What Is the Dark Web? A Plain-English Explanation

When people hear the words "dark web," they often picture something dangerous and mysterious. The reality is more nuanced — and understanding it can help you protect yourself online.

The internet is divided into three layers. The first is the surface web, which is everything you can find through a search engine like Google. News sites, YouTube, Wikipedia, and online stores all live here. This is the layer most people use every single day.

The second layer is called the deep web. Despite the scary-sounding name, the deep web is completely ordinary. It includes anything that search engines cannot index — like your bank account login page, your email inbox, your medical records, and streaming services behind a paywall. When you log into your bank online, you are technically on the deep web. There is nothing illegal about it.

The third layer is the dark web. This is a small collection of websites that are not accessible through a regular browser. To visit them, you need a special program called the Tor browser, which routes your connection through multiple servers around the world to hide your location. The addresses of dark web sites end in ".onion" instead of ".com" or ".org."

The dark web has legitimate uses. Journalists use it to communicate safely with sources in countries that censor the internet. Activists in authoritarian regimes use it to organize without government surveillance. Privacy researchers and security professionals rely on it for their work. News organizations like the BBC and The New York Times even have official dark web addresses so people in restricted countries can read their reporting.

Unfortunately, the dark web also hosts illegal marketplaces. Criminals buy and sell stolen personal information — including names, Social Security numbers, credit card numbers, and email and password combinations — that were obtained through data breaches. This is why you may hear about your information "being found on the dark web" after a company you use gets hacked.

Should you be scared? Not panicked, but informed. The dark web itself does not reach out and grab your data. Your information ends up there when a company you trusted with it gets breached. Once data is listed on a dark web marketplace, you cannot delete it — but you can take steps to limit the damage. Changing your passwords right away, freezing your credit, and monitoring your accounts closely are the most effective responses.

You do not need to visit the dark web yourself to stay safe. The best protection is using strong, unique passwords for every account, turning on two-factor authentication wherever possible, and staying alert to any unusual activity in your financial accounts.