What Is the Dark Web, Explained Through How It Actually Works

Where the Name Came From

The vocabulary is younger than the technology. Onion routing was developed at the US Naval Research Laboratory in the mid-1990s by Paul Syverson, Michael Reed and David Goldschlag, with the practical goal of letting government personnel use public networks without revealing which agency they came from. The code was released under a free license in 2004, and the Tor Project became an independent nonprofit in 2006. Hidden services, the feature that makes a website reachable only inside the network, arrived in 2004. The phrase darknet dates to a 2002 Microsoft research paper about content sharing among trusted groups, which had nothing to do with crime. Dark web as a media term took off after 2013, when the Silk Road takedown gave newspapers a story that needed a label. The iceberg picture came later and has been repeated so often that people mistake it for measurement. Its familiar claim that the visible web is a few percent of the total confuses two unrelated things: pages behind logins, which are enormous, and onion services, which are not. Estimates of live onion sites have hovered in the tens of thousands, a rounding error beside the billions of pages Google indexes. The hidden portion is small and mostly dull.

How an Onion Address Works

A modern onion address is 56 characters of base32 followed by .onion, and it is not a name someone chose. It is derived from a public key that the service generates itself, packed together with a checksum and a version byte. The address is the key, which produces two consequences worth understanding. First, nobody registers it. There is no registrar, no fee, no dispute process and no authority that can revoke it, because the site proves ownership by holding the corresponding private key. Nothing about the address involves DNS. Second, the address authenticates the destination cryptographically. When your client connects, the service must demonstrate control of the key the address encodes, so a man in the middle cannot impersonate it. That is stronger than a certificate authority vouching for a domain name. The cost is human. Since addresses are unmemorable strings, a single altered character in the middle goes unnoticed, and phishing clones exploit exactly that. Operators sometimes brute-force millions of keys to get a few recognizable leading characters, which helps a little and also trains people to check only the beginning. Older addresses were 16 characters under version 2, retired in 2021 because the shorter keys and weaker cryptography no longer held up.

The Rendezvous Dance

Reaching a normal website through Tor uses three relays and then an exit relay that fetches the page from the open internet. Onion services work differently and never touch an exit at all, which is why traffic to them stays inside the network end to end. The service starts by choosing several relays as introduction points and publishing a signed descriptor listing them to a distributed directory of relays. Your client fetches that descriptor, then picks an unrelated relay as a rendezvous point and sends its address to the service through one of the introduction points, along with a one-time secret. The service then builds its own circuit to that rendezvous point and the two circuits are joined. Both sides have contributed three hops, so around six relays sit between you and the server, and neither end learns the other's IP address because neither ever connects directly. This is why hosting is location-hiding rather than merely encrypted. The server's network address never appears in the conversation, which is what makes takedowns hard and why investigators generally win through operator mistakes, server misconfiguration or financial tracing instead of breaking the protocol. The tradeoff shows up as latency, since every click travels a long, deliberately indirect path.

What the Dark Web Is Really Used For

The tenant list is more mundane than the reputation suggests. Facebook launched an onion address in 2014, in part for users in countries that block it, and reported over a million people a month reaching it that way by 2016. The BBC followed in 2019 with an onion version of its news site aimed at readers in places where it is censored. The New York Times, ProPublica and The Guardian run onion services too, several tied to SecureDrop, the whistleblower submission system originally written by Aaron Swartz and Kevin Poulsen and now maintained by the Freedom of the Press Foundation. Privacy tools live there for the same reason. ProtonMail and DuckDuckGo both operate onion addresses, letting users reach them without passing through an exit relay. Criminal markets are real and well documented, from Silk Road through AlphaBay to their successors, and they generate the coverage. But measurement studies have repeatedly found that most connections into the Tor network go to ordinary websites rather than hidden services, and that hidden-service traffic is a small slice of the whole. A useful way to think about it: the technology is a location-hiding pipe, and pipes carry whatever people put in them, including journalism, censorship circumvention, whistleblowing and crime.

What the Network Hides and What It Does Not

Tor conceals your network location from the site and the site's location from you. That is the whole promise, and it is genuinely useful. What it cannot do is unlink you from information you volunteer. Log into an account and the account identifies you, regardless of how the packets traveled. Type a real name into a form, upload a photo carrying GPS coordinates in its metadata, reuse a username you also use on a hobby forum, or pay with a wallet funded from an exchange holding your passport scan, and the network layer becomes irrelevant. Every one of those failures appears in real prosecutions. The device is another gap. Malware on your computer reads what you type before encryption happens, and opening a downloaded PDF in an outside application can make that application fetch a remote resource over your normal connection. This is a documented deanonymization trick, not a theoretical worry. Anonymity also depends on blending in. Tor Browser deliberately makes users look identical, which is why installing extra extensions or resizing the window in unusual ways can make you more distinctive rather than safer. And for ordinary sites reached through an exit relay, HTTPS still matters, because a hostile exit can read unencrypted traffic passing through it.

Other Networks Besides Tor

Tor is the largest of these networks but not the only design, and the alternatives make different bets. I2P, launched in 2003, builds a self-contained network where nearly every participant also routes traffic for others, and it uses separate one-way tunnels for sending and receiving. It is strong for internal services such as its own torrent ecosystem and weak as a way to reach the ordinary internet, since outproxies are few. Freenet, later renamed Hyphanet and dating to 2000, works on a different principle again. Rather than routing live connections, it distributes encrypted chunks of content across participants' hard drives, so material persists even after whoever published it disappears. Nobody knows what their own node is storing, which is deliberate. GNUnet and various mesh projects occupy smaller niches with their own priorities around metadata and offline operation. Comparing them clarifies what dark web means in practice. In each case, reaching content requires software that speaks a nonstandard addressing scheme, which is precisely the definition worth keeping. Tor dominates because it does one thing the others do poorly: it also works as a gateway to the regular internet, so a single browser serves both purposes. That dual role is why almost every conversation about hidden networks turns into a conversation about Tor.

Legality, Risk and Sensible First Steps

Using Tor is legal in most countries, including the United States, the United Kingdom and across the European Union. Some governments block or criminalize it, and China, Iran and Russia have all restricted access at various points. What you do through it carries the same legal weight as doing it anywhere else, and the network offers no immunity. The practical risks skew toward fraud rather than exotic technical attacks. Phishing clones of known sites are endemic, since a swapped middle character in a 56-character address is invisible to a casual glance. Marketplaces exit-scam with customer deposits, malware is bundled into downloads promoted as tools, and extortion scams recycle old breach data to claim they hold something new about you. If curiosity is the motive, there are unglamorous starting points. Get Tor Browser from the project's own site and verify the signature. Read a news organization's onion version of a story you already know, which shows the mechanism with nothing at stake. Read the Tor Project's documentation on what its threat model does and does not cover. Skip link directories full of promises, and treat any page urging you to hurry, install something unusual or disable a protection as the risk it is.

Sources and official tools

• Tor Project: what a .onion address is
• Tor Project: how Tor routing works
• Tor Project: on criminal misuse of the network
• Tails: warnings and limitations

Official references checked when this guide was written. Product links contain no affiliate tracking.