The dark web is a section of the internet that requires special software , usually the Tor browser , to access. It’s not inherently illegal to visit, but much of its activity involves crime. Laws in the US, UK, EU, and most countries apply to what you do on the dark web, not just what you do on the regular web. Law enforcement has taken down dozens of dark web platforms and prosecuted operators and users across multiple jurisdictions.
What the Dark Web Actually Is
The internet has three layers most people don’t think about separately. For the full picture, see our guide to what the dark web is and how Tor works.
The surface web is what search engines like Google index , websites you can find by searching. It’s a surprisingly small fraction of the total internet.
The deep web, is everything that isn’t indexed your email inbox, your bank’s login portal, medical records, private databases. Nothing sinister about most of it. You use the deep web every day.
The dark web is a deliberately hidden subset that requires special software to access. The most common method is the Tor browser, which routes your connection through a series of encrypted relays around the world before delivering you to a .onion address.
The Tor Project, a US-based non-profit, builds and maintains the software and was originally developed with funding from the US military for secure communications.The anonymity Tor provides is real.It makes it significantly harder , not impossible , for anyone monitoring your internet connection to see where you’re going or what you’re doing. That anonymity is the feature that makes the dark web useful for both legitimate purposes (journalists in authoritarian countries, whistleblowers, privacy advocates) and illegal ones (drug markets, stolen data sales, fraud infrastructure).
For a full breakdown of how each layer differs, our deep web vs dark web guide explains it in plain language.
What’s Actually There
The dark web is not as uniformly sinister as popular culture suggests. A portion of its traffic is routine: news sites with .onion mirrors, privacy-focused messaging services, legitimate research, and censorship-resistant communications. The BBC, The New York Times, and even Facebook maintain dark web versions of their sites for users in countries where those sites are blocked.
But the illegal activity is real and significant.
Drug markets are the most established category. Silk Road, which ran from 2011 to 2013, pioneered the model , a marketplace with user ratings, vendor feedback, and cryptocurrency payments that moved hundreds of millions of dollars in controlled substances. Ross Ulbricht, its founder, received a life sentence. The model didn’t die with Silk Road. Empire Market ran from 2018 to 2020, facilitating over $430 million in transactions including fentanyl, cocaine, and heroin. Empire Market’s co-creator was sentenced to 40 years in prison in October 2026.
Stolen data is the second major category. Leaked credentials, credit card numbers, personal identity documents, and corporate data all circulate through dark web forums and markets. The CRIF Cyber Observatory found 2.5 billion unique records circulating on the dark web in just the first half of 2026. That data comes from thousands of corporate breaches and is constantly being repackaged and resold.
Hacking-as-a-service, ransomware affiliate programmes, counterfeit currency, forged documents, and illegal weapons are also present , at varying scales and levels of activity.
Do Laws Apply on the Dark Web?
This is where a lot of misconceptions live. The answer is yes , firmly.
The Tor network anonymises your connection. It does not give you legal immunity. What you do on the dark web is subject to the laws of your jurisdiction, the laws of wherever the server you’re accessing sits, and the laws of wherever any transactions occur. Buying fentanyl on a dark web marketplace is a federal drug trafficking offence in the US whether the order was placed through Chrome or Tor.
Law enforcement has spent the past decade developing specific capabilities for dark web investigations. They use undercover operations, financial forensics, operational security mistakes by operators, and cooperation with exit nodes and hosting providers to identify suspects. The results are documented. AlphaBay, Hansa, Empire Market, Silk Road, DarkMarket, Archetyp, and dozens of smaller platforms have been seized. Operators have received sentences ranging from years to life.
The Operation Alice takedown in 2026 shut down 373,000 dark web sites in a single coordinated operation across 23 countries. INTERPOL, Europol, the FBI, and national police forces run dedicated units specifically for dark web investigation.
The Specific Risks for Ordinary People
Even people who never visit the dark web are affected by it.
When a company you’ve bought from or shared your data with suffers a breach, the stolen data typically ends up on the dark web within hours or days. Your email address, your password, your home address, your credit card details , all of these can be circulating in criminal markets through no action of your own.
That data is then used for phishing, account takeover, identity fraud, and increasingly, synthetic identity creation, where criminals combine real stolen details with fabricated information to create fake identities that can pass financial verification checks.
The dark web is also where criminal tools are sold. LLM-jacking attacks , where criminals buy stolen AI service credentials to run unauthorised AI queries at victim companies’ expense , are being enabled by dark web credential markets. The stolen tools, credentials, and capabilities that make headline-grabbing cyberattacks possible are almost always bought and sold there first.
What You Can Do
You can’t opt out of data breaches at companies you interact with. But you can limit the damage.
Check whether your email appears in known breach databases at Have I Been Pwned. Use a password manager and unique passwords for every account. Enable two-factor authentication using an authenticator app rather than SMS. Freeze your credit at the three bureaus if you’re in the US , it’s free and blocks new accounts from being opened in your name without your explicit action.
Our full guide on what to do when your data is on the dark web covers the complete response checklist in priority order.
For businesses, dark web monitoring services have become a standard part of enterprise security posture. These services watch criminal forums for credentials, company documents, and discussions that suggest an organisation is being targeted , often detecting exposure before the organisation itself does.
Frequently Asked Questions
Is it illegal to access the dark web?
In most countries, accessing the dark web using the Tor browser is not illegal by itself. What you do there is subject to the same laws as the rest of the internet.
Does the dark web have any legal uses?
Yes. Journalists, activists, whistleblowers, and privacy-conscious users regularly use the dark web. Major news organisations maintain .onion mirrors for readers in countries that censor their content.
Can law enforcement track dark web activity?
Yes, with significant resources and time. Anonymity is not immunity. Dozens of major dark web marketplaces and their operators have been prosecuted.
How does the dark web affect me if I never go there?
Data stolen in breaches at companies you’ve used almost certainly circulates on the dark web. That data enables phishing, identity theft, and account takeover attacks against you.
How can I protect myself?
Use unique passwords, enable two-factor authentication, check breach databases for your email, and consider a credit freeze if your Social Security number may have been exposed in a breach.
