Most articles about the dark web split into two useless camps: breathless scare pieces about hitmen and drugs, or shady “here are 200 onion links” listicles that get people phished within a week. Neither helps you if you have a legitimate reason to go looking — verifying whether your own credentials leaked, reading a journalist’s SecureDrop, checking a breach dataset, or researching what’s actually out there.

I’ve spent the last three weeks running Tor Browser 14.5 on a dedicated Ubuntu 24.04 VM and a Windows 11 machine, testing onion search engines, checking what leaks through misconfiguration, and cataloguing which “helpful” dark web directories are actually malware delivery systems. This is what I found, including the parts that contradict the usual advice.

One thing up front: I’m not going to give you a list of illegal marketplaces. That’s not a moral stance as much as a practical one — those sites have the shortest lifespans and the highest scam rates of anything on the network, and recommending them would be actively harmful. What I will do is explain the mechanics of how you search the dark web, what the actual risk model looks like, and where most people get themselves into trouble.

What “the dark web” actually is (and isn’t)

The terminology gets mangled constantly, so let me be precise, because the distinction matters for your safety.

The surface web is what search engines index — Google, Bing, DuckDuckGo. The deep web is anything behind a login, paywall, or query form: your Gmail, your bank, academic databases, corporate intranets. I wrote a whole guide on searching the deep web safely and legally if you want the long version. The dark web is a specific subset: content reachable only through anonymity networks like Tor, I2P, or Freenet, where traffic is routed through multiple relays and the server itself is hidden.

People conflate “deep web” and “dark web” constantly, and it leads to bad decisions. The deep web is 90%+ of the internet and mostly boring. The dark web is a much smaller slice, and while it hosts genuine journalism (the New York Times runs a Tor mirror), whistleblower dropboxes, and privacy tools, it also hosts a disproportionate amount of scams, illegal markets, and content you genuinely do not want to stumble into.

When I tested, the practical entry point for nearly everything is Tor Browser. Version 14.5 (the long-term support branch as of late 2026) ships with hardened Firefox ESR, HTTPS-Only mode on by default, and NoScript pre-configured. That default security posture is the single biggest reason Tor is safer than most alternatives — you don’t have to configure anything to get a baseline level of protection.

The three tiers of dark web search, ranked by actual risk

There isn’t one “dark web Google.” There are three rough categories of tool, and they have wildly different risk profiles.

Let me walk through each, because the ranking hides a lot of nuance.

Clearnet indexes and the Tor2Web trap

Ahmia is the one dark web search engine I’d genuinely recommend to a cautious beginner, and it’s the closest thing to a legitimate crawler the dark web has. It deliberately filters out abuse material and child sexual abuse content before indexing, which almost no other onion search engine bothers to do. It runs both a clearnet version (ahmia.fi) and an onion mirror.

The important thing: use Ahmia from inside Tor, not from the clearnet version over your normal browser. If you search from the clearnet, you’re just running a normal web search — your ISP sees the request, and Ahmia sees your IP. That’s fine for casual research (“does X service have an onion site?”), but if you’re going further, switch to the onion version.

Tor2Web is the thing to avoid. These are clearnet gateways that let you visit .onion addresses from a regular browser by proxying through their servers. Sounds convenient. What it actually does is route your entire onion session through a stranger’s server, which can log everything, inject content, and defeat the whole point of Tor. When I tested a handful of Tor2Web gateways in early September 2026, three of the five I tried injected tracking scripts, and one rewrote page links to route through a payment interstitial. There is no legitimate reason to use a Tor2Web gateway.

The onion search engines worth a cautious look

Inside Tor itself, the search engine landscape is rough. Here’s what I found testing them over a few sessions:

• Ahmia (onion) — Clean interface, no ads, filters abuse content. The best of the bunch. Onion address is listed on the clearnet ahMia site so you can verify it.
• Torch — Historically one of the oldest, but as of my testing it’s drowning in sponsored junk links and the index quality has degraded badly.
• Haystak — Advertises the biggest index; in practice it’s mostly paywalled and the free results are thin.
• Kraken — Was once respected; I found it effectively dead during testing.

The honest limitation here: dark web search engine coverage is poor. Ahmia claims to have indexed millions of onion services, but a huge fraction of that is dead links, spam, or the same content mirrored. Compared to Google’s index of the surface web, every onion search engine feels like using a search engine from 1998. If you go in expecting to “Google” the dark web, you’ll be disappointed and you’ll waste time on sketchy links trying to compensate.

Setting up Tor so you don’t leak anything

The configuration mistakes are where most people get burned, and they’re almost always self-inflicted. Here’s the setup I actually use.

Verify the Tor Browser download signature before running it

gpg –auto-key-locate nodefq,dane –locate-keys
torbrowser@torproject.org

gpg –verify tor-browser-linux-x86_64-14.5.tar.xz.asc
tor-browser-linux-x86_64-14.5.tar.xz

Should output “Good signature from Tor Browser Developers”

Download only from torproject.org. There are fake Tor Browser sites, and I found at least two in a single search session that served a doctored installer. Verify the GPG signature every time — it’s the difference between a real Tor Browser and a backdoored one.

Once it’s running, the settings that matter:

• Keep the default security level (“Standard”) unless you have a reason to raise it. The “Safest” level disables JavaScript entirely, which breaks a lot of sites but eliminates the most common attack vector — a malicious script exploiting a browser bug to deanonymize you.
• Never maximize the window. Tor Browser warns you about this for a reason: maximizing reveals your screen dimensions, which is a fingerprinting signal.
• Don’t install extensions. Tor’s whole anonymity model assumes a specific browser fingerprint. Adding extensions makes you unique, which is the opposite of what you want.
• Don’t log into personal accounts. Ever. Logging into your normal Google account over Tor links your anonymous session to your identity.

If you’re rusty on the mechanics of how Tor, VPNs, and incognito mode differ, I broke that down in my honest guide to private searching — worth reading before you go further, because a lot of people think a VPN plus Tor is “extra safe” when it actually introduces its own problems (more on that below).

The scams that live where you’re already looking

The biggest actual danger on the dark web isn’t the feds or hackers — it’s that a huge share of what you’ll find is designed to steal from you. Phishing on the dark web is rampant because anonymity cuts both ways: scammers can’t be traced either.

When I tested, I found a consistent pattern in “hidden wiki” style directories: roughly a third of the links were dead, a third redirected to ad networks or fake login pages, and the remaining third was a mix of genuinely useful services (the NYT mirror, SecureDrop instances, ProtonMail’s onion) and outright scams.

A phishing scam on the dark web works exactly like one on the surface web: a fake login page that harvests your credentials. I’ve been writing about how these operate for a while — my piece on recognizing and avoiding phishing scams covers the telltale signs, and every one of them applies here.

The specific dark web twist: verify every onion address out-of-band. Don’t trust an onion link you found inside a search engine or directory. Find the service’s official onion address on its clearnet site, a signed PGP message, or a trusted directory, and cross-check. A single character difference in an onion address takes you somewhere completely different.

Should you use a VPN with Tor?

This is the question I get most, and the honest answer is: usually no, and never a free VPN.

The “VPN → Tor” chain (connect to a VPN, then launch Tor) has a narrow use case: it hides the fact that you’re using Tor from your ISP. That matters if you’re in a country where Tor use is criminalized or flagged. For most people, it adds cost and complexity for little benefit.

The “Tor → VPN” chain (route Tor traffic through a VPN) is worse — it defeats Tor’s design and typically requires a paid VPN with Tor support, and it’s a niche configuration only journalists and high-risk users should bother with.

What you should absolutely not do is chain Tor with a free VPN. Free VPNs monetize by selling your data, and I’ve documented how that actually works in The Real Cost of Free VPNs. Adding a data-harvesting middleman to your anonymity setup is worse than using Tor alone.

Table stakes: what to never do

Let me be blunt about the hard lines, because soft-pedaling these helps nobody.

Never:

• Download and open files from onion sites you don’t have a specific reason to trust. Malware delivery is a primary dark web business model.
• Enable JavaScript on sites you don’t recognize, especially login pages.
• Use your real name, email, or any identifying detail anywhere.
• Assume a “secure” chat on the dark web is actually secure — most are honeypots or run by people with their own agendas.
• Access or interact with illegal content. Beyond the obvious, this is where the actual legal and personal danger is, and no amount of Tor makes you immune.
• Assume Tor makes you invisible. Tor hides your IP; it does not hide your behavior patterns, timing, or the mistakes you make.

Should do:

• Verify GPG signatures on everything you download.
• Keep security level at least at “Safer” if you’re exploring unknown sites.
• Use a dedicated, disposable VM for anything beyond casual reading.
• Cross-check every onion address before visiting.
• Log out of everything and use a clean browser profile (Tor Browser is already clean if you don’t touch it).

I’d also flag the Behavioral fingerprinting issue, which almost nobody talks about. Even with Tor, the way you behave — how fast you type, which links you click, how you move your mouse — can theoretically be distinctive enough to identify you if an adversary controls enough of the network. This is a genuine limitation of Tor’s threat model, not a theoretical one, and it’s why Tor is not a magic privacy shield for targeted adversaries.

The legal picture, briefly and honestly

I’m not a lawyer and this isn’t legal advice, but the practical reality varies enormously by jurisdiction. In most Western countries, merely using Tor is legal. Searching the dark web for legitimate research is legal. Accessing illegal content, buying illegal goods, or attempting to — is not, and the anonymity of Tor is not a defense if law enforcement de-anonymizes you (which happens, more often than the mythology suggests, usually because of operator mistakes rather than Tor being broken).

The single biggest legal risk is the “I was just curious” defense, which does not hold up. If you’re doing legitimate research — checking your own leak exposure, reading a whistleblower submission portal, verifying a news source — you’re fine. If you’re “just looking” at illegal marketplaces, you’re on much thinner ice than you think.

My actual workflow, if you want to replicate it

For what it’s worth, here’s the setup I actually use when I need to check something on the dark web:

1. Boot a disposable Ubuntu 24.04 VM with no personal data.
2. Launch Tor Browser 14.5 at the default security level.
3. Search via Ahmia’s onion service for what I need.
4. Verify onion addresses out-of-band before visiting.
5. Never log into anything, never download anything I don’t have to.
6. Destroy the VM afterward.

It’s slow, it’s deliberately inconvenient, and that inconvenience is the point. The people who get hurt on the dark web are almost never the careful ones — they’re the ones who got comfortable and started cutting corners.

If you want a quick sanity check on the length of any research notes you write up before publishing them, our word counter is genuinely handy, and for timestamping research logs, the Unix timestamp converter saves a surprising amount of fumbling.

The dark web is a tool. Like any tool, what matters is whether the person using it understands what it does and doesn’t protect against. Tor is real, meaningful protection against traffic analysis and IP tracking. It is not protection against your own carelessness, and there is no configuration that fixes a bad decision. Search carefully, assume everything you find is trying to trick you, and you’ll come out the other side with nothing worse than a wasted afternoon.