Dark Web Search Engines in 2026: What Each One Really Indexes

A dark web search engine is a search engine for onion services, the sites on the Tor network whose addresses end in .onion. It crawls the onion pages it can reach and lets you search their text by keyword. Ahmia, Torch, Haystak and Excavator are among the best-known names.

No engine sees more than a small part of the onion space, and none sees Telegram channels or forum threads behind a login. We compared ten engines, ran five defender searches on Ahmia on 10 November 2026 and set the results beside what Brandefense Blackhole collected this year. This page gives no onion addresses.

What Is a Dark Web Search Engine?

Onion addresses cannot be guessed. The Tor Project explains that an onion address is the public key of the service, which is why it looks like a long random string. Google and Bing do not index these pages, so specialist engines fill the gap.

They work like small web crawlers. They start from known onion pages and from addresses that operators submit, follow the links they find and index the text. Ahmia, for example, takes submissions from onion service operators and publishes its crawler as open-source code.

The space they try to cover is large and unstable. Tor Metrics estimated 500,224 unique version 3 onion addresses on 8 November 2026, extrapolated from relay reports. Ahmia’s public list of known onion domains held 10,769 entries on 10 November 2026, about 2% of that figure. Not every onion address is a public website, so the gap overstates what is missing, but no engine comes close to full coverage.

Not every onion site is criminal. BBC News, for example, launched an onion version of its site in October 2019 so readers could reach it where it is blocked. The criminal part is what defenders search for.

Onion, Tor and Deep Web Search Engines: Is There a Difference?

Mostly no. “Onion search engine” and “Tor search engine” usually mean a tool that indexes .onion pages, the same thing as a dark web search engine. One exception catches people out: the search box in Tor Browser is DuckDuckGo, the default since Tor Browser 6.0.6, and it searches the regular web, not onion sites.

“Deep web search engine” is looser. The deep web is everything ordinary search engines do not index. Most sites in the deep web are ordinary pages behind a login, such as webmail or an intranet.

This page uses the phrase the way most guides do, for engines that index onion pages. Our deep web vs dark web comparison explains the difference, and the glossary covers the dark web and the Tor network.

Dark Web Search Engines Compared

The table shows what each engine indexes, how it filters and what we could check ourselves on 10 November 2026. “Not opened” means we found no clear-web interface for the engine, and we do not open onion services to write a blog post.

Engine	What it indexes	Filtering	What we could check
Ahmia	Onion pages its crawler reaches; 10,769 known onion domains in its public list	Blocks child sexual abuse material and, since November 2023, sexual searches	Clear-web site works; used for our five test searches
Torch	Onion pages; no figures from its operators	Unknown; no statement found	Not opened; a 2025 study used it to collect addresses
Haystak	Onion pages; no independent count of its index	Unknown; no statement found	Not opened
Excavator	Onion pages; operator unknown	Unknown; no statement found	Not opened; see its own section below
OnionLand Search	Onion pages	Sends child abuse searches to a self-help notice (2024 study)	Clear-web site answered with a bot check
Onion Search Engine	Onion pages	Same self-help notice (2024 study)	Clear-web site blocked our request
DuckDuckGo onion service	The regular web, not onion pages	DuckDuckGo’s own policies	Tor Browser’s default engine; Onionize switches to this version
VisiTor	Onion pages	Unknown	Not opened; used in the same 2025 study
DarkSearch	Onion pages, with a free API in its time	Unknown	Closed in 2022; its domain no longer resolves
Grams	Darknet market listings	Not applicable	Closed in 2017; its operator was sentenced in 2024
TorBot, OnionScan, Fresh Onions	Whatever your own crawler reaches	You set it	Open-source code you run yourself

What Does Each Engine Index?

Ahmia

Ahmia was the only onion index whose clear-web site, ahmia.fi, answered our searches on 10 November 2026; it also runs an onion version. Juha Nurmi founded it, and its code is open source in three parts: the crawler, the Elasticsearch index and the website. A researcher can search it without Tor, because the results page shows titles, snippets and a “last seen” time.

Ahmia blocks onion services that host child sexual abuse material and publishes that blocklist as hashed addresses. Its banned list held 60,330 entries on 10 November 2026, far more than the 10,769 domains it lists as known and not banned. Since November 2023 it has also filtered all sexual searches. The cost is coverage: a search that finds nothing on Ahmia proves nothing.

Torch

Torch is one of the names every list repeats. We found no clear-web interface for it and no statement from its operators about its index size or filtering. Researchers who built the Mimir crawler queried Torch, Ahmia and VisiTor to collect their starting addresses, so it was still a working research source during their crawl.

Assume Torch results are unfiltered. A 2024 study led by Ahmia’s founder found that 21 of the 26 most-used Tor search engines returned child sexual abuse material for test searches. Only five tried to block it. The paper does not say which engines those were, so treat this as a rule of thumb, not a finding about Torch.

Haystak

Haystak usually appears next to Torch in these lists, and we found no clear-web interface for it. We also found no independent count of its index, so we repeat no size figure. If your team relies on it, record each result with its date, because nobody outside can check what it covers.

OnionLand Search

OnionLand Search indexes onion pages and also runs a clear-web front end. When we requested that front end on 10 November 2026, it answered with a bot check, and we did not try to get past it. The 2024 study names OnionLand as one of three engines that show a self-help notice to people who search for child sexual abuse material.

Onion Search Engine

Onion Search Engine works the same way: an onion index with a clear-web site. That site blocked our request outright on 10 November 2026. Like Ahmia and OnionLand, it showed the researchers’ questionnaire to people searching for child abuse material, so its operator took part in that filtering work.

DuckDuckGo Onion Service

DuckDuckGo is the default search engine in Tor Browser, and it runs its own onion service. The Tor Project says the “Onionize” option in DuckDuckGo switches you to it. It gives private search of the regular web over Tor, which helps when you read news about a leak, but it will not find onion pages.

DarkSearch

DarkSearch offered a free API, so analysts could script searches instead of typing them. Its 2020 homepage, saved by the Internet Archive, described it as free, with an API and a crawler running around the clock. A notice saved in 2023 says public access ended in 2022, and on 10 November 2026 the domain did not resolve at all.

Grams

Grams shows that a dark web search engine can itself be criminal infrastructure. It searched darknet market listings, and the US Internal Revenue Service calls it “a darknet search engine” run by Larry Dean Harmon. Harmon also ran Helix, a bitcoin mixer that processed at least about 354,468 bitcoin from 2014 to 2017. He was sentenced to three years in prison in November 2024.

Crawlers You Run Yourself

Some teams skip public engines and run their own crawler in an isolated environment. TorBot, an open-source dark web OSINT tool, was still being updated in October 2026, and Ahmia’s crawler code is public under a BSD license. OnionScan’s code last changed in February 2017 and Fresh Onions’ in July 2020, so check a tool’s age first. Our post on OSINT tools for the dark web shows how such tools are used.

Names From Older Lists

Older guides also name Not Evil, Candle, Tor66 and DeepSearch. We did not open them for this page and found no primary source on who runs them or whether they still work. Treat any ranking of them as unchecked.

What Is the Excavator Search Engine?

Many readers search for Excavator by name. Online guides describe it as a search engine for onion sites. This page cites no primary source on who runs it, when it started or what it filters.

Treat it as unverified and unfiltered, so results may include harmful material. We do not publish its address, because fake copies of onion search engines are common. If an analyst needs it, get the address from a source you trust and follow the safety steps below.

Excavator was not part of our test, because we found no clear-web interface for it. Some guides add details about who built it and how it works, but the ones we read cite nothing from its operators, so we leave those details out. If Excavator turns up your company’s name, treat it as a lead: save the result, check it against a second source and never log in anywhere it links to.

What Did Five Test Searches on Ahmia Return?

We ran five searches a defender might run, on Ahmia’s clear-web site, on 10 November 2026 at about 17:23 UTC. Each word matches a chapter of our Cybercrime Report 2026, so the results can be set beside Blackhole’s numbers. We read the results pages only and opened no onion page.

Ahmia lists every match on one page after it drops “very similar entries”. For each search we counted the matches, the different onion sites behind them and how recently Ahmia’s crawler had reached each page. We also read the top ten titles.

Three things stood out.

• The top results were mostly noise. Sales pages for ransomware “for hire”, keyword-stuffed spam and mirrored news filled most top-ten places. No top ten held a ransomware group’s leak site or an access offer, and the combolist threads were a few adverts repeated.
• Ahmia matches words, not phrases. Putting “data breach” in quotation marks returned the same 869 matches. Only 21 of them showed the phrase in the title or snippet, and only 10 of 1,491 did for “initial access”. Search single, distinctive words instead.
• Results were recent, but repeated. The oldest result had last been reached “1 week, 1 day” before our search, which suggests Ahmia drops pages it has not reached for some days. Many sites appeared more than once: 111 “ransomware” matches came from 54 sites.

Recent does not mean alive. In the 2025 Mimir study, researchers collected nearly 7,000 starting addresses, about 98% of them by querying Ahmia, Torch and VisiTor, and 83% could not be reached. They also found that about 82% of the landing pages they crawled were copies of other pages.

What Do Public Search Engines Miss?

A search engine indexes the web pages it can open without an account. Much of what defenders need is not there. Telegram channels are not onion pages at all, and forum threads behind a login or an invitation are closed to any crawler.

Brandefense Blackhole, our cybercrime database, watches more than 100,000 sources, including underground forums, Telegram channels, ransomware leak sites and stealer log markets. In the Cybercrime Report 2026, Telegram is the largest source: the collection behind six of its eight chapters is mostly Telegram. In the exploit chapter’s coded sample, Telegram supplied 63% of the posts and forums 33%.

Set our five searches beside Blackhole’s posts from 1 January to 27 October 2026, and both point the same way. Most text that mentions a threat is not the threat.

• Data breach. Ahmia’s top results were news stories. In Blackhole, 63% of about 9,400 posts that say “data breach” were news retellings, and only about one in five shared, sold or relayed data first-hand. See the data breach and leaks chapter.
• Stealer. Ahmia’s top results were spam. In Blackhole, 303,314 posts from January to April used the word, and 97.5% of them carried one brand’s automated notification template. The infostealer chapter explains the count, and our glossary defines stealer logs.
• Initial access. Ahmia showed no access offer at all. In Blackhole, real access offers made up 38.2% of posts under the “Initial Access Selling” label from January to August, and 4.9% from 12 September to 27 October. The initial access chapter and our initial access broker entry explain the trade.
• Ransomware. Ahmia’s top ten held no group leak site. Blackhole counted 9,203 leak-site claims, one per group and victim, from 177 groups, and 33 groups made 64.7% of them (ransomware chapter). Our guide to ransomware groups and how to monitor them covers the leak sites.
• Combolist. Ahmia’s top results were “HQ Fresh Combolist” threads. In Blackhole, reposted combolist texts said “fresh” 49% of the time, against 26% for texts seen only once, so the word tracks copied adverts, not new data. More in the stolen accounts chapter and our combolist explainer.

The units differ: Ahmia counts web pages and Blackhole counts collected posts. Blackhole has blind spots too, and the report says closed forums, brokers and Tor sites are barely covered in the collection behind its newer chapters. For the places these posts come from, see our guides to hacker and leak forums, darknet markets, Telegram leak channels and the dark web sites analysts watch.

Is It Safe to Use an Onion Search Engine?

The search page is the safe part. The risk starts when someone clicks a result. The 2024 study above found child sexual abuse material in the results of most engines it tested. That alone is reason to keep staff on the results page and off unfiltered engines.

The other risks are scams and malware. Onion addresses are long random strings, so a copy with one changed character looks like the real thing. Ahmia’s own pages carry a warning about fake clones, and in 2015 it published a list of hundreds of fraudulent copies of onion sites.

Why You Should Not Trust Lists of Dark Web Links

Search results for dark web links, onion links or deep web links are full of lists. Common tricks are:

• A clone of a market or search engine with one changed character in the address, built to steal logins and funds.
• A directory page that sends visitors to malware or scam sites.
• Fake “verified link” lists that sell the same worthless addresses.

Dead names get copied too. After Grams closed, scam versions reused the first characters of its address and appeared on link lists as if they were the original. If you need the address of a legitimate service, get it from that service’s own regular website.

Before an Analyst Opens an Onion Site

Most organizations should not send staff to browse these sites. If you research in house, set the rules first.

• Get written approvalLegal and management should agree on scope and purpose.
• Use an isolated machineA dedicated virtual machine or device, never a work laptop with company logins.
• Use no real identityNo personal accounts, no real names, no reused passwords.
• Never download or buyDo not open files from unknown sites. Do not pay for anything.
• Log what you seeSave notes and screenshots for the report, then close the session.

For most teams a monitoring service is the better route, because it collects the posts without anyone clicking. Our dark web monitoring tools comparison covers the options, and our guide on dark web access and whether it is legal covers the rules.

What Is the Hidden Wiki, and Is It a Search Engine?

No. The Hidden Wiki was a wiki on Tor that anyone could edit after signing up. Its main page was a directory of links to other onion sites, including illegal ones, and the earliest known mention dates from 2007.

Before August 2013 it was hosted on Freedom Hosting. In March 2014 its address was hacked and redirected, and during Operation Onymous in November 2014 it showed a message from law enforcement.

Today there is no single official Hidden Wiki. Many copies exist at different addresses, some kept up for access and some set up to filter out the worst links. Anyone can copy one. Treat any Hidden Wiki as a list of unverified claims, not a safe starting point.

Which Browsers Open Onion Sites?

A search engine finds onion pages; a browser opens them. Ordinary browsers cannot resolve .onion addresses, because these services sit outside the normal name system.

• Tor Browser is the standard tool. It is built on Firefox ESR, and version 16.0 moved to Firefox ESR 153.
• Onion Browser is the iPhone app the Tor Project recommends, since there is no Tor Browser for iOS. The Tor Project notes that Apple’s WebKit rule stops it from matching Tor Browser’s privacy protections.
• I2P is a separate anonymous network with its own sites, whose names end in .i2p.
• Hyphanet is a peer-to-peer network for files and sites. It is the original Freenet, renamed in June 2023.
• ZeroNet has had no new code since January 2021. Older articles still list it; we do not advise using it.

How Should a Security Team Use a Tor Search Engine?

1. Start on a filtered engine’s clear-web page. Ahmia’s results page shows titles, snippets and last-seen times without Tor and without opening any onion page.
2. Search single, distinctive words. Your brand, main domains, product names and internal project names work better than phrases, because Ahmia matches words, not phrases.
3. Read, do not click. Record the title, snippet, date and query in your case notes. Treat claim words such as “fresh”, “private” and “valid” as advertising.
4. Confirm before you act. Check a hit against a second source, such as your own sign-in logs, before you open an incident.
5. Cover what search cannot. Telegram and closed forums need collection, not search. Our glossary explains how dark web monitoring works. A free dark web check on Atlas shows what is said about your brand.

If a search turns up something you cannot judge, our dark web investigations team can take the lead further, and Cyber Threat Intelligence puts it in context. Request a demo to see what Blackhole holds about your organization.