Dark web sites are websites that normal browsers cannot open. Most are onion sites: pages on the Tor network with addresses ending in .onion. To find them people use Tor Browser and special search engines such as Ahmia and Torch, or link directories such as the Hidden Wiki. This page explains each tool, how far to trust it and what is risky, written for security teams. It gives no working onion addresses.
What are dark web sites and onion sites?
The deep web is everything search engines do not index, such as your online banking or company intranet. The dark web is a small, deliberately hidden part of it. You need software such as Tor Browser to reach it. Our dark web glossary entry covers the basics.
An onion site is a website that runs as a Tor onion service. Its address is a long string of random letters and numbers ending in .onion, so you cannot guess it or read it like a normal domain. The site and the visitor are both hidden from each other. Accessing the dark web is not illegal in most countries, but some of what is on it is. Check the rules where you work.
Not everything there is criminal. Some well-known organizations run onion versions of their sites so people can reach them in countries that block them. The BBC, for example, launched an onion version of its news site in October 2019. Journalists, activists and privacy-minded people use Tor every day. The criminal side is what defenders watch.
What kinds of dark web sites do defenders watch?
Threat actors use the anonymity of the dark web for a few kinds of sites. Each one gives a different kind of intelligence.
- Forums. Hacking communities trade stolen data, fraud methods and malware, and recruit partners.
- Marketplaces. Commercial sites for illegal trade. Several of the biggest were seized, and we track which in our dark web marketplace list, including dates.
- Ransomware leak sites. Lists of victim companies with a countdown and, later, the stolen files. See ransomware groups and how to monitor them.
- IRC channels and chat. Anonymous chat used by hackers and hacktivist groups. Much of this chat has also moved to Telegram, which we cover in Telegram marketplaces.
For how analysts use each type, read deep web websites for threat intelligence.
Which browsers reach the dark web?
Tor Browser
Tor Browser is the standard way in. It is built on Firefox ESR and sends your traffic through three relays run by volunteers, so no single relay knows both who you are and what you open. Chrome, Firefox, Edge and Safari cannot open onion addresses on their own. For a step-by-step explanation of how Tor works, see our dark web guide and the glossary entry on the Tor network.
I2P
I2P is a separate anonymous network with its own sites, called eepsites, ending in .i2p. It is smaller than Tor and less used for searching, but some criminal communities run there.
Hyphanet
Hyphanet is a peer-to-peer network for sharing files and sites. It was called Freenet until it was renamed in 2023.
ZeroNet
ZeroNet development has almost stopped and the project has several forks and known vulnerabilities. We list it because older articles still mention it, not because we advise using it.
Best dark web search engines in 2026
Dark web search engines index onion sites so you do not have to guess addresses. None is as good as Google. Pages disappear, results go stale, and anyone can submit a page, including scammers. The table shows what each tool is and the main risk. We do not publish onion addresses. A copied address from a forum or a list is how people end up on a clone.
| Engine | What it is | Main risk |
|---|---|---|
| Ahmia | Open source search for onion sites with a block list for abusive material. Has a regular web version. | Smaller index, so you miss sites. |
| Torch | One of the best-known onion search engines. It has a very large index and no content filter. | Shows harmful material and heavy ads. Clone pages exist. |
| Haystak | Large onion index. The free version is limited; extras such as cached copies and alerts are paid. | Paid tiers cost money; free results are limited. |
| DuckDuckGo onion service | A private search of the regular web through Tor. It does not index onion sites. | Not a dark web index, so it will not find onion pages. |
| OnionLand and Not Evil style tools | Older or community-run search sites. | Often unreliable, and look-alike copies are common. |
| Candle | An experimental search engine from the mid-2010s. | Index is small and may be out of date. |
The Torch search engine
People search for the Torch search engine more than for any other onion search tool. It is a long-running search site on Tor with a large index. It applies no filtering, so results can include illegal or disturbing material. It also carries a lot of advertising, and on the dark web ad networks are used to spread scams and malware. Pages that copy its look exist, so never trust an address from a forum post or a list.
Ahmia and others
Ahmia is the one most often used by researchers because it filters abuse and is open source. Researchers also use crawlers they run themselves. Our post on OSINT tools for the dark web shows how this works with tools such as TorBot.
DarkSearch and the “onion browser” question
DarkSearch is a search engine for onion pages that has offered a web search and a programming interface (API) for researchers, which is why teams that want to script lookups know it. Its index is limited like the others, so treat a miss as unproven. People also search for an “onion browser”. This usually means one of two things: Tor Browser, which opens .onion addresses on a computer or an Android phone, or Onion Browser, an app for iPhone. The Tor Project says Onion Browser is open source and built by someone who works closely with the project, but that Apple’s rules stop it from giving the same privacy protection as Tor Browser. For dark web chat rooms, see the note on chat above: most of that talk has moved to Telegram.
What is the Hidden Wiki, and is there a real one?
The Hidden Wiki was a wiki on Tor that anyone could edit after signing up. It worked as a directory of links to other onion sites, including illegal ones. Its earliest known address dates from 2007. It was hosted by Freedom Hosting until 2013 and was hacked and redirected in March 2014. In November 2014, during Operation Onymous, law enforcement posted a message on it.
Today there is no single official Hidden Wiki. Many copies exist at different addresses, some set up to filter out the worst links, others set up to trick visitors. Because anyone can edit them, their link lists often contain scams and phishing pages. Treat a Hidden Wiki as a list of unverified claims, not a safe starting point.
Why should you not trust lists of dark web links?
Search results for dark web links, onion links or deep web links are full of lists. Onion addresses are random strings, so a fake looks the same as a real page. Common tricks are:
- A clone of a market or search engine with one changed character in the address, built to steal logins and funds.
- A directory page that sends visitors to malware or scam sites.
- Fake “verified link” lists that sell the same worthless addresses.
If you need the address of a legitimate service, get it from the service’s own regular website, not from a list.
How can security teams research onion sites safely?
Most organizations should not send staff to browse these sites. If you do research in house, set rules first. Users run into malware, scams and illegal content, and a mistake can harm the person and the company.
- Get written approvalLegal and management should agree on scope and purpose.
- Use an isolated machineA dedicated virtual machine or device, never a work laptop with company logins.
- Use no real identityNo personal accounts, no real names, no reused passwords.
- Never download or buyDo not open files from unknown sites. Do not pay for anything.
- Log what you seeSave notes and screenshots for the report, then close the session.
Most teams do better with a monitoring service or a threat intelligence platform that collects this data for them. See the deep web monitoring tools comparison and Cyber Threat Intelligence.
Conclusion
Dark web sites are easy to find and hard to trust. Tor Browser opens them, Ahmia and Torch search them and the Hidden Wiki lists them, but every one of those tools comes with risk. For defenders the question is not how to browse onion sites, it is what is being said about your organization there. Request a demo to see how dark web monitoring answers that.