What the dark web is and why people use it

The dark web is a part of the internet that requires specific software to access and is designed to hide the identity of both the user and the website operator. The most common way to reach it is through Tor, free software that routes your connection through multiple computers worldwide, making it difficult to trace where you are or what you are doing.

People use Tor and the dark web for legitimate reasons: journalists in countries with censorship access news sources, activists organize without government surveillance, and people in restrictive regions communicate freely. Whistleblowers use it to share information with news organizations. Researchers study it to understand how anonymity networks function. Law enforcement also operates on the dark web to monitor illegal activity.

The dark web also hosts illegal marketplaces and content. Understanding how to access it safely is important if you have a legitimate reason to do so — and equally important if you want to avoid it or understand what your family members might encounter.

Key Takeaways

  • Tor Browser is free software that lets you access the dark web by routing your connection through multiple servers, but using it does not make you anonymous by itself.
  • Your internet service provider can see that you are using Tor, even though they cannot see what you do inside it, and some networks block Tor traffic entirely.
  • The dark web has legitimate uses — journalism, activism, research — but also hosts illegal marketplaces, and law enforcement actively monitors both.
  • Using Tor safely requires disabling plugins, keeping your operating system updated, and understanding that your behavior online can still identify you even if your IP address is hidden.
  • A VPN and Tor together create different security properties than either alone, and the choice between them depends on what threat you are trying to protect against.

How Tor Browser works and what it actually hides

Tor Browser is the legitimate software tool for accessing the dark web. When you read and install it from torproject.org, it works like a regular web browser — Firefox is actually its base — but it sends your traffic through a chain of volunteer-operated servers called nodes. Each node knows only the server before it and the server after it, so no single point in the chain can see both where you started and where you are going.

This hides your IP address from the websites you visit. The website sees the exit node's IP address instead of yours. It also hides your browsing activity from your internet service provider — they can see that you are using Tor, but not which websites you access or what you do on them.

What Tor does not hide: your behavior. If you log into a personal email account, use your real name, or visit websites that identify you, you have defeated the anonymity. If you maximize your browser window, install plugins, or use unusual fonts, websites can fingerprint your device even without your IP address. Law enforcement has successfully identified Tor users by analyzing their typing patterns, posting habits, and the specific times they are online.

Installing and configuring Tor Browser safely

read Tor Browser only from torproject.org, not from mirrors or third-party sites. The official site has a green lock icon and an HTTPS connection. On Windows, macOS, and Linux, the read is a single executable file or installer — there is no registration or account creation.

After installation, open Tor Browser and wait for it to connect. The first time you launch it, it will establish connections to the Tor network, which takes 10 to 30 seconds. You will see a status window showing the connection progress. Once connected, the browser window opens to a blank page with a Tor logo.

Before you browse, disable plugins. Tor Browser comes with plugins disabled by default, but check your settings: go to about:preferences#privacy and confirm that all plugins are set to "Never set up". Plugins like Flash or Java can leak your real IP address even inside Tor. Also turn off JavaScript in the same menu if you are visiting untrusted sites — this prevents some attacks, though it breaks some websites.

Keep your operating system updated. Tor protects your network traffic, but vulnerabilities in Windows, macOS, or Linux can expose your identity through other means. Set your system to install security updates automatically.

What your ISP and network administrator can see

Your internet service provider can see that you are connecting to Tor. They cannot see which websites you visit or what you do inside Tor, but they can see the IP addresses of Tor entry nodes — the first servers in the chain — because that traffic leaves your computer unencrypted. Some ISPs flag Tor usage or throttle it. Some corporate networks and school networks block Tor entirely.

If you are on a work or school network, using Tor may violate the acceptable use policy. If you are on a home network you control, your ISP's visibility of Tor usage is a privacy concern but not a legal one in most countries — using Tor itself is legal in the United States, Canada, the United Kingdom, and most of Europe, though some countries restrict or ban it.

A VPN (virtual private network) can hide the fact that you are using Tor from your ISP. When you connect to a VPN first, then open Tor Browser, your ISP sees traffic to the VPN server but not to Tor. However, the VPN provider then sees that you are using Tor. This trades one observer for another. The choice depends on whether you trust your ISP or your VPN provider more, and what threat you are protecting against.

Accessing dark web sites and understanding .onion addresses

Dark web websites use addresses ending in .onion instead of .com or .org. These addresses are long strings of random characters — for example, thehiddenwiki.onion — and they are generated by the website operator's Tor software. You cannot find .onion addresses through regular search engines. They are shared through forums, news sites, and word of mouth.

The Hidden Wiki (thehiddenwiki.onion) is a directory of dark web resources, accessible only through Tor Browser. It lists news sites, forums, and information resources. Many .onion sites are mirrors of regular websites — ProPublica, BBC News, and The New York Times all maintain .onion versions so people in censored countries can read them.

Dark web marketplaces exist, and some are illegal. Law enforcement agencies worldwide have shut down major marketplaces like Silk Road (2013) and AlphaBay (2017), and they continue to operate undercover on active marketplaces. Assume that any marketplace claiming to be anonymous is monitored by law enforcement, and that purchasing illegal goods carries real criminal risk.

Staying anonymous and avoiding identification

Using Tor is not enough to stay anonymous. Your behavior online can identify you even if your IP address is hidden. Do not use your real name, email address, or username. Do not upload files unless you have removed metadata — images, PDFs, and documents contain creation dates, author information, and other identifying data. Use the metadata removal tools built into Tor Browser or standalone tools like ExifTool.

Do not maximize your browser window. Tor Browser comes in a standard size to prevent websites from fingerprinting you based on screen resolution. Do not install extensions or change settings. Do not use the same .onion site accounts across multiple identities. Do not assume that HTTPS (the lock icon) means a site is safe — it only means the connection is encrypted between you and that server.

Law enforcement has identified Tor users through correlation attacks (analyzing traffic patterns across the network), browser exploits (finding vulnerabilities in Tor Browser itself), and behavioral analysis (recognizing individuals by their posting style and timezone). If you are doing something that could result in serious legal consequences, assume that anonymity is not may provide.

Legal risks and what law enforcement can do

Using Tor is legal. Accessing the dark web is legal. Purchasing illegal goods or services is not legal, and law enforcement actively investigates dark web marketplaces. The FBI, DEA, and international law enforcement agencies operate undercover on dark web sites, purchase from sellers, and use the transaction records to identify buyers.

If you are arrested and law enforcement finds Tor Browser on your computer, that alone is not evidence of a crime. However, if they find evidence of illegal activity — marketplace accounts, cryptocurrency wallets, communications about illegal transactions — they can use that against you. Tor does not protect you from the consequences of your own actions.

Legitimate uses of Tor — journalism, activism, research, privacy — are protected in most democracies. If you are using Tor for a lawful purpose, you do not need to hide that you are using it. If you are using it for an unlawful purpose, understand that anonymity is a technical property, not a legal shield.

Tor versus VPN versus other privacy tools

Tor, VPNs, and other privacy tools solve different problems. A VPN encrypts your traffic and hides your IP address from websites, but the VPN provider sees all your traffic. It is faster than Tor and easier to use, but it offers less anonymity because one company sees everything you do. VPNs are useful for hiding your activity from your ISP or using services that block your country, but they do not provide the same level of anonymity as Tor.

Tor is slower because your traffic bounces through multiple servers, but it provides stronger anonymity because no single entity sees both your identity and your destination. Tor is designed for anonymity; VPNs are designed for privacy and encryption.

Other tools like proxy servers, DNS over HTTPS, and encrypted messaging apps each solve specific problems. A proxy hides your IP but not your identity. DNS over HTTPS encrypts your domain lookups but not your full traffic. Signal or Wire encrypt your messages but do not hide who you are messaging. Understanding what each tool does helps you choose the right one for your actual threat.

Frequently Asked Questions

Is using Tor illegal?

No. Using Tor Browser and accessing the dark web are legal in the United States, Canada, the United Kingdom, and most of Europe. Some countries restrict or ban Tor, including China, Russia, and Iran, though even there the legal status is unclear. What is illegal is using Tor to purchase illegal goods or services or to commit crimes.

Can my ISP see what I do on Tor?

Your ISP can see that you are using Tor, but not which websites you visit or what you do on them. They see the IP addresses of Tor entry nodes because that traffic leaves your computer unencrypted. A VPN can hide the fact that you are using Tor, but then your VPN provider sees that you are using it instead.

Will Tor make me completely anonymous?

No. Tor hides your IP address and your browsing activity from websites and your ISP, but it does not hide your behavior. If you log into personal accounts, use your real name, or have distinctive posting habits, you can be identified. Law enforcement has successfully traced Tor users through behavioral analysis and correlation attacks.

What is the difference between Tor and a VPN?

A VPN encrypts your traffic and hides your IP from websites, but one company sees all your activity. Tor routes your traffic through multiple servers so no single entity sees both your identity and your destination. Tor is slower but more anonymous; VPNs are faster but less anonymous. They solve different problems.

Can I get in trouble just for using Tor?

Using Tor itself is not illegal and will not get you in trouble. However, if law enforcement finds Tor Browser on your computer and also finds evidence of illegal activity — marketplace accounts, illegal purchases, communications about crimes — they can use that evidence against you. Using Tor for legitimate purposes like journalism or activism is protected.