What is the deep web?
Definition
The deep web is the part of the internet that search engines do not index and that you normally reach with a login or credentials, such as an online bank account or an internal company system. It is not the same as the dark web.
- Category
- Privacy
- Also called
- hidden web, invisible web
- Last updated
Most of what you do online sits on the deep web, and most of it is ordinary. In CISA's description, the deep web is content that search engines like Google do not index and that needs credentials or special access to reach. Its examples include an agency's internal SharePoint site and a bank account portal.
Your webmail inbox, your medical portal, your cloud documents and your online banking all fit that description. Nobody hid them. They are simply behind a login, so a search engine cannot list them.
Deep web vs. dark web vs. surface web
CISA separates three layers:
- Surface web: pages Google indexes and anyone can open without special access.
- Deep web: pages and services behind logins or other access controls, not indexed by search engines.
- Dark web: a small part that needs special software such as Tor and uses .onion addresses.
People mix up the deep and dark web all the time, and that is why the deep web sounds sinister. It is not. The dark web is the layer where stolen data can be traded. For that, see our entry on the dark web.
Why it matters to you
The deep web is where your most sensitive accounts live, so it is where account takeover hurts. If someone gets your password for an account behind a login, the search engine's blindness does not protect you. The login is the only barrier.
It also helps to know what the deep web is not: it is not a place your data gets listed for strangers to read. Pages that expose your details publicly, such as people-search profiles, are on the surface web, and that is the layer where removal requests work.
How to protect yourself
- 1
Use a unique password for each account
A login is the only thing guarding deep web content. A password manager makes unique passwords practical.
- 2
Turn on two-step verification
Add it to email, banking and cloud storage first. These accounts can reset the others.
- 3
Check what is exposed on the surface web
Search your name and see what strangers can read. Serus finds where your address and phone number are listed and removes them. See our data broker guides for the manual route.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is the deep web illegal?
No. It covers any content behind a login or otherwise not indexed by search engines, including your email and online banking. Illegal activity is associated with parts of the dark web, which is a separate and much smaller layer.
Do I need special software to use the deep web?
No. You use it every day with a normal browser whenever you sign in to something. Special software such as Tor is what the dark web needs.
Is my email part of the deep web?
Yes. Webmail sits behind a login and search engines do not index it, which matches CISA's description of the deep web.
Sources
Something wrong or out of date? Tell us and we'll re-check it.