What is the dark web? Sites only Tor can open, and what's really on them

The difference between the deep web and the dark web

People use the two terms as if they had the same meaning. They don't. The deep web is everything a search engine can't show you because it sits behind a login, a paywall or a company firewall: your webmail inbox, your bank account, a university's library catalogue. You use it every day without Tor. The BSI calls the dark net "a comparatively small part of the deep web", the slice that needs special software to open at all.

You'll often read that the deep web is about 90% of the internet. The BSI uses the same figure, "approx. 90% of the entire internet." Nobody can measure the unindexed web precisely, so read it as "most of it", not as a count. The point it makes is correct, though: almost everything hidden from Google is mundane, and the dark web is the small, deliberate exception.

How the dark web works without Google or a normal browser

A normal website has a domain name, and DNS turns that name into a server's IP address. An onion site has neither. Its address is its key. A v3 onion address is the service's 32-byte public key, a two-byte checksum and a version byte, base32-encoded, which comes to a 56-character name ending in ".onion". Nobody registers it, and no registrar can hand it to someone else.

When you open one, Tor Browser does the lookup inside the Tor network:

1. The service asks a few Tor relays to act as its introduction points, reaching them through anonymous circuits so they don't learn where it is.
2. It signs a descriptor listing those introduction points and uploads it, again anonymously, to a distributed hash table that is part of the Tor network.
3. Your browser fetches that descriptor and checks its signature against the public key inside the address you typed. Only the holder of that key could have signed it, so nobody else can serve a site at that exact address.
4. You pick a relay as a rendezvous point, the service connects to it, and the rendezvous relay passes end-to-end encrypted messages between the two of you. The full connection runs through six relays, three chosen by you and three by the service.

Step 3 has a catch that matters more than the cryptography. It proves you reached the address you asked for. It can't tell you that you asked for the right one. Scammers don't need to break anything; they hand out a different, perfectly valid address that starts like the real one. The scams guide covers how those clones are made and how to check an address before you trust it.

The same design explains why there's no Google for onion sites. The Tor Project's support page says that, "Just like any other website, you will need to know the address of an onion service in order to connect to it." Dark web search engines exist, but they can only crawl addresses someone has published or submitted. The search engines guide says which one publishes how it filters, and why the results still include fakes and dead sites.

Is it illegal to go on the dark web?

No, going there isn't the offence. The BSI puts the rule in a way that works well beyond Germany: "what is illegal outside the internet is still also illegal on the internet, regardless of whether it is on the clear web or dark net." Opening a news site's onion address is reading the news. Buying drugs from a market is buying drugs, and selling is "also punishable."

Two things catch people out. In some countries, trying to buy something illegal is itself the offence, even when the shop is a fraud and nothing ever arrives. And in countries that block or police Tor, connecting to Tor at all can draw attention before you open a single onion site. The access guide has a police case where a scam's customers were identified and one was convicted, and the Tor explainer covers whether Tor itself is legal.

What's actually on the dark web, and who uses it

Two very different crowds share the same address format.

One is organisations that want readers who can't be tracked or can't reach them otherwise. The Tor Project's list of featured onion sites includes onion addresses for BBC News, Deutsche Welle, Facebook, Reddit, Amnesty International, the Internet Archive, Brave and Qubes OS, and it lists SecureDrop and GlobaLeaks, the two tools newsrooms and NGOs use to take anonymous tips. The BSI lists who that serves: journalists, persecuted people and political opposition members getting round censorship, sources who need to stay unidentified, and whistleblowers. Add to that people who simply don't want an ad network or their ISP to see what they read. The onion sites directory lists the real ones, each address traced to the organisation's own website or header.

The other crowd is the one the dark web is known for. The BSI is blunt that the dark net is "a trading place for all sorts of crimes and illegal goods, where the offerings are mostly paid for with cryptocurrencies." The U.S. Justice Department says Empire Market alone facilitated more than four million transactions, valued at more than $430 million, between 2018 and 2020. Its co-creator was sentenced to 40 years in October 2026, and the Empire Market sentencing note has the details. Markets don't last. The history of darknet markets records how each major one ended, seized, exit-scammed or closed by its own staff, and the takedowns timeline has the police operations, including the market the police quietly ran. The best darknet markets of 2026 covers the ten still open in October and how each one holds a buyer's money. If the worry is your own email rather than how a market ended, the check is whether that address is in a dump you can search.

Between the two sit fake shops, cloned versions of real sites, and "verified link" pages that point at the clones. Many ads for illegal goods exist only to take a payment, and the buyer has nobody to complain to.

How big is the dark web, and can anyone list every onion site?

Tor Metrics estimated between about 586,000 and 720,000 unique v3 onion addresses a day over the first 19 days of October 2026. That's an estimate of addresses, not websites. It's extrapolated from statistics reported by the relays that act as onion-service directories, and only published when at least 1% of them report. How many of those addresses are sites a person could browse is unknown, and the 2026 Tor numbers cover what the series counts and how it has moved over the past year.

Can anyone list them all? No, and not because nobody has tried. The reason is explained in Tor's own specification: the relays that store onion descriptors are designed not to know whose descriptors they hold. Descriptors aren't signed with the service's own key but with a blinded "key-of-the-day," and the spec says it "should be impossible to derive the blinded signing key" without already knowing the service's public key. The descriptor's contents are encrypted against anyone who doesn't know that public key, directories included. This was one of the stated improvements over the old v2 design: a directory protocol "leaking less to directory servers."

So the network holds the map in a form it can't read. An onion address becomes known only when someone publishes it, on a website, in a header, in a forum post. Any site that claims to list "every onion link" is listing what has been published somewhere. That's a fraction of the total, and it's the fraction where scammers post their clones.

Is Tor the only dark web? I2P and Hyphanet

No, though it's the one nearly everyone means. Two other networks have their own hidden sites, and neither is a drop-in replacement for Tor:

Hyphanet is the original Freenet under a new name. Its maintainers announced the change on 26 June 2023, after the Freenet Project's board gave the name "Freenet" to a newer, separate project. In its "darknet" mode, where you only connect to people you know, it's "very difficult to detect." I2P's own comparison page is a sales pitch for I2P, so read its Tor numbers as I2P's view. Tor vs I2P is the choice, including the place that page contradicts itself. Both networks are worth knowing about. For a first look at the dark web, though, Tor is the one to use: it's where the organisations above publish, and where every guide on this site applies.

Is the dark web dangerous to visit?

Looking around costs very little if you use Tor Browser on its Safest setting and open addresses you got from the organisation that runs the site. Most of the danger starts with what you do after that. The BSI's summary of the risk is that visitors "can fall for dubious offerings and thus either make themselves liable to prosecution or come into contact with criminal organisations", on top of more malware than on the ordinary web.

Scams

Cloned sites, fake mirrors, shops that take the money and vanish. This is the risk most visitors actually meet. The scams guide covers how to verify an address.

Malicious pages

An unknown onion site gets to run whatever the browser allows. Safest turns JavaScript off for exactly that reason, and some sites stop working.

Giving yourself away

A reused username, a login, an email address. Tor can't hide what you type, and Can Tor be traced? shows how often that, not the network, was what identified people.

Money

Crypto sent to a stranger on an onion site doesn't come back. Markets end in seizures or exit scams, and the people with balances lose them.

If you want to see it for yourself, go in this order:

1. Read how to access the dark web safely: installing Tor Browser, switching to Safest, and the things never to do once you're on.
2. Open your first onion from the onion sites directory, where each address links to the operator's own source.
3. Before you trust any address you found anywhere else, run it through the checks in the scams guide. If it doesn't pass, don't use it.