Dark Web Search Engines – How Deep Web Search Engines Work

Type a word into Google and you’re searching an index of hundreds of billions of pages. Type the same word into a dark web search engine and you’re looking at something akin to a village library with half the shelves roped off. Tor Metrics reported approximately 665,000 unique onion addresses per day in the month ending 9 October 2026. A 2025 study which aggregated the results of six of the major onion search engines and repositories yielded around 36,000 addresses in a single day.

Put simply, a dark web search engine is a website that crawls onion services, stores what it finds and lets you search it by keyword, much like an ordinary search engine. Most can only be reached through Tor, a few also have a normal web version, and they differ enormously in how they handle illegal content, scam sites and your privacy. Using one is legal in most countries. What you click on afterwards is a separate question.

That gap is the first thing to appreciate when you’re looking at a dark web search engine. None of them sees the entire network. The ones that boast the largest indexes aren’t necessarily the ones that will show you the most real, working sites. Every engine is shaped by what it chooses to exclude and by who makes that decision.

This is a roundup of the engines that are still worth knowing about in 2026 (Ahmia, Torch, Haystak, OnionLand, Tor66, Excavator, and the DuckDuckGo onion service that most people assume is one). For each, we look at what it filters, how it deals with scams and how far you can trust the results. Then we get to the part most roundups skip, which is the role search results play in dark web phishing. If you’re new to the subject, start with our guide to what the dark web is.

The index problem nobody mentions

Google discovers new sites because the web runs on public links and a public domain system. Onion services have neither. Since the move to v3 addresses in 2021, an onion address cannot be harvested from the network at all. It’s known only to the owner unless the owner chooses to publish it. A dark web search engine can therefore only index what someone has posted somewhere and what its crawler can reach from there.

There’s no domain registrar and no public phone book of onion sites to start from. According to the Tor Project’s own support pages, an onion address is 56 letters and numbers followed by .onion, and just like any other website you need to know it before you can connect. That’s also what separates the dark web from the much larger deep web people often confuse it with. Your inbox, your bank account and a company intranet are part of the deep web because they sit behind a login, not because they’re hidden on an anonymity network. Our breakdown of which layers of the web are real clears up the difference.

In practice, engines collect addresses in a few ways. Crawlers start from seed lists of known directories, forums and other indexes, then follow every link they find, so a site nobody links to can stay invisible indefinitely. Some engines also accept submissions, and Ahmia has a public form for operators to add their own address. Then there’s the churn. Onion sites go offline, move and reappear far more often than normal websites, so a result that worked last month may be dead today, and a dead result is often replaced by an imitation.

In 2025 two researchers at Johannes Kepler University in Austria (Tobias Höller and René Mayrhofer) went to the trouble of measuring exactly how much that limits things. Their paper, Evaluating Onion Address Collection Methods, pulled every address they could from six onion search engines and repositories in March and April 2025.

Put that in the context of the Tor Project’s own estimate of some 800,000 onion services at the time the paper was written, and the six engines together would be seeing some 4 to 5% of them. Not all of the other 95% are hidden websites simply waiting to be found, and that’s the second surprise in the data.

A significant proportion of onion addresses are not actually websites. The same study found that over 14,000 Bitcoin nodes (around two thirds of the entire Bitcoin network) currently operate as onion services. Messaging apps such as Briar and Cwtch have onion addresses which are deliberately not made public. Search engines crawl web pages, so they skip all of that by design.

The third limit is intentional. Ahmia publishes a list of over 46,000 hashed addresses which it will not index. When the researchers ran Ahmia’s own crawler for 20 days in April 2024 without that blocklist, they ended up with 48,745 addresses, and 11,809 of those (around 24%) were on the list. A filtered engine is not simply a smaller version of an unfiltered engine. It is a different map.

The final finding should change the way you interpret any search result. When the researchers cross-referenced the addresses from the onion search engines against a full year’s worth of data from 50 relays within the Tor directory system, only around 65% showed any sign of being in use. The authors point out that some of the difference is simply due to timing (newly created services won’t be in the earlier data). Even so, around a third of what the search engines returned couldn’t be verified as live.

The practical result is simple. A search that comes up blank on the dark web tells you very little. And no engine, however large its index, is showing you the whole dark web. Each one shows you only the publicly accessible, crawler-reachable portion it has chosen to keep. For the big picture of how much is actually out there, see our dark web statistics.

The engines at a glance

The biggest actual difference between the engines is their editorial policy rather than their technology. Some filter out abuse material and known scams, some just flag content as risky, and some index everything their crawler comes across.

A couple of other kinds of tool get lumped in with these. Link directories and “hidden wiki” pages are hand-made lists of onion links grouped by category. They’re often out of date, and many of them are run by scammers who swap genuine addresses for fake ones. The other is an ordinary search engine used through Tor, like the DuckDuckGo row above. It hides who is searching, but it still searches the regular web, so it won’t surface onion services.

Two names from older lists have been left out on purpose. Not Evil (a favourite of guides from 2018) went offline in 2024 according to threat intelligence firm SOCRadar, and anything using that name now is likely to be an impersonator. Deep Search still shows up in link lists, but the same review documents it promoting scam sites, so it’s something to recognise rather than use.

Engine by engine

Ahmia, the one that tells you what it hides

Ahmia was created by Finnish security researcher Juha Nurmi during Google Summer of Code in 2014, with support from the Tor Project, and it remains open source. According to Ahmia’s about page, the code is split into three public parts on GitHub (an onion crawler, an Elasticsearch index and the search website), so anyone can read how it crawls and filters instead of taking the operator’s word for it. The crawler adheres to robots.txt, so a site can opt out of being indexed, and it publishes the list of onion services it has banned as hashes. That level of transparency is the exception rather than the rule. Most engines either filter silently or don’t filter at all.

In the Austrian study Ahmia was the biggest single source, and its address list ranged between 18,000 and 22,000 entries across a single week in April 2025. The number fluctuates because Ahmia drops sites when they go offline, which keeps the index fresh but means the count falls on a bad day. Ahmia also makes its list of addresses public, and other researchers use it as the basis for their own crawlers. A huge amount of the academic view of the dark web is effectively filtered through Ahmia.

One practical note. Ahmia has a clearnet site at ahmia.fi as well as an onion address. The clearnet version lets you see what the engine is like without installing anything, but you lose the anonymity of Tor while using it, and your internet provider can see you were looking up onion services. Open it in Tor Browser instead. Ahmia’s about page also warns that fake clones of Ahmia itself exist, which tells you how common impersonation is in this space. Our step-by-step guide to using Ahmia covers the setup.

Torch, the oldest and the most copied

Torch has been crawling onion services since the early 2010s (longer than almost anything else that’s still running). It does no filtering, it says it keeps no logs and it carries banner advertising. It’s often described as having indexed a billion pages, but that figure comes from Torch itself and has never been independently verified. On a network of a few hundred thousand onion addresses, that’s at best a measure of sheer crawl volume.

The Austrian researchers found something more useful. They took 4,190 addresses from Torch (the lowest of the six sources). They also observed that most of the links claiming to be Torch were actually malicious clones designed to redirect users to scam sites. One of the clones they tested returned fewer than 150 addresses, and the vast majority of those weren’t present in the real Torch results. So it wasn’t a broken copy of the index at all. It was a list chosen by whoever ran the clone. More in our Torch search engine review.

One more source of confusion. Torch the search engine has nothing to do with Torch Browser, an unrelated Chromium-based browser that stopped receiving updates years ago and shouldn’t be downloaded today. Torch is mostly useful to researchers who specifically want an unfiltered view and understand what that means. For anyone who’s simply curious, the lack of filtering works against you.

Torch vs Ahmia at a glance

Haystak, the paywalled index

Haystak markets itself on the size of its database, claiming over 1.5 billion pages across more than 260,000 onion sites. The free version is a normal keyword search with no default filtering. The paid version (priced in Bitcoin) adds historical snapshots of pages, email alerts for new matches and a range of advanced search operators. The historical snapshots are the real value proposition, as onion sites go up and down all the time and a cached copy can be the only record you have of a site. The 260,000 figure is larger than the total number of addresses the researchers could find in any one of the search sources they used, and no one else has independently verified it.

OnionLand, Tor66 and VormWeb, the directory hybrids

These three do a mix of search and directory. OnionLand indexes I2P sites as well as Tor and will tell you whether a link is currently online, which saves a lot of dead clicks. It was also a bit inconsistent in the study, publishing a list of 4,316 addresses while its search results pointed to at least 7,161. Reviewers keep highlighting the number of scam pages in its results.

Tor66 sorts results by category and language, takes user submissions and runs a feed of newly discovered onions. User submissions pick up sites the crawlers simply don’t find, but they also allow anyone to submit a phishing link, so the quality varies from category to category. VormWeb (launched in Germany in November 2020) rates each result as secure, moderate or risky and doesn’t use any JavaScript. The ratings are of some use, but risky results are still displayed.

Excavator, the JavaScript-free option

Excavator came out in 2019 and runs completely without JavaScript (which removes one of the primary methods a site can use to fingerprint or deanonymise a user). It’s focused on new links rather than a deep archive. It applies no filtering whatsoever, and SOCRadar cites user reports of its paid ad space being used to promote abusive content. It’s a tool for the more experienced researcher with a good reason to use it rather than one for general browsing.

DuckDuckGo onion, the one that isn’t

DuckDuckGo is the default search engine in Tor Browser and has its own onion address (so it appears on all these lists). It searches the normal web privately. It doesn’t index onion services in any meaningful way. A 2024 research project gathered 80,049 onion addresses and found only 759 of them via DuckDuckGo. The Austrian team found that a DuckDuckGo search for onion addresses returned nothing at all. It’s a good search engine to use within Tor. It is not a dark web search engine.

The quiet contributors

Two names you don’t often see in roundups actually did better than Torch in the 2025 study. FreshOnions (an onion-only repository) provided 11,537 addresses, and Dargle (a clearnet catalogue) provided 7,254. Neither has a particularly polished search interface, but they do show that the engines with the most marketing behind them aren’t necessarily the ones with the broadest reach.

The real risk is the copy, not the content

Most of the safety advice you’ll find about dark web search engines is about the risk of ending up on illegal content. That’s a genuine risk, and a filtered engine such as Ahmia goes some way to reducing it. The more likely way people get into trouble is far more subtle. They’re looking for a forum, a market or even a search engine, they click on the top result, and they end up on a very convincing fake run by someone who wants their username and password, their deposit or their attention.

The figures on this have been consistent for a decade.

• 2014. After police seized hundreds of onion addresses in Operation Onymous, security researcher Nik Cubrilovic went through the list and found that 153 of the 276 addresses seized were clones, scams or phishing sites. In a number of instances the fake was taken down while the legitimate site remained live.
• 2019. Researchers at KAIST in South Korea looked at 28,928 onion services hosting 21 million pages and identified 901 phishing domains. They also found that people tend to remember only the readable portion of an onion address, and that phishers take advantage of this by creating lookalike addresses which share the same opening characters.
• 2020. A study by Barr-Smith and Wright of 11,533 onion services found that only around 34% were unique. Approximately 45% were imitations (either duplicates or clones), and the remaining 21% were default server pages.
• 2026. Oasis Security tracked a single PhishPage v2.1 phishing control panel that was running six fake onion addresses at once, posing as the Dread forum and several markets, including Torzon.

Search engines are right in the middle of this. A v3 onion address is 56 random-looking characters, so very few people actually read it in full. Some engines sell ad space or top positions, and unfiltered engines index whatever their crawler finds (clones included). The Austrian study did find that search engines tend to suppress results that lead to identical pages, which removes some exact copies. The clones that get through are the ones that are different enough.

The Torch example from the earlier section is the most telling one. If the search engine itself is a fake, then every result it returns is selected by whoever runs it. That’s a far greater risk than any one bad link, because it looks exactly like legitimate research. If you’re looking for a particular market or forum, our tracker of dark web marketplaces in 2026 explains why so many of those names are already scams or have been seized.

The other risks behind the results

The search engine itself is rarely the dangerous part. The risk sits in what the results point to.

• Illegal content. In many countries, viewing or downloading certain material is a crime in itself, whether or not you meant to find it. Unfiltered engines make an accidental click more likely.
• Malware and downloads. Files from onion sites can carry malware just like files anywhere else, and opening a document outside Tor Browser can reveal your real IP address.
• Scams. Many onion “shops” and “services” exist only to take payment and deliver nothing.

Legally, using a search engine to read or research is treated very differently from buying, selling or downloading illegal material. Our guide on whether the dark web is illegal explains where ordinary users actually cross the line.

How to choose one and search without getting burned

Pick the engine for the job rather than looking for a single best one.

• For a safe default, I’d go with Ahmia. It filters, it tells you what it’s filtering, and it’s the easiest to justify if you’re doing this for work.
• For breadth, run the same query on one filtered and one unfiltered engine and compare the two lists. The difference is exactly what the filter is removing, and that’s often the most useful bit of information.
• For history, Haystak’s paid snapshots are the only easy way to see a page that has since gone.
• For checking a link, OnionLand’s online and offline indicator is a timesaver before you even open anything.

How you get to the engine is just as important as which engine you pick.

1. Get Tor Browser only from the official Tor Project website. Fake “Tor” apps and bundles are a common way to spread malware. Our Tor Browser review and install guide shows how to install and verify it.
2. Get the address from the operator, not from a list. Ahmia publishes its own onion address on its clearnet site. Many legitimate services do the same or sign their address with a PGP key. The clones spread through random link directories and forum posts.
3. Bookmark it once you’ve checked it’s the right one. After that, use the bookmark and never a search result to get back to it.
4. Compare the full 56 characters. Phishers copy the readable bit at the start of the address. The difference is generally in the middle or at the end.
5. Raise Tor Browser’s security level. The “Safest” setting disables JavaScript on all sites, which stops most fingerprinting and a whole host of exploits. Our guide on how to access the dark web safely goes into the settings in detail, and the Tor Project’s own manual explains each level.
6. Don’t download or open files. If you really must, never open them while connected to the internet outside Tor Browser.
7. Never log in or pay through a link you’ve just come across. If a site asks for a deposit or a password on your first visit, assume it’s a copy. Never enter real personal details either, which means no real name, everyday email address or reused password.
8. Close and leave anything that looks illegal. If you come across child sexual abuse material, report it to a hotline such as the NCMEC CyberTipline in the US or the Internet Watch Foundation in the UK, and don’t save or share it.

Do you need a dark web search engine at all?

For most people the honest answer is no. The most common reason ordinary users want to look at the dark web is to find out whether their own email address, passwords or personal details have leaked, and a search engine is the wrong tool for that. Stolen data is usually traded in closed forums, private channels and paid databases that onion search engines don’t index, and visiting those places yourself is risky and pointless. Remember the index problem too. An empty result doesn’t mean the information you’re looking for isn’t out there.

A breach-checking service does that job far better. Our free dark web scan checks whether your email appears in known breaches without you going anywhere near Tor. If you’ve already had an alert, our dark web alert wizard builds a step-by-step checklist, and our guide on what to do if your details have been compromised walks you through the next steps.

Dark web search engines are tools, and like any tool they reflect the choices of the people who build them. An open, filtered engine such as Ahmia is a reasonable way to see what the onion network actually contains. An unfiltered one such as Torch shows you more, including much you’d rather not have seen. Either way, the search box is the safest part of the trip. The care you take with each result is what keeps you out of trouble.

The information in this article is general and should not be taken as legal or security advice. Laws vary from country to country and change over time, so check the rules where you live before using Tor or any dark web service.

Sources

• Höller and Mayrhofer, Evaluating Onion Address Collection Methods (FOCI 2025)
• Tor Metrics summary, onion addresses and users (October 2026)
• Ahmia banned onion services list
• SOCRadar, Top 10 Dark Web Search Engines in 2026
• DeepStrike, Torch Search Engine review
• DeepStrike, Haystak Search Engine review
• TechCrunch on Operation Onymous clone sites
• Yoon et al., Doppelgängers on the Dark Web (KAIST, 2019)
• Pastor-Galindo et al., Big Data architecture for dark web sites (2024), citing Barr-Smith and Wright
• Oasis Security, PhishPage v2.1 analysis
• Tor Project support, onion services
• Tor Project, how onion services work
• Ahmia, about the project, blocklist and clone warning
• Ahmia source code on GitHub
• NCMEC CyberTipline
• Internet Watch Foundation, report