What is the dark web? Its real size, and how your data ends up there

Ask most people what the dark web is and you get a movie answer: hitmen for hire, drug bazaars, hackers in hoodies. Look at the measurements instead and the picture shrinks. On an average day in October 2026, the Tor Project counted roughly 650,000 active onion addresses worldwide. Some of those belong to newsrooms and broadcasters. Others belong to people selling stolen logins next to everything else they sell.

That second group matters more to you than the first. You will probably never open a dark web site. Your email address and an old password may well have been listed on one anyway. This guide covers what the dark web is, how big it really is, who uses it, how personal data ends up there, and what those dark web scans from antivirus companies and credit bureaus actually check.

What is the dark web?

The dark web is made of websites that only exist inside an anonymity network. By far the largest one is Tor. Sites on Tor are called onion services. Their addresses end in .onion and look like a long string of random characters. Chrome or Safari cannot open them, and Google does not index them.

What makes them different is that the anonymity runs both ways. When you use Tor to visit a normal website, you are hidden, but the website sits in plain view with a public server address. With an onion service, visitor and server meet through several relays and neither learns where the other one is. That is why a site can stay online without anyone knowing where its server stands. For how the relay chain works and where its protection ends, see our piece on Tor Browser.

Germany’s Federal Office for Information Security (BSI) adds a caveat worth keeping in mind: even with Tor, being traced back “cannot be ruled out.” The dark web is harder to watch, not impossible to watch.

Deep web vs dark web

These two get mixed up constantly, often on purpose, because “the deep web” sounds more ominous than it is. The surface web is what search engines find: news sites, online stores, Wikipedia, this page. The deep web is everything they cannot reach because it sits behind a login, a paywall or a database query. Your Gmail inbox is deep web. So is your bank account, your health insurer’s portal and your company’s intranet. The BSI estimates the deep web at around 90 percent of the web.

The dark web is a small slice of that deep web with two extra features: you need special software to get in, and anonymity is the whole point. If someone says the deep web is dangerous, they almost always mean the dark web. You probably used the deep web a dozen times today.

How big is the dark web, really?

The Tor Project publishes its own network statistics at Tor Metrics. The numbers are extrapolated, since no single relay sees everything, but they give a solid sense of scale. We pulled them on October 20, 2026.

The address count swings a lot, from over a million in spring to around 650,000 this fall. Generating an onion address takes seconds, and plenty exist for a single chat, a test or one file transfer. Far fewer than 650,000 of them are real, lasting websites.

The traffic numbers tell a second story. Only a few percent of everything that flows through Tor goes to onion services at all. Most of Tor’s millions of daily users are reading ordinary websites without their ISP or the site seeing who they are. Using Tor and visiting the dark web are mostly two different things.

Who uses the dark web?

Both sides are real. The BSI calls the dark web “a marketplace for crimes and illegal goods of all kinds,” and in the same breath says its encryption lets journalists, persecuted people and opposition activists get around censorship, and lets whistleblowers bring material to the public.

The legitimate side is more mainstream than its reputation. The BBC launched an onion version of its international news site in October 2019, specifically for audiences in countries that block BBC News; it named China, Iran and Vietnam. Germany’s international broadcaster Deutsche Welle runs one as well, set up with help from the Tor Project. If you open dw.com in Tor Browser, a feature called Onion-Location sends you to the onion address automatically. That is also the safe way to find these services: the address comes from the official site, not from a list someone posted.

The most important legitimate use is probably the anonymous tip line. SecureDrop is open-source whistleblower software originally written by the late Aaron Swartz and now maintained by the Freedom of the Press Foundation. The Washington Post, The Guardian, Der Spiegel and many other outlets run it on servers they own, it does not log IP addresses, and sources reach it through Tor.

None of this makes headlines, because nothing happens there except reading and uploading documents.

What gets traded on the dark web

The criminal side mostly becomes visible when police take a market down. Here are a few cases, with the figures the investigating agencies released. German authorities led or co-led each of them, which is why the numbers come from Germany’s Federal Criminal Police Office (BKA).

Drugs dominate. What matters for everyone else is the line that keeps coming up in these announcements: stolen data. Europol devoted its 2025 Internet Organised Crime Threat Assessment to exactly that, under the title “Steal, deal and repeat.” Data, the report says, has become a key commodity, and the platforms where it is bought and sold are “predominantly hosted on the dark web.”

According to Europol, the goods include:

• logins for email, social media and shopping accounts,
• raw output from infostealers, malware that copies saved passwords, cookies and browsing history off infected computers,
• credit card details, often sold in bulk,
• access to company networks, resold to ransomware crews.

Takedowns slow this trade down less than the press releases suggest. Europol describes data brokers spreading across several platforms at once, precisely so a raid does not put them out of business. More and more of the actual deals happen in end-to-end encrypted messaging channels. The forums are turning into shop windows.

How your data ends up on the dark web

You do not have to go anywhere near the dark web to end up on it. Your data usually arrives by one of three routes.

A company gets breached. A store, a forum or a service provider is hacked, its customer database is copied and later sold or dumped for free. Our guide on how to check if your data was in a breach walks through what that means and how to look yourself up.

Ransomware with a leak threat. Extortion groups copy data before encrypting a network and threaten to publish it. Germany’s BKA describes one 2025 case involving the aid organization Welthungerhilfe: the Rhysida group posted extracts of the stolen files on the dark web and demanded €1.8 million. The people whose data sits in such files are donors, customers and staff who did nothing wrong themselves.

An infostealer on your own device. A fake download, a cracked program or a shady browser extension, and a piece of malware quietly reads every password your browser has saved. When police dismantled the servers of one major stealer, Rhadamanthys, during the international Operation Endgame, they seized data belonging to more than 650,000 victims.

Europol adds two details worth knowing. The same data gets sold again and again, and resold after it has been used, so a breach from five years ago can reach a new buyer this week. At the same time, many sellers exaggerate, relabel old leaks as fresh or sell outright fakes to build a reputation.

What dark web scans and monitoring actually do

Norton, Microsoft Defender, Experian, Aura and plenty of others offer dark web scans or ongoing dark web monitoring. The pitch: we patrol the hidden corners of the internet and warn you the moment your details show up.

Under the hood it is more ordinary. Providers collect data sets from known breaches, forums and seller listings, load them into their own database, and compare your details against it. Microsoft’s own FAQ says Defender can watch for things like email addresses, phone numbers, passport and card numbers, and that it reports which data turned up in which breach. That is useful. It is also a lookup against known collections, not a live search of the dark web.

The clearest verdict came from Google. It discontinued its free Dark Web Report: new scans stopped in January 2026, and on February 16, 2026 the tool was shut down and its data deleted. According to TechCrunch, Google said feedback showed the report “didn’t provide helpful next steps.” That is the core problem. Knowing your address appears in three old breaches does nothing unless you change something afterwards.

For most people, free breach checkers like Have I Been Pwned cover the same ground. A paid plan can be worth it if it adds something you would not otherwise have, such as covering several family members or hands-on help with actual identity theft. The scan on its own does not protect anything.

Your data showed up. Now what?

A hit is not a reason to panic. It is a reason to act, and the order matters more than the speed.

1. Change the password everywhere you used the same or a similar one. Reused passwords are the real danger, because attackers automatically try leaked combinations on other sites.
2. Turn on two-factor authentication or passkeys for email, banking and your most important accounts. A stolen password alone is then not enough. Our passkeys guide explains how they work.
3. If card or bank details are involved, call your bank and have the card blocked.
4. Be wary of messages that know things about you, like your real name, address or a genuine recent order. That is exactly what this data is bought for.

If you suspect an account has already been taken over, the checklist in has my phone been hacked? is a good next step.

Is the dark web illegal?

In Germany and most Western countries, no. Using Tor and visiting onion sites is legal; what you do there is what counts. The BSI says it directly: simply moving around the dark web is not illegal, but it is a security risk. Buying drugs, stolen data or abuse material is illegal there exactly as it is anywhere else. The picture is different in countries that censor the internet, where Tor itself may be blocked or treated with suspicion.

The security risk is not hypothetical. The BSI notes that the chance of picking up malware is higher on the dark web than on the regular web, and that people who fall for dubious offers can end up committing a crime themselves or in contact with criminal groups.

As for how to access the dark web: technically through Tor Browser, downloaded only from torproject.org, because fake versions circulate. We are deliberately not writing a browsing guide. You do not need one for the legitimate services: open dw.com in Tor Browser and it forwards you on its own, and a newsroom’s SecureDrop address belongs on that newsroom’s official website and nowhere else. The link lists floating around the internet are a good part of the risk the BSI is warning about.

The short version

The dark web is neither the monster from TV nor a harmless curiosity. It is a small, hard-to-police corner of the internet that helps people get around censorship, protects whistleblowers and gives data thieves a place to sell. Most people only ever touch it one way: through their own data, which got there without them doing anything.

A scan that tells you after the fact will not change that. What changes it is a stolen password that works nowhere else, a second factor on the accounts that matter, and a healthy suspicion of any message that happens to know your real name. None of that is exciting, and it still beats any dark web monitoring plan.

Frequently asked questions

What is the dark web in simple terms?

The dark web is the part of the internet you can only reach through an anonymity network such as Tor. Sites there use addresses ending in .onion, they do not show up in Google, and a regular browser cannot open them. Both the people running a site and the people visiting it stay largely anonymous. News organizations, whistleblower drop boxes and people living under censorship use it, and so do criminal marketplaces.

Is the dark web illegal?

In most Western countries, simply visiting the dark web or using Tor is legal. Germany's Federal Office for Information Security (BSI) puts it plainly: moving around the dark web on its own is not illegal, but it is a security risk. What is illegal offline stays illegal there, such as buying drugs, stolen data or abuse material. Laws differ by country, and some governments block or punish Tor use.

What is the difference between the deep web and the dark web?

The deep web is everything search engines do not index: your inbox, online banking, medical portals, paywalled articles, company databases. It is ordinary and makes up most of the web. The dark web is a small slice of it that additionally requires special software like Tor Browser and is designed for anonymity.

How do I know if my information is on the dark web?

Nobody can fully answer that, because no service sees every forum, market and private chat channel. In practice, you check whether your email address shows up in known breaches using a free tool like Have I Been Pwned. A hit means your data is circulating. No hit does not prove it is not.

Is dark web monitoring worth paying for?

For most people, a paid scan adds little beyond what free breach checkers already show. These services match your details against collections of known leaks and alert you on a hit. They cannot see into closed groups, and they cannot pull your data back. Google shut down its own free Dark Web Report in February 2026, saying users found it did not offer helpful next steps.

What should I do if my information is found on the dark web?

Change the exposed password everywhere you reused it, then turn on two-factor authentication or passkeys for email, banking and other key accounts. If card or bank details are involved, call your bank right away. After that, treat emails, texts and calls that quote your real details with extra suspicion, because that is exactly what stolen data is bought for.