The dark web has transformed into a platform that demands maximum security. This is due to the security issues it poses that can impact business, governments, and even ordinary people. It is currently the home for illicit activities where people can carry out illegal deals like drug & weapon purchases, selling of data and information, and other cybercriminal activities.
It is a place many people don’t fully understand, but most of us know it as a dangerous place that everyone should avoid, especially if you want to stay safe online. Particularly because the statistical data for 2026 show that this layer of the net is a significant threat to individuals, organizations, businesses, as well as consumers.
This list of dark web statistics for 2026 collects around 60 figures across 6 main categories, sourced to primary research and official releases wherever one exists — and flagged where one doesn’t: size of the dark web, number of .onion sites, marketplace activity, volume of breach data, user demographics, and law enforcement activity. Without further delay, let’s get started!
The Layers of the Internet: Surface, Deep & Dark Web
The Surface Web is a part of the internet that involves browsing with standard browsers like Google, Bing, YouTube, Safari, and many more. In general, we use it for our everyday activities like social networking and reading news. It is referred to as the Common Web, and it is remarkably a small part of what is really out there on the internet.
On the other hand, The Deep Web is vast, covering about 90-96% of the entire internet. The Deep Web is any aspect of the internet that search engines never index. These include bank websites, medical records, government websites, corporate email accounts, intranets, and more. It requires users to log in to access its contents. Because it’s not indexed by search engines, its content cannot be seen or accessed by standard browsers like Google, Bing, Yahoo, etc.
The dark web is a small portion of the internet that is intentionally hidden in the Deep Web. Its contents are not indexed by search engines, nor can they be accessed with standard browsers. It however, requires special software, such as the Tor browser, to access. Instead of using conventional domains like .com and .org, the dark web uses the .onion URL. Our guide to the deep web versus the dark web breaks down the differences in full.
The Tor network is incredibly difficult to detect and anonymizes users by relaying encrypted communications over a global chain of servers run by volunteers. However, it’s crucial to remember that the Dark Web is just a tool that may be used for a variety of purposes, both good and bad, and is neither intrinsically hazardous nor unlawful.
Dark Web Statistics: Size of the Dark Web in 2026
One distinction underpins everything below, and almost every statistics page gets it wrong. Tor users and dark web users are not the same population. Research presented at the Privacy Enhancing Technologies Symposium found that only around 3 to 7% of Tor traffic ever reaches an onion service — the overwhelming majority of people on the network are using it to browse the ordinary internet privately. So when you see “three million daily dark web users,” what is actually being measured is three million daily Tor users, of whom perhaps a hundred thousand or two touch the dark web at all. We use “Tor users” below where that is what the data measures.
The Dark web is only a fraction of a percent of all the web content on the internet, which is a very small portion compared to the rest of the layers.
The dark web is a hidden part of the deep web. Researchers believe that it accommodates a small share of the deep web. Together, they occupy an area of approximately 96% of the entire internet, while the surface web, which we use in our day-to-day lives, constitutes the remaining 4%.
These layer percentages all trace back to Michael K. Bergman’s 2001 white paper in the Journal of Electronic Publishing, the study that coined the term “deep web.” No rigorous update has been published since, so they are best read as an order of magnitude rather than a measurement.
Bergman’s own estimate put the deep web at 400 to 550 times the size of the surface web. Larger figures circulate — 5,000 times is a common one — but they trace back through aggregator sites rather than to original measurement, and we have not been able to find a primary source for any of them.
Tor users have increased from 2 million to about 3 million within a short period, according to the Tor Project’s own network metrics.
Onion Sites: How many are on the Dark Web?
The question of the number of sites that exist on the dark web is one of the most common and frequent questions. The truth is that there are currently no exact numbers for the number of onion sites available on the dark web. However, there are good approximations.
Tor Metrics counts roughly 700,000 to 900,000 unique v3 .onion addresses visible on a typical day. That number needs handling with care, though, because a unique address is not the same as a working website — most are short-lived, duplicated, or belong to services that were never public. Estimates of genuinely active dark web sites at any one moment run into the low thousands, not the hundreds of thousands. Churn is part of the reason: illegal sites are continually shut down and others take their place, with new marketplaces appearing every three to four weeks.
In 2024, the number of active Tor browser users was 2.5 million. But now, data has shown that there are over 3 million people using Tor. This is more than a 20% growth from 2024 to 2026.
Of the dark websites, 83.27% are in the English language, which suggests that the English-language dark web (both illegal and legal) is well-dominant. Searches for dark web surveillance software have increased 31% in the last 12 months in the US.
The dark web underground economy was valued at around US$3.2 billion for 2025, with roughly $1.1 billion in illicit drugs and $700 million in cybercrime-as-a-service.
Dark Web Statistics: Breach Data
Around 60% of the websites, marketplaces and forums in the dark web are engaged in illicit activities such as buying and selling of illegal drugs & weapons, selling of companies’ and individuals’ personal data, installing viruses, malware and ransomware in devices.
The most popular activities among the above are the illicit activities: theft, sale and purchase of personal information. Digital Shadows counted 24.6 billion stolen credentials available for sale across criminal markets in 2022 — offered, not necessarily traded, which is an important distinction when reading any figure this large. That was up from 15 billion in the same research two years earlier.
More than 80% of those credentials are consumer data — email addresses, contact details, driver’s licence information.
In 2022, the darknet saw over 1.2 million credit card numbers being stolen. Indeed, prior to this year, more than 500 million records belonging to Fortune 500 company employees were found to be circulating on the darknet. Also, sensitive social security info from the Washington driver’s license database was released in 2022 by Darknet hackers.
The count of personal data records on the dark web marketplaces in 2024 was more than 703 million, which is a 28% increase compared to 2023 (549 million). One-third of the data breach incidents in 2024 also result in the content being posted on the dark web.
In 2022, 60 million compromised credit card records were found on the dark web, attributed to a 77% rise in payment-card skimming that year.
Around 4,000 dark web sites have been detected impersonating well-known e-commerce brands such as Amazon and Alibaba. Stolen databases were being priced at roughly $130 per 1,000 records as of late 2025, though this figure comes from a stats aggregator rather than an original source and should be read as indicative.
Individual incidents show how fast these records move. The T-Mobile breach exposed records on roughly 76 million people, with Social Security numbers and driver’s licence details among a subset of around 48 million of them, while the MyLovelyAI leak affected only around 106,000 accounts but caused harm far out of proportion to that number.
Marketplace Activity: Dark Web Marketplaces and Forums
Despite the dark web being a double-edged sword — that is, it can be used for both good and bad — most activities on the dark web online platforms are illegal. It’s estimated that the content on the dark web is 60% illicit and 20% of the platforms are used for selling drugs globally.
The dark web is estimated to generate $1.5 billion a year in revenue from the sale of stolen data, drugs, fake goods and cybercrime services. If we take into account additional categories (including money laundering services), a total of about $3.2 billion in revenue a year is expected to flow through the dark web.
The three biggest marketplaces, with shares of 28%, 22% and 17% (BlackSprut Market, Mega Darknet Market and OMG! OMG! Market), account for 67% of the dark web market share. The “Other” group makes up the remaining 33%, and as such shows the presence of many smaller or emerging markets.
Large dark web markets have between 80,000 and 250,000 listings; medium markets have 10,000 to 40,000 listings; and small markets have around 1,000-5,000 listings.
All dark web markets combined generated 4.2 million daily sales, approximately five days before Hydra was seized in April 2022, and 9.4 times less (447,000) a few days later.
The median customer rating of a successful darknet market is 4.8 out of 5 stars – this shows the extent to which these sites have embraced acceptable e-commerce practices.
The commission rates of most dark web marketplaces are between 2 and 10 percent per transaction to the vendors.
A majority of vendors operating in dark markets (68%) are shipping illegal goods to North America, thus North America is the greatest regional target of the dark web market worldwide.
User Demographics: Who Is on the Dark Web?
By early February 2026, over 3 million users were connecting to the Tor network daily. As noted at the top, only a small fraction of them — somewhere in the region of 3 to 7% — reach onion services at all.
The US, Germany and Russia together account for a large share of Tor traffic, but which country leads is genuinely disputed — depending on the reading, Germany has ranged from 25–35% of directly-connecting users, while other analyses put the United States first at 15–21%. The live Tor Metrics table is the only thing worth quoting here, and it moves.
The United States accounts for roughly a fifth of Tor users worldwide by most estimates. America is also unusual in combining a large population of users seeking legitimate privacy protection with a high ranking across several categories of harmful activity.
With 12.93% of users, Germany comes in second to America. Law enforcement developments and internet users’ understanding of privacy are both greatly impacted by this circumstance. Perhaps because of their history and the numerous regulations that protect data in the nation, Germans value their privacy more than people in many other nations.
Finland, a country of just 5.5 million people, has an astoundingly high frequency of 5.22%. This suggests that Finns are probably among the world’s most privacy-conscious internet users.
Europe has a higher total dark web adoption rate at the regional level, with shares of 3.43% in France, 2.71% in the Netherlands, and 2.58% in the UK. Iran has the smallest share with roughly 0.94% of the daily global usage.
Survey estimates put the Tor user base at roughly 75–82% male, though this is worth treating sceptically — the network is specifically engineered to defeat the kind of observation that would let anyone measure it properly. A recent report also shows a significant rise in women-led cybercrime groups, particularly in phishing and identity theft.
Survey data suggests mobile accounts for roughly 48% of dark web access, with the remainder on desktop — though the underlying survey isn’t published, so treat the split as approximate. Our guide to dark web apps for iOS and Android covers what runs on each platform — note that there is no official Tor Browser for iOS.
Dark Web Statistics 2026: Law Enforcement Work – Victories & Takedowns
Criminal justice has registered prominent successes in fighting dark web crime. Nevertheless, the ecosystem has turned out to be very resilient.
In April 2022, the German police dismantled the Hydra Market, a dark web marketplace that facilitated the trafficking of illegal drugs, money laundering, and the sale of falsified documents and hacking services. The confiscated wallets contained an estimated $25 million in Bitcoin. The vendor accounts and customers of Hydra numbered 19,000 and 17 million, respectively. The operator was sentenced to life in prison by a Russian court in December 2024.
In May 2023, following the German seizure of Monopoly Market’s infrastructure in December 2021, Europol coordinated a nine-country operation known as Operation SpecTor. It resulted in 288 arrests — 153 in the US, 55 in the UK and 52 in Germany. The outcome of Operation SpecTor was the seizure of $53.4 million in cash and cryptocurrency, 117 firearms, and 850 kg of narcotics including 64 kg of fentanyl. The Department of Justice described it as the largest number of arrests and seizures of any JCODE operation to that point.
In early 2024, the Department of Justice, U.S., joined the United Kingdom and international law enforcement partners in London to announce the disruption of the LockBit ransomware group. LockBit was one of the most active ransomware groups in the world that had targeted over 2,000 victims/organisations, collecting over $120 million in ransom payments.
In May 2025, Europol coordinated a global law enforcement operation known as Operation RapTor. The operation struck a major blow to the criminal underground, with 270 arrests of dark web vendors and buyers across ten countries. Operation RapTor seized over $200 million and 2 tons of drugs, alongside weapons and counterfeit goods.
In early 2026, the German police, with assistance from Europol, carried out a well-coordinated multinational operation between 9 and 19 March known as Operation Alice, involving authorities from 23 countries. It began as an investigation opened in 2021.
A single operator who allegedly managed more than 373,000 fraudulent .onion domains was discovered by the operation, and 105 servers were seized. These websites promised to provide cybercrime-as-a-service (CaaS) and child sexual abuse material (CSAM), but their true purpose was to defraud victims into paying for illicit tools or materials that never existed. Alongside the operator, 440 of his customers were identified.
Key Trends and Notes on The Dark Web
After several high-profile takedowns, criminal networks have spread operations within encrypted messaging applications (in particular Telegram), private invite-only forums, and various overlapping applications.
Phishing kit generation, victim targeting (automated), and marketplace management are some of the ways criminals utilize AI. Defenders are putting the same technology on the defensive side, but the defense barrier has fallen more rapidly than the attacker barrier. VoidLink, an 88,000-line malware framework built largely by an AI agent, and purpose-built criminal models like FraudGPT are the clearest examples.
Monero has displaced Bitcoin as the settlement currency of choice on most markets — one widely repeated estimate puts it above 60% of transactions, though we have not found the original measurement behind that number. The direction of travel is well documented even where the precise share isn’t: privacy coins make financial tracing substantially harder than in the Bitcoin-dominated era.
Over half of all dark web content consists of illegal file sharing (29%) and leaked data (28%). Drug trafficking and sales of weapons account for less than 10%. The stereotypical image of the drug market on the dark web is stale. It is more of a data economy.
The trend remains the same: a big marketplace or forum is closed down, the activity loses momentum, and in a few days or weeks, the market appears again and is restored or replaced with another .onion site.
Small companies are not exempt — one industry survey put the share of sub-$10 million businesses hit by ransomware in a single year at 47%, a figure we cite with the usual caution that applies to vendor-published survey data. Small businesses are now viable targets thanks to ransomware-as-a-service and the general democratisation of cybercrime tooling.
The pattern across all of this is that the dark web has become less exotic and more mundane. It is less a hidden bazaar and more a wholesale market for data that was stolen somewhere else entirely — usually from a company the victim trusted, in a breach they had no part in. Which is why individual exposure now has more to do with who holds your data than with anything you do online.
Conclusion
This report is a compilation of information from official statistics, industry reports, peer-reviewed research, and longitudinal studies. Where a figure comes from a named primary source, that source is linked directly. Where an estimate is contested, derives from a single report, or cannot be independently confirmed, we say so rather than presenting it as settled.
Dark web measurement is genuinely difficult. Tor is designed to resist the observation that would produce reliable statistics, so many widely circulated figures trace back to one study or one vendor report and are then repeated until they look authoritative. We would rather publish fewer numbers you can rely on than a longer list you cannot.
Frequently Asked Questions (FAQs)
How big is the dark web in 2026?
The dark web is smaller than most might believe — a fraction of a percent of total web content. Tor Metrics sees roughly 700,000 to 900,000 unique .onion addresses on a typical day, but the number of genuinely active sites at any one moment is far smaller, in the low thousands, because law enforcement pressure and criminal churn keep the average lifespan of an individual site short.
What is the number of people who use the dark web daily?
As of the beginning of 2026, the Tor Project’s metrics show over 3 million people connecting to Tor each day. Only about 3 to 7% of them reach onion services, so the genuine dark web audience is far smaller than the headline figure suggests.
What type of data is sold on the dark web, and how much is it sold?
The dark web sells a variety of personal and financial information that has been stolen. The prices differ drastically according to the type and freshness of the data. Purchasable data includes credit card records, Social Security numbers, passports, breached databases, cryptocurrency accounts, logins, corporate VPN credentials, and deepfake identity kits.
