Dark web · guide

Deep web vs dark web, and which one you are in now

By Alberto Gulotta · Updated 23 September 2026 · 17 min read

Deep web vs dark web is one question with two answers that are not close to each other. The deep web is every page a search engine does not hold — your webmail, your bank, your employer’s intranet. The dark web is a network you have to install software to reach, and you are not in it by accident.

Which one are you in right now?

Almost certainly the deep web, and it is not a dramatic place to be. What is the deep web, in one sentence: every page a search engine does not hold in its index. Every page that asked you to sign in today was in it. The word describes a property of an index, not of a page — nothing has been hidden and nothing is suspicious. It is simply not in the list.

What makes a page deep: three ways out of an index

This is where most short explanations go wrong, and it is checkable against the documentation of the company that runs the index. There are three common ways a page stays out of Google, and they do not have the same effect. A rule in a file called robots.txt asks crawlers not to fetch the page: Google’s own guide says that file “is used mainly to avoid overloading your site with requests; it is not a mechanism for keeping a web page out of Google”, and that a page blocked that way can still have its address listed, only “the search result won’t have a description”.

The two that do work are a noindex rule and a password. Of the first, Google writes that when its crawler sees the rule it “will drop that page entirely from Google Search results, regardless of whether other sites link to it” — with a catch worth knowing, because it is the commonest mistake in this area: “for the noindex rule to be effective, the page or resource must not be blocked by a robots.txt file”. Block the crawler and it never reads the instruction telling it to forget you. The second, a password, is the one almost everybody reading this is behind right now.

So the deep web is three arrangements with different consequences, and only one of them — the sign-in — is what people picture. For the neighbouring confusion, what the padlock in the address bar does and does not promise.

What makes a network dark: onion services

What is the dark web, then? Not a deeper layer of the same web: a different network laid over the ordinary one. The Tor Project — which builds it — defines the pieces without any drama: “Onion services are services that can only be accessed over Tor.” They use “the special-use top level domain (TLD) .onion (instead of .com, .net, .org, etc.)”, and your browser cannot resolve one of those addresses, because there is nothing in the ordinary internet’s address system to resolve it against.

Three properties follow, and they explain most of what looks strange about the place. First, there is no server address to find: “Onion services are an overlay network on top of TCP/IP, so in some sense IP addresses are not even meaningful to Onion Services: they are not even used in the protocol.” Second, the address is not a name somebody chose — it “looks weird and random because it’s the identity public key of the Onion Service”. Third, the connection is encrypted the whole way: “Onion service traffic is encrypted from the client to the onion host. This is like getting strong SSL/HTTPS for free.”

It is worth saying what these services are, because the word suggests a high street of shops and the documentation describes something else. The Tor Project’s own list: “metadata-free chat and file sharing, safer interaction between journalists and their sources like with SecureDrop or OnionShare, safer software updates, and more secure ways to reach popular websites like Facebook”. A software update service has an onion address for the same reason a newspaper does: so that using it reveals nothing. For the software itself, whether Tor Browser is safe, and safe from whom, and bridges for what happens when a network blocks it.

How big is each one, and who counted

Here is the part that is usually asserted and almost never sourced. The famous figure — that the deep web is around 90% of the internet — has an ancestor worth meeting. In August 2001 the Journal of Electronic Publishing published a paper by Michael K. Bergman, “The Deep Web: Surfacing Hidden Value”, on data “collected between March 13 and 30, 2000”. Its headline finding was that “public information on the deep Web is currently 400 to 550 times larger than the commonly defined World Wide Web”, with “7,500 terabytes of information compared to nineteen terabytes” on the surface, across “more than 200,000 deep Web sites”.

Three things about that paper change how the number should be read. It was measuring searchable databases, not pages behind passwords: “Deep Web sources store their content in searchable databases that only produce results dynamically in response to a direct request.” It described a deep web that was mostly open — “a full ninety-five per cent” of it “publicly accessible information — not subject to fees or subscriptions”, which is the reverse of today’s definition. And it was a marketing document, something the journal said in its own introduction: it is “designed as a marketing tool” for a product, and the editors ran it anyway because of what it showed about the structure of the web. None of that makes it worthless: it makes it a twenty-five-year-old measurement of a different thing, which is not what a round number in a bullet list suggests.

The other side has a number that is neither old nor anonymous, and it is published every day by the people who run the network. Tor Metrics puts out a file counting “the number of unique .onion addresses for version 3 onion services in the network per day”, extrapolated “from aggregated statistics on unique version 3 .onion addresses reported by single relays acting as onion-service directories”. Read from that file on 23 September 2026, the twenty-eight days ending 20 September carry between 620,821 and 711,536 a day, averaging 672,540; the last day in the file, 20 September 2026, is 620,821. Those are addresses rather than sites, one service can hold several, and the publisher labels the figure an estimate — but it has a source, a method and a date, which is three more than the percentages have.

Is any of this illegal?

No legal advice here, and none of the sources read for this page gives any. What they do show is that the technology is documented in public by the organisation that builds it, that its worked example is a newspaper receiving anonymous tips, and that its listed uses include software updates and reaching Facebook. A network is not a crime and neither is a word; what happens on it is a separate question, and it is not this page’s.

The practical version of the question is usually different anyway, and it has a page already: if something has written to tell you your information was found somewhere, start at what a data breach means and what to do in the first hour, and if somebody is already using the details, identity theft has deadlines attached to it.

Not covered here. It publishes no addresses. No .onion links, no directories, no mirrors, not as illustration and not as curiosity — the Tor Project’s own protocol page prints an example address and it has deliberately not been copied across.

It does not explain how to get there, which is what most of the better-known writing on these two words spends its second half doing. Explaining how a mechanism works is one thing; a set of steps is another, and this is not the page for it.

It does not say how dangerous the place is, either. That is a different question with a different set of answers, it will get its own page, and answering it in passing here would mean repeating what the monitoring industry says about the product it sells.

And it does not sell anything. Twelve pages about these two words were read while writing this one, leaving aside the documentation and the 2001 paper, and ten of the twelve carry an offer — monitoring, a free trial or a demo. One of the remaining two is a university selling degrees in the subject. There is nothing here to buy, no subscription recommended, and no commission earned by anybody from a word of it. What holds instead is simple: every number on this page names who counted it, and when.