What Is the Dark Web? It's Probably Not What You Think
The dark web includes privacy technology with legitimate uses as well as criminal services. Learn the difference between the deep web and dark web, how Tor and onion services work, how to take a safe first look, what Tails and VPNs are for, and why dark-web monitoring is a security intelligence activity rather than an afternoon browsing exercise.
Mention the dark web and most people picture hackers, stolen credit cards, criminal marketplaces and ransomware. Those things exist. But that is not the whole story.
The BBC has used Tor. The New York Times has used it. Amnesty International launched its global website as an onion service in 2023. Facebook has operated an onion service. These organisations were not trying to join a criminal marketplace. They were using privacy technology to make access, communication or publishing harder to block and harder to trace.
The dark web is technology, not a moral category
The same technology that can hide a criminal marketplace can also help a journalist protect a source. The network is not criminal. Some of the people and services using it are.
The web, the deep web and the dark web
These terms are often used as though they mean the same thing. They do not.
| Layer | What it means | Everyday examples |
|---|---|---|
| Surface web | Pages ordinary search engines can discover and index | Public websites, news, shops and blogs |
| Deep web | Content that is not publicly indexed, usually because it is private or behind a login | Microsoft 365, online banking, CRM, private SharePoint, webmail and customer portals |
| Dark web | Services intentionally accessible through specialist anonymity networks | Tor onion services and other privacy-network services |
Deep web does not mean dark web
Your online banking is part of the deep web. That does not make it part of the dark web.
What is Tor?
Tor originally stood for The Onion Router. In simple terms, Tor routes traffic through a distributed network of relays rather than sending the connection directly from you to the destination.
Normal web: YOU -> WEBSITE
Tor: YOU -> TOR NETWORK -> MULTIPLE RELAYS -> DESTINATIONThat design can make tracing the original connection more difficult and can help people reach information when a normal route is blocked. Tor is designed to improve privacy and anonymity. It is not a magic invisibility cloak, and it does not make somebody untraceable.
Why is it called onion routing?
Routing information is protected in layers and handled across multiple relays. The onion is a memorable way to describe those layers; you do not need a cryptography lecture to understand the practical point.
What is a .onion address?
An onion service is a service that can only be accessed through the Tor network. Its address ends in .onion rather than .com, .net or .org. Current v3 onion addresses contain a long string of characters followed by .onion. The address format includes the service's public-key identity, which is one reason it is long and difficult to recognise.
Tor's documentation describes onion services as offering location hiding, end-to-end authentication and end-to-end encryption. They can hide the network location of the service while still giving users a secure connection. As always, the details of the service and the behaviour of the user still matter.
Why would a legitimate organisation need a dark-web site?
Censorship is one answer. Someone living in a country where the BBC, human-rights information, news sites or social media are blocked may still need independent information. An onion service can provide an alternative route.
- Journalism and access to news
- Whistleblowing and source protection
- Human-rights work
- Censorship resistance
- Privacy and anonymous communication
- Publishing information where ordinary routes are restricted
The BBC documented its international news site becoming available through Tor in 2019. Amnesty International announced its global onion site in December 2023, explaining that people in countries where human-rights information is restricted may need privacy and censorship-resistant access.
SecureDrop: a legitimate use case
SecureDrop is an open-source whistleblower submission system that media organisations and NGOs can install to accept documents from anonymous sources with stronger anonymity protections. It is a useful example because it shows the purpose clearly: the privacy network is being used to protect communication, not to provide a shopping list for illegal services.
Is the dark web dangerous?
Parts of it are. Risks include scams, malware, phishing, illegal marketplaces, stolen credentials, leaked business information, ransomware leak sites, malicious downloads, impersonation and disturbing or illegal material.
The ordinary internet contains criminal activity too. Technology and behaviour are different questions. Tor can protect aspects of the connection; it cannot protect you from every bad decision you make after connecting.
Is it legal to access Tor in the UK?
Using privacy technology and committing a crime are not the same thing. Tor itself is not synonymous with an offence. What somebody does using the technology remains subject to the law, including laws against unauthorised access, fraud, malware, theft and other criminal conduct.
This is a general explanation, not legal advice. If a particular activity could affect your organisation, obtain advice appropriate to the facts and current law.
How can an ordinary person safely see it?
The safest starting point is not a random directory. Go to the official Tor Project website, download Tor Browser for the appropriate platform, install it, start it and connect to Tor. You can browse normal websites or enter a legitimate onion address obtained from the organisation's official normal website or another authoritative primary source.
- 1Install Tor Browser from the official Tor Project website.
- 2Visit the ordinary website of a legitimate organisation known to provide an onion service.
- 3Find its onion address on that organisation's official website or in a verified primary source.
- 4Open that address in Tor Browser.
- 5Compare the normal and onion versions, remembering that they may not have identical features.
A safe first look
Do not Google “dark web links” and start clicking random directories. Onion addresses are long and difficult to recognise. A fake address can look plausible.
On the dark web, finding the address and proving whose address it is are two different problems.
Some ordinary sites support Onion-Location. This is a Tor Browser feature that lets a website advertise an onion counterpart using a special HTTP header. Treat the browser's indication as a useful sign, but still pay attention to the site and the address you are visiting.
Tor Browser is not a security force field
- Do not download unknown files or execute unknown software.
- Do not disclose your identity or enter credentials into a site you cannot verify.
- Do not assume every site is genuine.
- Do not ignore phishing or malware warnings.
- Do not use privacy technology as permission to buy illegal goods or evade the law.
What is Tails?
Tails is The Amnesic Incognito Live System: a privacy-focused operating system designed to run from removable media and route internet traffic through Tor. It is different from simply installing Tor Browser.
| Tool | Main purpose | Who might need it? |
|---|---|---|
| Tor Browser | A browser designed for Tor access and onion services | Someone learning about Tor or needing a Tor-based browser |
| Tails | A specialist privacy-focused operating environment using Tor | A person with a specific need for stronger separation and a carefully planned workflow |
| VPN | An encrypted tunnel to a VPN provider and a network-location change | Someone whose use case fits shifting trust towards a VPN provider |
| Private/incognito browser | Reduces local browser history and session persistence | Someone sharing a device; it does not inherently hide activity from the network |
Ordinary IT Club readers do not need Tails simply to look at a legitimate onion site. Tails is a specialist operating environment, not a more dramatic version of Tor Browser.
Why we are talking about Tails now
Tails 7.11 was announced on 19 August 2026. The official release notes say it updates Tor Browser to 15.0.20, fixes Persistent Storage activation on some computers and provides automatic upgrades from Tails 7.0 or later. Treat this as a dated release note, not a promise that those versions will remain current.
“Amnesic” describes a design goal of minimising traces on the computer being used. It does not mean that absolutely no forensic trace can exist under every circumstance. Persistent Storage can deliberately retain selected information when configured.
Tor versus a VPN
VPN: YOU -> VPN PROVIDER -> INTERNET
Tor: YOU -> MULTIPLE TOR RELAYS -> INTERNETA VPN shifts trust towards the VPN provider. Tor uses a distributed relay architecture. They solve overlapping but different problems, so neither is universally better. Private browsing is different again: it mainly reduces local browser history and session persistence.
What does this have to do with my business?
The dark web may contain stolen passwords, credential dumps, leaked customer information, ransomware leak sites, stolen corporate documents, impersonation attempts and discussion of vulnerabilities. That does not mean a business owner should personally browse criminal marketplaces.
Dark-web monitoring is security intelligence
Dark-web monitoring is a security intelligence activity, not an afternoon browsing exercise. It may look for your company domain, email addresses, credentials, leaked data or breach references. It cannot scan every hidden service, cannot prevent a breach and cannot tell you everything.
Finding your password on the dark web is not the breach. It is evidence that something may already have happened.
A hit should trigger investigation and response: reset credentials, investigate possible compromise, enforce MFA or passkeys, check logs, identify affected accounts and review the breach exposure. Have I Been Pwned can help with known breach exposure, but it is not equivalent to searching the whole dark web. Domain searches require verification that you control the domain.
Common myths
| Myth | Reality |
|---|---|
| The dark web is illegal. | Privacy networks have legitimate and illegitimate uses. |
| The deep web and dark web are the same. | Most private online services are deep web, not dark web. |
| Tor makes me completely anonymous. | Tor improves privacy and anonymity, but behaviour, configuration and endpoint security still matter. |
| Only criminals use Tor. | Journalists, activists, researchers, ordinary privacy users and major organisations use Tor and onion services. |
| Dark-web monitoring stops hackers. | It may provide intelligence after information is exposed; it does not replace prevention and response. |
Business owner checklist
- Is MFA or passkey protection enabled for important accounts?
- Are breached passwords blocked or replaced?
- Do we know whether employee credentials have appeared in known breaches?
- Do we have a breach response process?
- Would we know what to do if corporate data appeared on a ransomware leak site?
- Do staff know that dark-web monitoring is not a substitute for security?
- Is security intelligence reviewed regularly?
The Operational Heartbeat
Dark-web intelligence needs an Operational Heartbeat too. Review known breach exposure, credential security, MFA or passkey coverage, security alerts, threat intelligence and incident response regularly. Buying a monitoring service is not the same as deciding who will notice a warning, investigate it and act.
Use the IT Club Operational Heartbeat checklist →
IT Club view
The dark web should be neither glamorised nor demonised. It is technology. Some uses are socially valuable. Some are criminal.
For businesses, the practical concern is not “How do I explore the dark web?” It is “Would we know if our data or credentials turned up there?” The interesting thing about the dark web is not simply that it is hidden. It is why somebody wants the connection, the visitor or the service to be harder to identify.
Sources and further reading
- Tor Project: how onion services work, .onion addresses and Onion-Location
- Tor Project: Tails 7.11 and Tor Browser 15.0.20 release announcements
- BBC: its international news service becoming available through the Tor network
- Amnesty International: its global website launch on the Tor network
- Freedom of the Press Foundation: SecureDrop
- UK Computer Misuse Act 1990 and Crown Prosecution Service guidance
- Have I Been Pwned API and domain-search documentation
Tor Project: How do Onion Services work? →
Tor Project: Onion Services in Tor Browser and Onion-Location →
Tor Project: New Release — Tails 7.11 →
Tor Project: New Release — Tor Browser 15.0.20 →
BBC: BBC News launches 'dark web' Tor mirror →
Amnesty International: global website launches on Tor →
Freedom of the Press Foundation: SecureDrop →
Have I Been Pwned: API and domain search documentation →
Frequently asked questions
What is the dark web?
The dark web is a part of the internet containing services intentionally accessible through specialist networks such as Tor. It includes legitimate privacy and censorship-resistance uses as well as criminal activity.
What is the difference between the deep web and dark web?
The deep web is content not publicly indexed, such as online banking, email and private business portals. The dark web is a smaller set of services intentionally accessible through specialist anonymity networks. Deep web does not mean dark web.
What is Tor and what does Tor stand for?
Tor originally stood for The Onion Router. It routes traffic through multiple relays to improve privacy and anonymity and can provide access to onion services. It does not guarantee perfect anonymity.
Is Tor illegal in the UK?
Using Tor is not synonymous with committing an offence. Activities carried out using it remain subject to UK law, including laws concerning unauthorised access, fraud, malware and theft. This is general information rather than legal advice.
Do legitimate organisations use the dark web?
Yes. The BBC has documented its international news service on Tor, Amnesty International launched a global onion service in 2023, and systems such as SecureDrop are used by media organisations and NGOs to protect sources.
How do I access an onion site safely?
Download Tor Browser from the official Tor Project website. Obtain the onion address from the organisation's official normal website or a verified primary source. Do not use random directories, click unverified links or download unknown files.
Does Tor make me anonymous?
Tor is designed to improve privacy and anonymity, but it is not a magic invisibility cloak. Your behaviour, device, configuration, endpoint and the information you disclose still matter.
What is Tails, and do I need it?
Tails is a specialist privacy-focused operating system that runs from removable media and routes traffic through Tor. You do not need Tails simply to look at a legitimate onion site; Tor Browser is the more natural starting point for ordinary learning.
Is Tor the same as a VPN or private browsing?
No. A VPN shifts trust towards a VPN provider, Tor uses a distributed relay architecture, and private browsing mainly reduces local browser history and session persistence. They solve different or overlapping problems.
What is dark-web monitoring?
It is a security intelligence activity that may look for exposed domains, credentials, email addresses, leaked data or breach references. It cannot scan every hidden service or prevent a breach, so findings need investigation and response.
Should a business browse the dark web itself?
Usually not. Businesses should focus on prevention, credential security, MFA or passkeys, logging, incident response and appropriately scoped security intelligence rather than sending staff into unverified criminal marketplaces.
Plain-English Takeaway
The dark web should be neither glamorised nor demonised. For a business, the useful question is not “how do I explore it?” but “would we know if our data or credentials turned up there?”
Tap to follow The IT Club Briefing on WhatsApp.
Related Articles
Zero Trust Security: What Does It Actually Mean?
Zero Trust is not a product and it does not mean distrusting employees. This plain-English UK guide explains verify explicitly, least privilege, assume breach and how a small business can start.
Read articleMake Chrome Autofill Safer with Windows Hello
Chrome can use Windows Hello to add an extra verification step before saved passwords are filled, revealed, copied or edited. A separate setting can require device verification before saved payment methods are autofilled. These are simple controls on business PCs that are worth reviewing.
Read articleMicrosoft 365 Security Checklist: 7 Controls Every Business Should Review
Many businesses assume that licensing Microsoft 365 Business Premium means the environment is secure. A review often reveals something different: configuration gaps, stale administrator accounts, unreviewed guest access and no documented baseline. This guide covers seven controls every Microsoft 365 tenant should address.
Read article