What Is the Dark Web? What It Is, the Risks, and What to Do If Your Data Is There

The dark web is the part of the internet that cannot be reached with an ordinary browser and is not indexed by search engines. It needs special software, and many of its sites are Tor onion services. It is a small slice of what people call the "deep web", which is simply everything behind a login. This guide explains the difference, what the real risks and legal limits are, and what a defender should do when someone says your data is for sale there. It does not explain how to get on.

TL;DR

The short version

5 points

The dark web is the part of the internet that can only be reached with special software and is not indexed by search engines. Sites there are often run as Tor onion services.
It is not the same as the deep web. The deep web is everything behind a login or paywall that search engines cannot index, such as your email, online banking and medical portals. Most of it is ordinary and legal.
Using privacy software is legal in most countries. Buying stolen data, drugs, weapons or malware, or looking for illegal material, is a crime and carries real risk. This guide does not explain how to get onto it.
A criminal group listing an organisation on a leak site is a claim, not proof. Treat it as unconfirmed until the company, a regulator, a court filing or a reputable outlet confirms it.
If your credentials may have been exposed, change the password, turn on phishing-resistant sign-in and check the accounts that reused it. You do not need to visit the dark web to do any of this.

Surface web, deep web, dark web

Surface web

Pages search engines index and anyone can open: news sites, public company pages.

Deep web

Content behind a login or paywall that search engines do not index: email, banking, cloud files, intranets, medical portals. Mostly ordinary.

Dark web

A deliberately hidden part that needs special software and often uses onion addresses. Contains privacy services and criminal markets.

Why it exists, and what is traded

The Tor Project describes onion services as a way to browse and publish anonymously through the Tor network, used for things like journalist and source contact (SecureDrop) and safer software updates. The same anonymity attracts crime. Security researchers and law enforcement describe stolen credentials, payment card data, access to compromised networks, malware and fraud services being offered on forums and markets. Listings are often scams themselves, and markets are regularly seized or disappear. This guide does not quote prices or volumes because they vary by source and change quickly.

Law and safety

Privacy tools are generally lawful; crimes are not. Buying stolen data, drugs, weapons or malware, or viewing illegal content, is illegal in most places, whether or not you are on the dark web. Laws differ by country.
There is no safe shortcut. Scams, malware and fake sites are common, and curiosity visits can expose you to illegal material.
If your job needs it, such as threat intelligence, do it under your employer's policy, legal sign-off and approved tooling, not from a personal machine.
You do not need to look yourself. Defenders can learn what is claimed from vendor reports, breach-lookup services and public reporting.

Leak-site listings are claims

Ransomware and extortion groups run leak sites to pressure victims. A name on one means the group says it holds data. It can be an old breach reused, an exaggeration or, sometimes, accurate. Only the company, a regulator, a court filing or a reputable outlet can confirm it. That is why we write "X was named on the Y leak site; X has not confirmed", as in our Deloitte leak-site article. To practise telling recycled claims from new ones, try the Leak-Forum CTI Correlation Lab, which uses synthetic data, and read how recycled breaches and aliases are tracked.

If your credentials may be exposed

Change the password on that account, and on every other account that used it.
Use a unique password per site from a password manager, and turn on multi-factor sign-in. Where offered, move to passkeys.
Check for sign-ins you do not recognise and revoke old sessions and tokens.
Expect phishing that quotes real details, and be sceptical of calls or messages about the leak.
Check whether an address appears in known breaches with a legitimate lookup service. Our breach lookup API roundup lists options.

Security teams can rehearse the steps in the Leaked Credential Response tool.

Frequently asked questions

What is the dark web?

The dark web is a part of the internet reachable only with special software, such as the Tor network, and not indexed by search engines. Many of its sites are onion services whose operators and visitors are designed to be hard to identify. It hosts both privacy-protecting services and criminal marketplaces and forums.

What is the difference between the deep web and the dark web?

The deep web is any content search engines do not index, usually because it sits behind a login: webmail, banking, cloud documents, intranets, medical records. The dark web is a small, deliberately hidden part that needs special software. Everyone uses the deep web daily; few people ever need the dark web.

Is the dark web illegal?

Accessing privacy networks like Tor is lawful in most countries, and journalists, activists and ordinary people use them. What is illegal is the activity: buying or selling stolen data, illicit drugs, weapons or malware, or viewing certain illegal content. Laws differ by country, so check your own jurisdiction.

Is it safe to browse the dark web?

It carries real risks: scams, malware, fake marketplaces, exposure to illegal material, and attention from law enforcement. Most people have no good reason to go, and this guide gives no access instructions. If your job needs it, such as threat intelligence work, use your employer’s approved tooling, policies and legal advice rather than doing it yourself.

What is sold on the dark web?

Reports from security researchers and law enforcement describe stolen credentials, payment card data, access to compromised networks, malware and fraud services, alongside non-criminal content. Prices and volumes change quickly and vary between sources, so this guide does not quote figures.

How do I know if my data is on the dark web?

You usually cannot check the dark web yourself and should not try. Use legitimate breach-lookup services and your password manager’s breach alerts, and treat monitoring products as a convenience, not a guarantee. Assume that any password reused across sites could be exposed and replace it.

A ransomware group says it has stolen a company’s data. Is that confirmed?

No. A listing on a leak site is the group’s own claim. Groups can exaggerate, recycle old data or list victims without proof. Wait for confirmation from the company, a regulator, a court filing or a reputable outlet, and word it as "named on the leak site; has not confirmed". Our Deloitte article is an example of that wording.

What should I do if my password appears in a leak?

Change it on that site and on every site where you reused it, use a unique password for each, turn on multi-factor authentication or a passkey, and watch for phishing that uses the leaked details. Organisations should follow an incident process to reset credentials and review sign-ins.

This is general information, not legal advice. Definitions follow common usage and the Tor Project's description of onion services (support.torproject.org/onionservices/onionservices-1/, checked 3 November 2026). No statistics are quoted because published figures differ widely between sources.