If you've spent any time in tech communities or reading cybersecurity news, you've probably heard the term "darknet." But what exactly is it, and how does it differ from the "dark web" or "deep web"?
This post covers the origins, the technology, the common uses, and the myths and realities of darknets.
TL;DR: A darknet is an overlay network inside the Internet that you can only reach with specific software, configurations, or authorization. The dark web is the web content hosted on those networks. Tor is the most famous darknet, but far from the only one. Darknets protect journalists and dissidents, and they also host serious crime.
🌑 What is a Darknet?
A darknet is an overlay network located within the Internet that can only be accessed using specific software, configurations, or authorization. These networks often rely on a unique, customized communication protocol to function.
Two of the most typical types of darknets are:
- Anonymity proxy networks like Tor, which uses an anonymized series of connections
- Friend-to-friend (F2F) networks, usually used for peer-to-peer file sharing
The opposite of a darknet is the clearnet (the surface web): content that standard search engines can readily index.
Terminology Confusion: Deep Web vs. Dark Web
People often mix these terms up, so here's a quick reference:
| Term | Meaning |
|---|---|
| Clearnet / surface web | Content readily indexed by standard search engines |
| Deep web | Content search engines can't index (behind logins, paywalls, and so on) |
| Darknet | An overlay network that requires specific software, configuration, or authorization |
| Dark web | The World Wide Web content that exists on darknets. It's a small part of the deep web |
Why the confusion?
- "Darknet" is often used interchangeably with "dark web" because of the sheer quantity of hidden services on Tor's darknet.
- It's also inaccurately swapped with "deep web," partly because of Tor's history as a platform search engines couldn't index.
- The mix-up goes back to at least 2009, and press coverage of Silk Road made it worse.
⚠️ Mixing these terms is considered inaccurate, and commentators recommend using them distinctly.
📜 Origins and History
The concept of a darknet is older than many people realize.
1970s: the term is coined
The word originally described networks isolated from ARPANET for security purposes. These early darknet computers were programmed to stay invisible: they could receive messages from ARPANET, but wouldn't respond to inquiries, acknowledge anything, or answer pings.
2002: the term goes mainstream
It gained wider public acceptance after a paper titled "The Darknet and the Future of Content Distribution," written by four Microsoft employees. The paper defined a darknet as any parallel network requiring a specific protocol or encryption to connect. It argued that their existence made copyright infringement inevitable and hindered digital rights management (DRM) technologies.
2009: "dark web" appears
The term dark web first emerged in 2009, though it's unknown when the dark web itself first appeared.
2011: Silk Road
Silk Road became one of the first dark web marketplaces and drew huge media attention, as we'll see below.
🧅 How Anonymity Works (Tor in a Nutshell)
The Tor dark web, sometimes called onionland, uses a technique called onion routing and lives under the .onion top-level domain suffix.
You ──► Entry node ──► Middle node(s) ──► Exit node ──► Destination
(layer 1) (layer 2...) (last layer)
- Your traffic is wrapped in layers of encryption and routed through multiple intermediate servers.
- Each node can only decrypt its own layer, so it knows only where the data came from and where it goes next.
- That makes it extremely hard to reconstruct the full path. Sites can't see their visitors' IP address or geolocation, and visitors can't see the host's.
The result is that people can chat, blog, and share files confidentially, which is exactly why the technology appeals to both privacy advocates and criminals.
🛠️ Active Darknet Software
Accessing a darknet requires specialized network configurations or specific software. Tor (The Onion Router) is the most popular and is famous for its onion services, but it's not the only one.
| Software | What it is |
|---|---|
| Tor | The most popular darknet, known for its onion services |
| I2P (Invisible Internet Project) | An overlay proxy network that hosts hidden services called "Eepsites" |
| Freenet / Hyphanet | A popular distributed hash table (DHT) darknet platform for file hosting, supporting opennet and friend-to-friend modes |
| GNUnet | A network that can act as a darknet when the "F2F (network) topology" option is enabled |
| RetroShare | A file transfer platform and friend-to-friend messenger that can function as a darknet if its Discovery and DHT features are disabled |
| anoNet | A decentralized friend-to-friend network built with software BGP routers and VPNs |
| Secure Scuttlebutt | A self-hosted social media ecosystem, mesh network, and peer-to-peer communication protocol |
| Riffle | A client-server system with minimal bandwidth burden, efficient computation, and secure anonymity (as long as at least one server remains uncompromised) |
🔍 How Are Darknets Used?
Technologies such as I2P, Tor, and Hyphanet are designed to defend digital rights by providing censorship resistance, security, and anonymity. As a result, darknets serve a wide spectrum of both legitimate and illegal purposes.
✅ Privacy and freedom
- Bypassing restrictive firewall policies, content-filtering systems, and network censorship
- Protecting citizens' privacy from mass and targeted surveillance
- Protecting dissidents from political reprisal
- Enabling anonymous communication between news organizations, journalists, activists, and whistleblowers, using tools like SecureDrop
- Whistleblowing and news leaks
- Sharing personal and confidential files
❌ Illicit activity
- Sharing illegal or counterfeit software, warez, and illegal pornography
- Computer crime, including file corruption and cracking
- Buying, selling, or trading restricted, illicit, or illegal goods and services on darknet markets
📊 What Is Actually on the Dark Web?
The numbers
A February 2016 study of web-based onion services found that around 52% were active, and of those, roughly 57% hosted illicit content:
| Category | % of active sites |
|---|---|
| Non-illicit + unknown | 43.2% |
| Illicit drugs | 15.5% |
| Illicit finance | 12.0% |
| Illicit other | 7.3% |
| Extremism | 5.1% |
| Illicit pornography | 4.5% |
| Illicit links | 4.3% |
| Hacking | 3.5% |
| Illicit social | 2.4% |
| Arms | 1.5% |
| Violence | 0.6% |
| Illicit total | 56.8% |
A few more data points for context:
- A December 2014 study from the University of Portsmouth found that child sexual abuse material was the most commonly hosted content type on Tor, followed by black markets, while the highest-traffic sites were dedicated to botnet operations. Whistleblowing sites and political discussion forums were also present.
- As of December 2020, the number of active
.onionsites was estimated at 76,300 (many of them copies), of which about 18,000 had original content. - In 2017, Tor co-founder Roger Dingledine said that Facebook is the biggest hidden service and that the dark web makes up only about 3% of Tor network traffic.
💡 Counts of sites and counts of traffic tell very different stories, so be careful with any single statistic.
🛒 Darknet markets and crypto
Commercial darknet markets mediate transactions for illegal goods and typically use Bitcoin as payment. They work much like eBay or Craigslist, with sellers, buyers, and reviews.
- Silk Road (2011) was one of the first, trading in illegal drugs, weapons, and identity fraud resources, until authorities seized it. Its creator, Ross Ulbricht, was sentenced to life in prison in 2015.
- These markets offer users no protection and can be shut down by authorities at any time. When one closes, others pop up in its place. At least 38 active markets existed as of 2020.
- In April 2022, US and German authorities shut down Hydra Market, described as the world's largest darknet market. It had handled an estimated 80% of cryptocurrency transactions linked to darknet markets in 2021.
- Quality isn't guaranteed: a study of the Evolution market (2013 to 2015) found that listing details such as shipping country seemed accurate, but the purity of illegal drugs often differed from what listings claimed.
- Bitcoin tumblers (mixing services) are often available on Tor and are used for money laundering.
💻 Ransomware, botnets, and hacking
- Ransomware-as-a-Service (RaaS): Operators recruit affiliates through underground forums, and most prominent groups run dedicated data leak sites on Tor.
- Double extortion: Pioneered by the Maze group in November 2019, this means stealing data and threatening to publish it if victims don't pay. Groups like LockBit, ALPHV/BlackCat, and Cl0p have hosted data from hundreds of victim organizations.
- Initial access brokers (IABs): Specialists compromise organizations and sell that access to ransomware affiliates, creating an efficient criminal supply chain that lowers the technical barrier to entry.
- Botnets: Often use censorship-resistant hidden services for their command-and-control servers.
- Credential theft: Around 100,000 compromised ChatGPT logins were sold on the dark web in 2023, mostly harvested by the Raccoon infostealer.
-
Scams: Many
.onionsites are scams themselves, including cloned sites, phishing, and downloads infected with trojans or backdoors.
🚨 The darkest corners
The dark web hosts some of the worst content on the Internet, and it's worth stating plainly:
- Child sexual abuse material (CSAM) is a major problem, and law enforcement runs regular operations against it, often by compromising sites and tracking users' IP addresses. Recent examples include a 2021 German-led takedown of a network with over 400,000 registered users and a 2025 Europol-coordinated operation against a platform with 1.8 million users.
- Terrorist groups have used dark web chat platforms for propaganda and recruitment, and cryptocurrency for anonymous funding. Some purported extremist sites have turned out to be fake or were hacked and defaced by activists.
👥 Social media on the dark web
Dark Web Social Networks (DWSNs) look like regular social sites, with customizable pages, friends, likes, and forums, but they require members to reveal no personal information. Some mainstream platforms have also launched dark-web versions of their sites.
🎭 Hoaxes and urban legends
Not everything you read about the dark web is true:
- Hitmen for hire and crowdfunded assassinations are believed to be exclusively scams.
- "Red Rooms" (supposed live-streamed murders) are an urban legend, and the evidence points to every reported instance being a hoax.
- The horror game Sad Satan was claimed by YouTubers to have been found on the dark web, but inconsistencies in their story cast doubt on it.
🕵️ Policing the Dark Web
Some argue the dark web promotes civil liberties like free speech, privacy, and anonymity. Prosecutors and agencies worry it's a haven for crime. Both can be true.
Police normally start an investigation with a suspect's IP address, but Tor makes that tactic effectively impossible. Law enforcement has had to adapt:
- OSINT (Open Source Intelligence): Tools that legally collect information from public sources, including dark-web-specific tools.
- Site takedowns and compromises: As in the CSAM operations above.
- Training and task forces: Interpol launched a dedicated dark web training program in 2015, with simulated darknet market takedowns. In 2013 the UK's National Crime Agency and GCHQ formed a Joint Operations Cell, which in 2015 was tasked with child exploitation on the dark web.
- Public-private cooperation: Cybersecurity firms that monitor the dark web for banks and retailers share findings with the FBI "when possible and necessary."
- Research: In 2017 the US Congressional Research Service published an extensive report on the dark web.
📰 How the Media Covers It
Coverage tends to go one of two ways: either highlighting the freedom of speech and privacy the dark web enables, or, far more commonly, reinforcing fear and illegality (hackers, drug markets, abuse material). Headlines about the dark web are overwhelmingly about crime, which shapes how most people picture it.
🎯 Key Takeaways
- A darknet is an overlay network that requires special software, configuration, or authorization.
- Darknet ≠ dark web ≠ deep web. The dark web is a small part of the deep web. Use the terms precisely.
- The term dates back to the 1970s, went mainstream in 2002, and "dark web" emerged around 2009.
- Darknet technologies exist to provide censorship resistance, security, and anonymity, which serve both legitimate and illegal ends.
- Tor is the best known, but not the only one: I2P, Hyphanet, GNUnet, and others are all active.
- The dark web has a real criminal ecosystem (markets, ransomware, fraud, abuse material), but it's also full of scams and hoaxes, and most Tor traffic isn't dark web activity at all.
- Law enforcement can't rely on IP tracing, so it uses OSINT, infiltration, and international cooperation.
📚 Sources and Attribution
Much of the data and history in this post is adapted from the Wikipedia article Dark web, which is available under the CC BY-SA 4.0 license. Wikipedia in turn cites studies and reporting from the University of Portsmouth, King's College London, Europol, Interpol, the US Congressional Research Service, and others.
Did I miss a darknet technology, or get something wrong? Let me know in the comments! 👇
Top comments (0)