Dark Web: What It Is, How to Access It, and How It Works
What is the dark web, how does it differ from the deep web and Tor, what criminal economy really operates there, and what's true about legends like the Red Rooms.
- Posted on 2026-09-27
- Reading time: 11 min
Dark Web: Deep Web, Legality, and Security #
The dark web includes services and content hosted on networks designed to be inaccessible from the traditional web—such as the .onion services of the Tor network—and accessible only with specialized software. It's not a den of criminals per se, nor simply "the dangerous part of the internet": it's a network layer with specific technical properties—anonymity for publishers and users—that can be used to protect journalists or sell stolen data. It's the use made of it that determines its legality, not access itself.
In short: (In Italian only)
- deep web — everything that search engines don't index (email, intranet, databases): mostly legal and everyday
- Dark web — the portion of the deep web accessible only with dedicated software, designed for anonymity
- darknet — strictly speaking, the overlay network (Tor is the most widespread) on which the dark web runs; in common parlance, however, the two terms are used synonymously.
- Tor — the most used anonymization network to reach it, via onion routing
- .onion — the address of sites reachable only within the Tor network
- Legality — using Tor and accessing the dark web is not a crime; any illegal activities carried out there are.
Surface Web, Deep Web, and Dark Web: The Differences #
The two terms “deep web” and “dark web” are used synonymously almost everywhere, but they describe different levels of the same three-layered scheme.
| Subscription | What it does | How to access |
|---|---|---|
| surface-web | Pages indexed by Google and other search engines — what you browse every day | Normal browser |
| deep web | Everything that is NOT indexed: your email inbox, home banking, online medical records, an internal company database, a paywalled article | Direct access or login, no special software |
| Dark web | A specific and much smaller portion of the deep web, specifically designed to remain unreachable without dedicated software and to guarantee anonymity to those who publish and those who visit | Specific software such as Tor Browser |
The deep web is, in the vast majority of cases, perfectly legal and everyday content, simply not public—your webmail isn't "dark web" just because Google doesn't index it. Every dark web is deep web, but the deep web is almost entirely something else.
How It Works: Tor and Onion Routing #
The most common way to access the dark web is Tor (The Onion Router), an anonymization network born from a US Navy project and now maintained by the Tor Project, a nonprofit organization. The mechanism that gives it its name is onion routing : traffic is wrapped in multiple layers of encryption, one for each node it passes through. For a typical website, the circuit passes through three relays—an entry node, an intermediate node, and an exit node that faces the rest of the network. Each node removes one layer of encryption and only knows the step before and after it, never the entire route.
For .onion services, the mechanism is different: both the client and the service each build their own circuit of three relays to a randomly chosen rendezvous point , for a total of about six hops—and there's no exit node, because the connection never leaves the Tor network. This is why onion services remain protected from the publishers' side, not just from the visitors' side.
Tor does not guarantee perfect anonymity : truly protecting your identity requires not logging in with personal accounts, not entering identifying data in forms, not installing plugins or extensions in your browser (which can bypass the protections), and not using services like torrents over the network, which still expose your real IP address.
Sites reachable only within this network use addresses ending in .onion instead of .com or .it—strings generated by the service's own encryption key, not registered with an authority like regular domains. They aren't part of the standard DNS system: a traditional browser doesn't even know how to resolve them, and they can only be reached via the Tor network.
How to Access the Dark Web Safely #
The standard way to access it is to download Tor Browser from the official Tor Project website—the only source, as modified copies distributed elsewhere are a common vector for malware. Installation is identical to that of any other browser; once opened, it automatically routes all traffic through the Tor network and allows you to visit both regular .com/it sites (anonymously) and .onion sites. The Tor Project doesn't release an official app for iPhone; the alternative it recommends is Onion Browser , developed by a third party but explicitly supported by the Tor Project for iOS.
A few practical rules reduce most of the real risks:
- Do not download files from unknown .onion sites: This is the most common infection vector overall in this context.
- Don't use your real credentials or log in to personal accounts while browsing the dark web.
- Do not install plugins or extensions in the Tor Browser: they can compromise the anonymity that the network basically guarantees.
- Don't trust what you readThe lack of any control over who publishes makes the dark web a fertile ground for scams, even more so than for actual illegal content.
A clarification on VPNs that refutes a widely-used advice online: the Tor Project itself advises against combining a VPN with Tor unless you know exactly how to configure both, because a poorly executed combination can reduce anonymity rather than increase it. For normal browsing with Tor Browser, using it alone is already the default configuration designed to be secure.
Tor vs. VPN: They're Not the Same Thing #
| Tor | VPN | |
|---|---|---|
| Route traffic through | Three (or more) independent relays | A single provider server |
| Access .onion sites | Yes | No |
| Who should trust whom? | No single node sees the entire path | The VPN provider sees all your traffic |
| Swift | Slower | Generally faster |
| Main goal | Anonymity and resistance to censorship | Privacy of your connection to your ISP |
A VPN hides your traffic from your ISP, but the VPN provider itself can see it. Tor distributes trust across multiple independent nodes, but it's slower and, by itself, doesn't hide the fact that you're using Tor from your ISP. These are tools with different goals, not one replacing the other.
Additional Security Levels #
Tor Browser has a built-in security slider (Settings → Privacy & Security → Security Level) that, at its highest setting, disables JavaScript on all websites. This significantly reduces the attack surface for browser exploits, at the cost of breaking some interactive features on pages. Those with more stringent anonymity requirements often go beyond Tor Browser alone: Whonix routes all system traffic (not just browser traffic) through Tor using two separate virtual machines, so even a compromised application can't reveal your real IP address by accidentally bypassing Tor. For more casual use, Tails —a live operating system that can be booted from a USB stick and leaves no trace on the computer being used—is the most popular alternative.
What Are .onion Sites? #
A .onion address is automatically generated from the service's public key when it's created, which is why it appears as a random string of characters (in the current version of the protocol, 56 characters) rather than a freely chosen name. This design eliminates the need for a central authority to assign addresses—anyone can create an .onion service without registering it anywhere—but it has a direct impact on how these sites are found: there's no searchable public registry, and an address must be shared directly or found using a dedicated search engine.
How to Find .onion Sites #
There's no publicly searchable registry of .onion addresses, so the way to find them varies. The most reliable method is direct sourcing: many services publish their .onion addresses in plain text on their official websites, or they report them via Onion-Location , a header that Tor Browser automatically recognizes and offers to redirect you to the .onion version of a site when you visit it from the regular web.
Dark web search engines. Alternatively, there are dedicated search engines that crawl the Tor network. Ahmia is among the most well-known because it applies explicit filters against content such as child pornography, a design choice not all dark web search engines share. The structural limitation remains the same: an search engine can only index what it can reach by following known links, and many .onion services remain unreachable precisely because they are designed not to be.
Another name that often comes up is The Hidden Wiki , one of the most well-known and long-running .onion directories in the history of the dark web. Unlike Ahmia, however, it doesn't apply any filters: it indiscriminately mixes links to legitimate services with links to illegal content, and has been cloned several times by fake versions designed to steal data from visitors. For this very reason, it's not a recommended starting point—a filtered search engine or the direct source of a service remain safer options.
What's on the Dark Web #
Content is roughly divided into two categories, with the second taking up much more media space than the first despite not necessarily being the most widespread:
Legitimate use. Whistleblowing platforms like SecureDrop, used by news organizations like the New York Times and the Guardian to securely receive documents from anonymous sources, and GlobaLeaks , a similar framework also used in anti-corruption efforts; OnionShare , an open-source tool for anonymously sharing files via the Tor network without going through a third-party server; .onion mirrors of sites you want to remain accessible even under censorship—BBC News, ProPublica, and even Facebook maintain their own .onion services for this purpose; and forums for activists, political dissidents, and journalists operating under regimes that restrict the Tor network itself (China, Russia, Iran, Turkey). A little-known technical curiosity: not all .onion sites are equally public—a service can require an authentication key in addition to its address, remaining invisible and inaccessible to anyone who hasn't received it directly from its operator.
Illegal use. Marketplaces selling stolen data, compromised credentials (often the culmination of a successful phishing campaign), ready-made malware , drugs, weapons, and counterfeit goods; black hat forums where exploits and compromised logins are bought and sold. The most well-known marketplaces of this type—Silk Road and AlphaBay above all—were dismantled by international police operations, with their operators arrested and funds seized; Dream Market, however, ceased operations in 2019 under less clear circumstances. None of these marketplaces exist anymore, and it's the norm rather than the exception: a marketplace selling illegal goods online sooner or later ends up under investigation, shut down, or emptied of its owners. This article neither names nor links to any currently active marketplaces. And on the darker edges, material that law enforcement agencies around the world actively pursue, including child exploitation. On this last point there is nothing to explain beyond the fact that it exists as a priority for international counteraction: it is not material that this article goes into in any way.
The Underground Economy: Not Just Drugs #
The image of marketplaces selling only illegal substances is now reductive. A significant portion of modern cybercrime revolves around access and data, not physical goods—and understanding how it works helps explain why certain attacks occur in chains rather than as isolated acts of a single criminal.
| What is exchanged | What is |
|---|---|
| Credentials and session cookies | Username, password, and session token stolen through malware, phishing, or data breach — a valid session cookie allows you to reuse a previously authenticated login without even knowing the password |
| Initial access | Access to a corporate network (VPN, RDP, privileged account) already obtained, sold by the person who compromised it to someone who will exploit it at a later time — the person who enters and the attacker are often different people |
| Exploits and vulnerabilities | Code or information to exploit flaws that are not yet patched (0-day) or are already known (n-day); the value varies greatly depending on the severity and diffusion of the affected software |
| Ransomware Leak Site | .onion pages where a group publishes, or threatens to publish, data stolen from a company that has refused to pay — a pattern known as double extortion. |
This separation of roles—who gains access, who buys it, who leads the attack, who manages the extortion—is one of the most concrete aspects of how organized cybercrime really works today: a supply chain with different specializations, not the work of a single hacker isolated in a dark room.
The Myth of Total Anonymity: Two Things Almost No One Knows #
Two widespread beliefs about the dark web are, in practice, wrong—and understanding them is probably the most instructive part of this article.
Paying in Bitcoin doesn't mean being anonymous. Every transaction is recorded forever, in plain text, on the public blockchain: anyone can consult it. Specialized forensic analysis firms routinely collaborate with law enforcement to reconstruct the flow of funds between wallets, and the weak point almost always comes when someone converts cryptocurrencies into euros or dollars on a regulated exchange, which by law must identify its users. Several high-profile legal cases—including Silk Road—have been resolved by tracking the money on the blockchain, not by hacking Tor.
A marketplace that functions normally is no guarantee of anything. The most sensational case is that of Hansa Market: when Dutch police took control of it in June 2017, they didn't shut it down—they kept it operating undercover for about a month, just as thousands of users of the recently closed AlphaBay (a closure coordinated under the name Operation Bayonet) flocked there, believing it to be a safe haven. During those weeks, the Dutch police recorded passwords in clear text, intercepted orders before messages were encrypted with PGP, and collected over 10.000 real delivery addresses, which they then shared with Europol. A site that accepts logins and processes orders normally can still be controlled, at that moment, by those already investigating its users.
Dark Web Legends: What's True and What's Not #
Stories have been circulating around the dark web for years, building its sinister reputation, but they don't hold up well to fact-checking.
"Red Rooms." The most widespread legend speaks of hidden sites where it's supposed to be possible to watch live extreme violence by paying in cryptocurrency. Despite dozens of online accounts, there's no reliable public evidence that such a Red Room has ever actually functioned as described: most documented cases have proven to be scams, in which the victim is asked to pay for a nonexistent stream, followed by further requests for money.
Hitmen for hire. Several .onion sites have claimed over time to offer contract killings. The investigations that followed have never documented a single case in which a murder was actually committed through one of these services: almost all turned out to be scams designed to extort money from those who believed them, and in some cases, those who attempted to commission them ended up on trial for the attempt itself.
The "secret levels" of the internet. A popular story on forums and videos describes the web as divided into increasingly hidden and dangerous layers. It doesn't correspond to any real technical structure—the internet isn't organized into levels—and began as pure creepypasta, the same category of internet urban legend as Red Rooms.
The common thread is always the same: fear and curiosity are the perfect bait for a scam. Those who enter the dark web expecting the worst often discover that the real risk is much more mundane—being scammed, infected, or identified—not the horror stories circulating online.
Is the Dark Web Illegal? #
No—and it's worth being clear about this, because it's the most misunderstood point of the entire topic. Using Tor and accessing the dark web is not a crime in Italy or in most countries around the world, with the exception of countries like China, Russia, Iran, and Turkey, where the Tor network itself is restricted or banned. What remains illegal are the specific activities carried out once inside: purchasing illegal goods or services, accessing or distributing prohibited content, committing fraud or unauthorized access to computer systems—precisely the same crimes that remain illegal on the rest of the internet, not new rules created by the context. "I found this by accident" is not a valid legal defense if, once you've found illegal content, you knowingly download, store, or redistribute it.
FAQ #
What is the dark web? It's the portion of the internet accessible only with specialized software like Tor, designed to guarantee anonymity for both publishers and browsers—a small portion of the larger deep web (everything not indexed by search engines).
What's the difference between the deep web and the dark web? The deep web is all content not indexed by Google (emails, databases, corporate intranets) and is mostly completely legal and commonplace. The dark web is a specific subset of the deep web, accessible only with Tor or similar software and designed for advanced anonymity.
How do you access the dark web? Download Tor Browser from the Tor Project's official website—the only secure source—and navigate to .onion addresses as you would with a regular browser.
Is using Tor legal in Italy? Yes, on the same legal basis as any other software: using Tor does not in itself make an activity illegal; what can constitute a crime is the specific behavior, not the tool used to perform it.
What's really on the dark web? A mix of legitimate privacy and freedom of information services (whistleblowing, mirrors of censored outlets elsewhere) and marketplaces or forums dedicated to illegal activities—media perception emphasizes the latter category more than it reflects actual internet usage.
Is browsing the dark web dangerous? The main risk isn't legal, but practical: malware distributed via download, scams on marketplaces with no guarantees, and the complete lack of moderation or quality control on any content found.
Do you need a VPN to access the dark web? No, you don't: Tor Browser alone is already designed to be secure by default, and the Tor Project itself advises against using a VPN unless you know how to properly configure it with Tor.
Does Tor completely hide your identity? No. It greatly reduces traffic traceability, but logging in with personal accounts, data entered into a form, or a browser plugin can still identify you—anonymity depends on behavior, not just the tool.
Can you use Tor without accessing the dark web? Yes. Most people who use Tor Browser do so to browse the regular web anonymously, without ever visiting an .onion site—Tor and the dark web are not synonymous.
Does Google index the dark web? No. .onion sites aren't part of the traditional DNS system and can't be reached by standard search engine crawlers: they require dedicated engines that crawl within the Tor network.
Do Red Rooms really exist? There is no reliable public evidence proving the existence of a functioning Red Room as legend has it. Most documented cases involving this name have turned out to be extortion scams.
What's the difference between Tor and the dark web? Tor is the software and network used to access the dark web anonymously; the dark web is the set of content and services accessible through that network. You can use Tor without ever touching the dark web, but you can't access the dark web without software like Tor.
