Darknet

The darknet is an intentionally hidden part of the internet that cannot be reached with a standard browser — access requires dedicated software, most commonly the Tor Browser, and less often networks like I2P or Freenet. Darknet sites (recognizable in Tor by their .onion addresses) are invisible to search engines, and the network's architecture conceals both the identity of visitors and the physical location of the servers hosting the content.

How the darknet works

Tor, the largest darknet, is built on onion routing. A user's traffic is wrapped in multiple layers of encryption and relayed through at least three randomly selected nodes; each node knows only the previous and the next hop, so no single point ever sees both the origin and the destination. Hidden services go further: the server and the client meet at a rendezvous point, meaning the service's real IP address is never exposed to anyone. This is fundamentally different from a VPN, which encrypts traffic but concentrates trust in one provider, and from a browser's incognito mode, which only hides history locally on the device.

Practical applications

The darknet has a dual nature. On the legitimate side, it serves investigative journalists, whistleblowers, and people living under internet censorship — platforms like SecureDrop and onion mirrors of major news outlets exist precisely for these users. On the criminal side, it hosts marketplaces trading leaked credentials, stolen card data, and malware kits, while ransomware gangs run leak sites where they publish data from victims who refuse to pay. For businesses, the practical takeaway is defensive: dark web monitoring services scan underground forums for a company's domains, employee credentials, and customer records, giving security teams a chance to force password resets and enable two-factor authentication before stolen data is weaponized. Browsing the darknet is legal in most jurisdictions — the crimes are the specific acts committed there, exactly as on the open web.