What is the dark web? Definition and how it works

The dark web is the part of the internet you can only reach with special software, usually the Tor Browser. Its sites hide who runs them and who visits them. That's useful for journalists in censored countries. It's also where stolen logins and ID scans get traded.

You don't need to visit it to be affected by it. If your email showed up in a breach, there's a fair chance the password that went with it has been passed around there.

Dark web, deep web, surface web

People use "dark web" and "deep web" as if they meant the same thing. They don't, and the difference matters if you're trying to work out how worried to be.

Table: The three layers of the internet

You use the deep web every day. Your inbox isn't on Google, and it shouldn't be. The dark web is a much smaller corner built around anonymity.

Expand

How it works

Normally your browser connects straight to a website, and the site sees your IP address. On Tor (short for The Onion Router), your traffic takes a detour through three volunteer-run servers first. Your data is wrapped in layers of encryption, and each server peels off one layer. The first server knows who you are but not where you're going. The last one knows where you're going but not who you are.

That's it. Sites on the dark web use the same system to hide where they're hosted, which is why their addresses end in .onion and look like random strings.

Tor isn't the only network (I2P and Freenet work on similar ideas), but it's the one most people mean. And it's not the same as your browser's private window: incognito mode only stops your own device from saving history. Here's what incognito mode does and doesn't hide.

Is the dark web illegal?

No. Downloading the Tor Browser is legal in most countries, and plenty of mainstream sites, including the BBC and Facebook, run .onion versions for readers in places that block them.

What's illegal is a lot of what's sold there. Buying stolen data is a crime whatever browser you use.

What gets sold there

The trade that affects ordinary people is in personal data, mostly from breaches and from malware that steals saved passwords off infected computers:

• Email and password pairs, often in lists of millions
• Card numbers and bank logins
• Names with home addresses and dates of birth
• Scanned passports, driving licences and selfies holding ID
• Medical and insurance records

Most of it is cheap because there's so much of it. Sellers make their money on volume, and a single stolen login is rarely worth much on its own. Scanned ID documents cost more, because they open bank accounts.

A free first check: Have I Been Pwned shows whether your email appears in known breaches.

Should you visit it?

There's no good reason for most people to. You won't find your own stolen data by browsing, and the risks are real. There are no safe-browsing warnings, downloads often carry malware, and on some marketplaces even looking around can get you into legal trouble.

Police do shut markets down

The dark web hides people, but it isn't lawless. In April 2022, German and US authorities shut down Hydra Market, then the largest dark web marketplace in the world. A year later, the FBI and its partners seized Genesis Market, which sold logins stolen from infected computers. New markets keep appearing, which is why changing your passwords matters more than any single takedown.

What to do if your data is on the dark web

Start with the account that controls the others: your email. If someone gets into that, they can reset everything else.

1. Change the password on your email, then on your bank and any account that used the same password. A password manager makes every password unique, so one leak stays one leak.
2. Turn on multi-factor authentication (a code from an app or text on top of your password). A stolen password alone then isn't enough.
3. If card or ID details leaked, check your statements and place a credit freeze. It's free in the US and stops new accounts being opened in your name.
4. Run a full anti-malware scan if you think the leak came from your own computer. Password-stealing malware is the source of a lot of these lists.
5. Sign out of every session in your Google and Apple settings. Remove apps you no longer use.

If it's your email that turned up, here's what happens when your email is on the dark web.

Where Serus fits

Data on the dark web can't be taken down. Once a list is copied, it's out there, and anyone who tells you otherwise is selling something.

What you can do is find out early. Serus monitors the dark web and breach databases for your email, passwords and other personal data. When something turns up, you get an alert and a short list of what to change. For teams, Serus for Business does the same for executives and staff.

Run a free scan to see where you stand.