Why you can trust ZDNET : ZDNET independently tests and researches products to bring you our best recommendations and advice. When you buy through our links, we may earn a commission. Our process

'ZDNET Recommends': What exactly does it mean?

ZDNET's recommendations are based on many hours of testing, research, and comparison shopping. We gather data from the best available sources, including vendor and retailer listings as well as other relevant and independent reviews sites. And we pore over customer reviews to find out what matters to real people who already own and use the products and services we’re assessing.

When you click through from our site to a retailer and buy a product or service, we may earn affiliate commissions. This helps support our work, but does not affect what we cover or how, and it does not affect the price you pay. Neither ZDNET nor the author are compensated for these independent reviews. Indeed, we follow strict guidelines that ensure our editorial content is never influenced by advertisers.

ZDNET's editorial team writes on behalf of you, our reader. Our goal is to deliver the most accurate information and the most knowledgeable advice possible in order to help you make smarter buying decisions on tech gear and a wide array of products and services. Our editors thoroughly review and fact-check every article to ensure that our content meets the highest standards. If we have made an error or published misleading information, we will correct or clarify the article. If you see inaccuracies in our content, please report the mistake via this form.


Your guide to the dark web and how to safely access .onion websites

Here is our comprehensive guide to the dark web and what businesses need to know about this layer of the internet.
Written by Charlie Osborne, Contributing Writer on
Person using website in the dark.
Getty Images

The internet opened the door to a realm of possibilities that changed the business landscape and our personal lives permanently. 

No longer restricted to dial-up, many of us now consider access to a stable internet connection as a critical aspect of our daily lives -- and a right. For example, we pay our bills online, check our bank statements, communicate via email, and maintain a presence on social media. 

In addition, many of us rely on the web for work and entertainment, and seeking out information through search engines is customary. 

However, it isn't widely known that today's most popular search engines -- including Google, Bing, Baidu, and DuckDuckGo -- only index a portion of the internet. 

The area of the internet we access day to day is known as the clear or surface web. However, there is also the deep and dark web, and here's everything you need to know about the differences.

Also: Best browsers for privacy

The deep and dark web

A spiderweb in the dark
Getty Images

What is the difference between the clear, deep, and dark web?

You could consider the clear or surface web the "top" and visible layer of the internet, easily accessible using a browser such as Safari, Chrome, Edge, or Firefox. However, the terms dark and deep are sometimes used interchangeably. 

The deep web is the second layer of the internet, which is not indexed by search engines. Websites and pages in the deep web might include password-protected content, private forums, and personalized resources. 

As search engine crawlers do not catalog these pages, you would need to know the exact link to access a website in this area of the internet. This could include government services to access your records, health care services, members-only areas, intranets, or corporate resources. 

Also: These are the top passwords hackers use against remote access

The dark web, however, requires special software to access. You need to install a Virtual Private Network (VPN), (at the least, you should), and you need to use a privacy-central browser such as the Tor network to connect via nodes and proxy servers, which are more secure and aim to anonymize traffic requests. The Tor Browser is able to access the special domain names, with the suffix .onion, used in the dark web.

Is the dark web just for criminals?

When the dark web is mentioned online, it is usually in tandem with criminal marketplaces and arrests made by law enforcement agencies. 

Drugs, weapons, and stolen IP and data are all hot businesses in the dark web, with hundreds of terabytes of information on offer. Traders cash in on stolen credit card data dumps, initial access points to vulnerable systems, credentials, and intellectual property belonging to companies comprised during cyberattacks.

 According to Kela's 2022 Threat Intelligence report (PDF), 48% of organizations have no documented dark web threat intelligence policy in place, despite the obvious danger. 

However, the dark web has far more uses for organizations and individuals than what a small subset of criminals do under its umbrella.

To access a dark web address, you must use a VPN and a suitable browser (it should be Tor). The aim is to reduce your online footprint as much as possible, anonymize your traffic, and disguise your location. 

There are many legitimate uses for dark web services and communication. For example, this can include tools hosted for combating censorship -- critical services for individuals in countries with stringent government surveillance and control, as well as privacy-enhancing anonymous email and whistleblower drop boxes.

Also: What is torrenting and how does it work?

Some media outlets also maintain an online presence via the dark web when their surface websites are blocked, and other websites do the same when they are banned at the ISP level by countries during unrest and protests. 

Yes, the dark web has an unsavory reputation. However, remaining anonymous can be invaluable to protesters, civil rights groups, journalists, lawyers, and other vulnerable groups.

What should I be wary of on the dark web?

Unless you know exactly where to go to access a legal and legitimate website, you need to be aware of some of the risks you might be taking. These include:

  • Illegal marketplaces: If you stumble upon an underground marketplace, you will find all manner of items and services for sale including drugs, weaponry, counterfeit documents, stolen information, and malware. However, just because you're in the dark web and may be using cryptocurrency for purchases, doesn't mean you won't be tracked down.
  • Scams: As the Wild West of the web, even if you take the chance and try to buy something illegal, you could be scammed. Sellers are often not what they seem. 
  • Visits to extreme content: It's not that likely, unless you are intending to find it, but if you stumble upon extreme or abusive content, you might find yourself subject to an investigation by law enforcement. It should also be noted that downloading such content is often illegal.
  • Malware: In the same way as the clear web, websites and resources found here may be hiding malicious software designed to compromise your PC or mobile device. Malware can include information stealers, Trojans, ransomware, or exploit kits. You may also be subject to phishing attempts. 

Also: These are the cybersecurity threats of tomorrow that you should be thinking about today

How do I access the dark web?

If you need to access dark web resources, these are the steps you need to take.

Human connected to a shield, connected to a cloud.
Getty Images

1. Invest in a VPN

A VPN will mask your location and stop the online breadcrumbs that can lead back to you. Connections made while a VPN is active will also be encrypted, helping you stay protected from eavesdropping and Man-in-The-Middle (MITM) attacks. You can usually select the location you want to appear to originate from and VPNs will use a collection of servers and relays to make tracing your IP difficult. 

VPNs are also used for accessing geolocked content hosted by streaming services. The best options are paid-for and subscription-based, as many free options will either throttle your speed or collect your data. 

ZDNET's current choice for the best VPN is ExpressVPN.  

Tor Browser
Screenshot by ZDNET

2. Download the Tor Browser

You will need to visit the Tor Project to download the Tor Browser, a browser that prevents online fingerprinting, circumvents website blocks, and stops trackers from building a profile based on your browsing habits. 

The Tor Browser uses different layers of encryption to further strengthen your anonymity and has integrated the DuckDuckGo search engine, a system that makes a point of not saving or logging your search queries. You should make sure you check the settings, and if you want a more secure experience, go for the "safer" or "safest" options, which also disable potentially dangerous website functionality, such as rogue JavaScript.

The Tor network is operated by thousands of volunteers worldwide who maintain the proxy servers used to protect your identity. You can download the Tor Browser for Windows, MacOS, Linux, and Android. 

Both a VPN and Tor should be used together and it is advisable to connect via a VPN to Tor, rather than vice versa, for the best protection possible. In addition, if you're concerned about malware or exploits, you could also consider using a virtual machine (VM). 

Onions growing from the ground.
Getty Images

3. Find the onion

To access a dark web resource, you will need to know its web address to the letter. These websites will also use .onion top-level domain names, and many of them will be very long, random combinations of letters and numbers. 

There is a number of directories that host .onion links and websites, but you should always demonstrate caution. Some will lead you to commercial sites -- ranging from cryptocurrency mixers to drugs and fake passport offerings -- whereas others are non-commercial and include legal content, such as education and training workshops, forums, and personal blogs. DefCon, ProPublica, the CIA, various libraries, and open-source software providers also feature in this area of the internet. 


Is it legal to access the dark web?

What you should remember is that in most countries, accessing dark web resources is legal. However, conducting criminal activities via the dark web is illegal

If you are visiting websites in the dark web and you are not adequately protected, you may make yourself the subject of scrutiny or investigation -- even if there is no evidence of illegal activities or purchases. It's worth noting that some countries (such as China or Iran) more than others may take a dim view of attempts to stay in the shadows.

Do I have to use a VPN?

Yes, you should. It is recommended to use a VPN to reduce tracking by governments, companies, and advertisers anyway, but if you are privacy-conscious and elect to switch from a typical browser to Tor, a respectable VPN is key. 

Countries such as China (and its famous "Great Firewall" blocks) may monitor citizens at the Internet Service Provider (ISP) level, and so if you are using Tor, the usage alone may appear in your records. A VPN can help disguise your use of Tor and visits to dark web resources. 

Is the dark web completely private and secure?

The simple answer is no. While strong encryption, VPNs, proxy servers, and hidden web addresses can all contribute to a more anonymized experience, there is no singular system that we have access to that is completely private and secure. 

Being hidden doesn't translate into being completely protected from the possibility of tracking, or, when it comes to illegal activities, of risk. However, it's up to us to take control of our personal privacy in a world of bulk data collection, surveillance, and personalized ad tracking -- and so, at the least, you should consider using a VPN.

Editorial standards


How to customize the Firefox homepage on Android
The Customize Homepage button on Firefox.

How to customize the Firefox homepage on Android

The top travel VPNs (plus whether a VPN is all you need to be protected)

The top travel VPNs (plus whether a VPN is all you need to be protected)

Cyber scammers are scamming each other, and revealing dark web secrets along the way

Cyber scammers are scamming each other, and revealing dark web secrets along the way