The dark web is a small, deliberately hidden portion of the internet that you can only reach through specialized anonymizing software, most commonly the Tor Browser. It was originally built by the United States Naval Research Laboratory in the mid-1990s to protect intelligence communications, and today it hosts everything from whistleblower drop boxes run by major newspapers to illegal marketplaces. In the United States, simply visiting the dark web is legal. What federal law cares about is what you do once you are there.
How It Differs From the Deep Web
People use “deep web” and “dark web” as if they mean the same thing. They don’t.
The deep web is everything online that standard search engines don’t index: your email inbox, your bank’s account portal, medical records, subscription databases, anything behind a login. By most estimates only about 4% of the web is indexed and visible through a normal Google search, which means the deep web is the overwhelming majority of the internet. You use it constantly without noticing.
The dark web is a much smaller slice living inside that larger hidden layer. What sets it apart isn’t just that search engines can’t find it. It’s that the sites are intentionally concealed and reachable only through software that anonymizes the connection on both ends. There is no single dark web network; it’s thousands of independently operated sites using encryption to hide both their visitors and their operators.
How Tor Makes It Work
The core technology is called onion routing. Your data gets wrapped in multiple layers of encryption and then sent through a chain of three separate servers, known as nodes or relays. Each node peels off one layer, learns only what it needs to pass the data along, and forwards it. No single node ever knows both where the data came from and where it is going.
The first server in the chain, the guard node, knows your real IP address but has no idea what you’re looking at. The middle node sees only the guard and the exit. The exit node strips the final layer of encryption and sends your request to the destination website. Even if one node is compromised, an attacker gets only a fragment of the picture.
The tradeoff is speed. Bouncing traffic through three servers scattered around the globe makes browsing noticeably slower than a direct connection. The network stays alive through thousands of volunteer-run relays worldwide, a decentralized design that no single authority can easily switch off.
The Weak Spot at the Exit
The exit node is where this design gets thin. Because the exit strips the last layer and sends your traffic to the destination in whatever form the destination expects, a malicious operator can read anything that isn’t itself encrypted. Visit a site using plain HTTP instead of HTTPS, and the operator can see login credentials, messages, and financial data as they pass through.
In 2020, the Tor Project identified a group of malicious exit relays performing SSL stripping on cryptocurrency exchange sites. When a user tried to visit the unencrypted version of a site, the relays blocked the automatic redirect to the secure HTTPS version and sat in the middle, keeping a secure connection with the real website while feeding the user an unencrypted one. The user had no obvious sign anything was wrong. The compromised relays were removed, but the episode is why sticking to HTTPS sites through Tor matters.
How to Reach It Safely
The standard entry point is the Tor Browser, a modified version of Firefox built for anonymous browsing. It’s free, open source, and available from the Tor Project’s official website. Downloading it from anywhere else risks getting a version bundled with malware. Once installed, the browser offers three security levels, Standard, Safer, and Safest, that progressively disable features like JavaScript which could otherwise be exploited to reveal your identity.
When you launch it, the browser connects to a directory server, downloads a list of available nodes, and builds an encrypted circuit through three of them. If the connection fails, which is common in countries that block Tor traffic, you can configure the browser to use bridges: private relay servers that aren’t listed in any public directory. Bridges help users in places like China or Iran disguise the fact they’re connecting to Tor at all.
For stronger protection, the Tails operating system runs entirely from a USB stick, routes all internet traffic through Tor automatically, and wipes itself clean after every session. Nothing you do on Tails touches the host computer’s hard drive unless you specifically enable encrypted persistent storage. It has limits though. If you log into an account tied to your real identity, you’ve linked the anonymous session back to yourself. And unless you use a bridge, your internet service provider will know you connected to Tor, even if they can’t see what you did afterward.
Finding Sites Once You’re In
Dark web sites use the .onion top-level domain, which works nothing like a .com address. You can’t buy one through a registrar, and there’s no public ownership record. The address is generated from the site’s cryptographic keys, producing 56-character strings that are impossible to guess or memorize. That cryptographic binding is a security feature: the address itself proves you’ve reached the right server, because the address is mathematically tied to the encryption key that runs the site.
Finding .onion sites is harder than on the regular web. Ahmia, endorsed by the Tor Project, crawls .onion sites but filters out illegal content. Torch is one of the oldest dark web search engines and keeps a large uncensored index. DuckDuckGo runs a .onion version of its service but primarily searches the surface web. Many users still rely on curated directories like the Hidden Wiki, which mixes legitimate services with scams. Links break constantly, and fake versions of popular directories circulate to steal credentials from the people who trust them.
What People Actually Use It For
The reputation centers on illegal marketplaces, and that side is real, but some of the most important uses are legal and socially valuable.
SecureDrop, an open-source platform hosted as a .onion service, lets whistleblowers submit documents to journalists without revealing their identity. Major news organizations including the New York Times and the BBC run SecureDrop instances so sources in sensitive positions can communicate safely. The system doesn’t log IP addresses, encrypts data in transit and at rest, and sits on servers the news organization physically controls.
In countries with aggressive internet censorship, the dark web functions as a route to uncensored information. The BBC and the New York Times maintain .onion versions of their news sites so readers in heavily censored countries can reach independent journalism. Activists in places like Iran use dark web forums to coordinate protests and share evidence of human rights abuses. The CIA operates a .onion portal that allows informants to make contact without being monitored by hostile governments. Plenty of ordinary privacy-focused users turn to Tor simply to avoid commercial tracking, since every major website profiles visitors for advertising and Tor breaks that chain.
The illegal side runs almost entirely on cryptocurrency because traditional payment methods leave audit trails. Bitcoin powered Silk Road, the first major dark web marketplace, from 2011 until the FBI shut it down in 2013. But Bitcoin transactions are recorded on a public ledger, and law enforcement has grown skilled at tracing them. That pressure has pushed many transactions toward Monero, which obscures sender, receiver, and amount by default.
Dark web marketplaces typically hold buyer funds in escrow until a purchase is confirmed. The flaw is that the marketplace itself controls the escrow. In an exit scam, operators simply vanish with the cryptocurrency sitting in it, sometimes millions of dollars. This happens regularly, most recently with Abacus Market in 2025. There is no recourse. You can’t file a chargeback on stolen cryptocurrency, and you can’t sue an operator you can’t identify.
The Security Risks of Browsing
Browsing the dark web carries real security risks that have nothing to do with whether what you’re doing is legal. There is no consumer protection infrastructure, and every interaction is a potential attack vector.
- Drive-by downloads. Visiting a compromised .onion page can trigger an automatic malware download with no clicks required. These attacks exploit vulnerabilities in the browser or operating system to hijack your device, steal credentials, or add your computer to a botnet. The Tor Browser’s “Safest” setting disables JavaScript because most drive-by exploits depend on it.
- Phishing sites. Because .onion addresses are long random strings, attackers can create near-identical copies of popular dark web sites. A single-character difference in a 56-character address is easy to miss. Cloned sites harvest login credentials, cryptocurrency wallet information, and personal data.
- Credential theft at exit nodes. Malicious exit operators have used packet-capture tools to extract usernames and passwords from unencrypted protocols like FTP, IMAP, and SMTP, and have hijacked HTTP sessions by stealing session cookies from sites that use HTTPS only for the initial login.
- Stolen data marketplaces. Automated storefronts sell stolen personal information, login credentials, financial details, and corporate email addresses for cryptocurrency with instant delivery. If your data has been exposed in a breach, there’s a reasonable chance it has been packaged and listed on one of these sites.
What’s Legal and What Isn’t Under Federal Law
No federal law prohibits using Tor or visiting .onion sites. What federal law targets is specific conduct, and the penalties are steep.
- Computer Fraud and Abuse Act (18 U.S.C. § 1030). The primary federal statute for computer crimes. It covers accessing a computer without authorization, or exceeding authorized access, to obtain protected information, financial records, or government data. Using Tor to reach systems you’re not authorized to enter falls squarely within the statute, whether or not anonymizing technology is involved.
- Money laundering (18 U.S.C. § 1956). Applies to financial transactions designed to conceal the source or ownership of criminal proceeds. Running cryptocurrency through mixers or tumblers to hide the origins of illegally obtained funds can trigger money laundering charges carrying up to 20 years in prison.
- Bank Secrecy Act. FinCEN treats cryptocurrency exchanges and mixer operators as money transmitters that must register, implement anti-money-laundering programs, and file suspicious activity reports. Operating without registration is a federal crime, and mixer operators who skip these requirements face civil penalties from FinCEN and criminal prosecution for running an unlicensed money transmitting business or conspiracy to launder money.
Tor exit node operators sit in an uncomfortable gray area. Running an exit node is legal, and operators may have some protection under Section 230 of the Communications Decency Act and the DMCA’s safe harbor for services that transmit data without modification. But because illegal traffic passing through an exit node gets attributed to the node’s IP address, operators have had police arrive at their doors after investigators traced unlawful activity to the relay rather than the actual user. No operator has been convicted solely for running a relay, but the practical risk of investigation and equipment seizure is real.
For internet service providers, the Communications Assistance for Law Enforcement Act requires surveillance capabilities built into their systems for lawful intercept requests. CALEA doesn’t give law enforcement the ability to break Tor’s encryption, but it does mean your ISP can confirm that you connected to the Tor network, just not what you did after that, unless you’ve configured a bridge to disguise the connection.
How Federal Investigators Work Dark Web Cases
The idea that the dark web is beyond the reach of investigators is outdated. The FBI uses what it calls Network Investigative Techniques, which in practice means government-deployed malware. In the Playpen case, one of the largest dark web child exploitation investigations, the FBI took control of a hidden service and used it to deliver malware to visitors through a vulnerability in the Firefox browser bundled with Tor. The malware pulled identifying information, including real IP addresses, back to an FBI server outside the Tor network. The single operation identified users across the country.
A 2016 amendment to Federal Rule of Criminal Procedure 41 cleared the jurisdictional obstacle that had slowed these cases. The amended rule lets a judge in any district where criminal activity occurred authorize remote searches of computers whose locations have been concealed through technological means, even if the computer turns out to be in a different district or country.
Blockchain analysis is now one of law enforcement’s most powerful tools despite the perception that cryptocurrency is anonymous. Firms like Chainalysis provide software that traces cryptocurrency flows, identifies the entities behind wallet addresses, and follows funds through obfuscation attempts. That analysis contributed to the Silk Road takedown. Ross Ulbricht, who created and operated Silk Road from 2011 to 2013, was convicted in 2015 after investigators combined traditional techniques with digital forensics to identify him despite his use of Tor and Bitcoin. In that same investigation, federal agents made more than 60 individual undercover purchases of controlled substances from vendors over a two-year period, building cases against individual sellers as well as the operator. The techniques have been repeated in every major marketplace investigation since.