessing the dark web. In some countries, merely trying to access information anonymously and freely, or simply possessing software like Tor Browser, can be considered a criminal or even anti-state act — especially if linked to activities critical of the regime.
The history of the dark web
Finally, let’s return to the beginnings and take a look at the origins of the dark web as our submarine surfaces. Back in the 1970s, Stanford University and MIT students were using ARPANET — the precursor to today’s internet — to sell cannabis. However, this amounted more to informal coordination than to real transactions.
The history of the modern dark web began in the mid-1990s, when the US Naval Research Laboratory developed onion routing technology, laying the foundation for the Tor network. Originally designed as a secure means of communication for military and intelligence purposes, it was made publicly available in 2002 and increasingly adopted for civilian purposes — such as by NGOs, activists, journalists, and tech enthusiasts.
Following its release, Tor continued to be developed, and in 2006 the non-profit Tor Project was founded to support its wider adoption — with the mission to strengthen human rights, protect privacy on the internet, and enable browsing without tracking, surveillance, or censorship through free software and open networks.
The dark web only began to gain significance as a place for illegal marketplaces with the introduction of Bitcoin in 2009. In 2011, Silk Road emerged as the first major dark‑web marketplace. This was followed by many others — shaping the dark web’s negative reputation to this day.
- Dark Web Monitoring is only available to residents of Germany. The email address you use to purchase the product will then be monitored immediately following activation. Log in to your account to enter more information to monitor.
Tor, Tor Browser, and Onion are registered trademarks of the Tor Project, Inc.
Google is a registered trademark of Google LLC.