Vanity
The readable start was brute-forced
See how the BBC’s, DuckDuckGo’s and Facebook’s addresses start with their names? They generated keys by the million until one happened to begin that way. The rest of it can’t be chosen.
The . Without the Hype.
It’s the part of the internet a normal browser can’t open. Not a place, not one website and not mostly crime: a set of networks built to hide who’s talking to whom. Here’s how it actually works.
Nothing on this page links into the dark web. The onion addresses below are text to take apart, not links to follow.
Over three million people use Tor every day. Most of them are just reading ordinary websites, privately.
- Daily users
- 3M+people on Tor every day
- Relays
- ~9,000run by volunteers
- Hops
- 3relays between you and any site
- Address
- 56characters in an onion address
Source: Tor Metrics, October 2026
Surface, deep, dark. Each one harder to reach.
People say “dark web” when they mean three very different things. Only the last one needs special software.
- 0 mAny browser
Surface web
Everything a search engine can find: news, Wikipedia, shops, videos, this page. It feels like the whole internet, but it’s only the part that’s been indexed.
- −200 mAny browser + a password
Deep web
Everything behind a login, paywall or search box: your inbox, your bank, medical records, private cloud files. By far the biggest layer, and almost all of it is boring. You use it every day.
- −4,000 mSpecial software, like Tor Browser
Dark web
Sites deliberately hidden on overlay networks — Tor, I2P, Freenet (now Hyphanet) — that run on top of the normal internet. A normal browser can’t open them at all. It’s tiny compared to the layers above.
Deep ≠ dark. The famous iceberg picture, with the dark web as the giant part underwater, mixes the two up: the giant part is the deep web, and it’s mostly email.
How Tor hides you. No relay knows both ends.
Tor doesn’t make you invisible. It splits the job of knowing about you across three strangers, so none of them knows enough on their own.
Step 1 of 5
Your browser wraps the request three times
Tor Browser picks three relays and encrypts your request once for each, inside out: the exit’s layer first, then the middle’s, then the guard’s on the outside. Like an onion.
What your browser knows
- Who you areYes
- Where you’re goingYes
- What you sendYes
Tor builds a fresh circuit every ten minutes or so, and gives every site you visit its own, so your tabs can’t be tied together by sharing relays.
What’s in a .onion address. It’s a key, not a name.
Onion addresses look like keyboard mash because they are a cryptographic key. There’s no DNS and no registrar: the address itself proves which server you reached.
- Public keyThe site’s ed25519 public key, 32 bytes. Whoever holds the matching private key is the site — no certificate authority needed.
- ChecksumTwo bytes of SHA3-256 over the key. A single typo makes it fail, so mistyped addresses don’t silently go somewhere else.
- VersionThe protocol version, 3. Every modern onion address ends in d.
Try one
Valid v3 address. The checksum matches the key.
- Key
- d1b38b83a83b3ed9…
- Checksum in address
- ddd9
- Checksum of key
- ddd9
Phishing
Valid doesn’t mean safe
A valid checksum only proves nobody mistyped it. Phishing clones are perfectly valid addresses too. They’re just someone else’s key.
Both reputations are earned. Same tool, both sides.
The same privacy that protects a reporter’s source protects a drug market. That’s the uncomfortable part, and there’s no version of Tor that only works for the good guys.
People who need privacy
Journalists and their sources
SecureDrop runs on onion services so whistleblowers can hand documents to newsrooms like The Guardian and The New York Times without revealing who they are.
People living under censorship
Where news and social media are blocked, Tor — with bridges like Snowflake that disguise the connection — gets people onto the open web.
Big names, onion editions
The BBC, The New York Times, Facebook, DuckDuckGo, Proton and even the CIA run official .onion sites.
Ordinary privacy
Activists, abuse survivors hiding from someone who tracks them, researchers, and people who simply don’t want to be followed around by ads.
And why it’s infamous
Darknet markets
Drugs, fake IDs and stolen goods sold for crypto. The big ones get seized every few years — Silk Road, AlphaBay, Hydra — and new ones replace them.
Stolen data
Leaked databases, passwords and card numbers, resold in bulk. This is why “check if your email was leaked” services exist.
Ransomware leak sites
Gangs post companies’ stolen files on onion sites to pressure them into paying.
Scams. Lots of scams.
Fake markets, phishing clones of real sites and fake “hitman” services. A big share of what’s there exists only to take your money.
What every site already knows. This is yours, live.
Hiding your IP isn’t enough. Your browser describes itself to every site it opens, and the details together can be enough to pick you out of a crowd.
- IP address
- You…
- Tor…
- Time zone
- You…
- Tor…
- Local time
- You…
- Tor…
- Languages
- You…
- Tor…
- Browser
- You…
- Tor…
- System
- You…
- Tor…
- Window
- You…
- Tor…
- Screen
- You…
- Tor…
- CPU threads
- You…
- Tor…
- Theme
- You…
- Tor…
Read by your own browser, on this page. None of it is sent anywhere.
Tor Browser’s real trick isn’t hiding you, it’s making millions of people look exactly the same. That’s why the advice is never to install add-ons or resize things to taste: every tweak makes you a little more unique.
From a Navy lab. To your laptop.
The strangest thing about the dark web’s history is who started it.
Takedowns
- 1990s
The U.S. Navy invents onion routing
Paul Syverson, Michael Reed and David Goldschlag at the U.S. Naval Research Laboratory design onion routing to protect government communications.
- 2002
Tor goes live
Roger Dingledine and Nick Mathewson, with Syverson, release the first version of Tor — “The Onion Router”.
- 2006
The Tor Project
Tor becomes a nonprofit. The idea: a tool only the military used would be useless, because every user would obviously be military.
- 2008
Tor Browser
Work starts on a browser that does it all for you, so using Tor stops requiring a weekend of configuration.
- 2011
Silk Road
The first big darknet market opens, with anonymous sellers paid in Bitcoin. “The dark web” becomes a headline.
- 2013
Silk Road falls, Snowden leaks (takedown)
The FBI arrests Ross Ulbricht in a San Francisco library. Months later, Snowden documents show the NSA complaining it can’t unmask Tor users at scale.
- 2014
Facebook joins
Facebook launches an official .onion address — one of the first big companies to do it.
- 2017
Operation Bayonet (takedown)
AlphaBay and Hansa go down together. Dutch police had secretly run Hansa for a month first, collecting evidence.
- 2019
Newsrooms go onion
The BBC follows The New York Times (2017) with an onion site, so readers in censored countries can reach them.
- 2021
Short addresses retired
The old 16-character v2 addresses stop working. Only the longer, stronger 56-character v3 kind remain.
- 2022
Hydra seized (takedown)
German police shut down Hydra, then the largest darknet market in the world.
- 2024
Tor and Tails merge
The Tor Project and Tails, the amnesic operating system that runs from a USB stick, join forces.
- 2025
Ulbricht pardoned
President Trump pardons Ross Ulbricht after more than eleven years of a life sentence.
Things people get wrong. Tap one to decrypt it.
Heard another one? Email me
MythThe dark web is 90% of the internet.
RealityThat’s the deep web — inboxes, databases, anything behind a login — being confused with the dark web. The dark web is a tiny corner, and many .onion addresses are short-lived or aren’t websites at all.
MythUsing Tor is illegal.
RealityIn most countries, including the US and the whole EU, it’s legal. What you do with it can be illegal, same as on the normal web. Some governments, like China, Russia and Iran, block or restrict it.
MythTor makes you completely anonymous.
RealityIt hides your IP address. It doesn’t stop you logging into your own accounts, opening a file that phones home, or reusing a username. Most people who get caught make a mistake; the crypto rarely breaks.
MythEveryone on it is a criminal.
RealityMost Tor traffic is people visiting ordinary websites privately. Onion services are a small slice of it, and plenty of those are newsrooms, email providers and search engines.
MythThe police can’t touch it.
RealityTakedowns happen all the time: Silk Road, AlphaBay, Hansa, Hydra. Investigators use seized servers, infiltration, crypto tracing and old forum posts — not some magic Tor exploit.
MythHackers built it.
RealityIt came out of the U.S. Naval Research Laboratory, and the Tor Project still gets part of its funding from government grants.
Looking around. Without getting burned.
Opening Tor Browser is legal almost everywhere and won’t put a target on you. The risks are the ordinary internet’s, just sharper.
- Rule 1
Download Tor Browser only from torproject.org
Fake “Tor” apps and bundles with malware exist, especially in app stores and on forums.
- Rule 2
Don’t log into anything that’s you
Signing into your real email or social account links the whole session to your name.
- Rule 3
Don’t install add-ons or tweak settings
Every change makes you look different from everyone else, which is the opposite of what Tor is doing for you.
- Rule 4
Don’t open downloads while online
PDFs and documents can load things from the internet outside Tor and reveal your real IP.
- Rule 5
Treat every link as a scam
Link lists are full of phishing clones that differ by a few characters. Bookmark real addresses; never trust a search result.
- Rule 6
Use the “Safest” level if you’re worried
It turns off JavaScript everywhere, which blocks most of the ways a site could attack your browser.
Stay curious. Start at the source.
Tor Browser is free, and the Tor Project is the only place you should download it from.
- Free and open source
- Legal almost everywhere
- Made by a nonprofit