Dark Web Definition
The dark web is a portion of the internet that isn't indexed by standard search engines and can only be reached using specialized software, most commonly the Tor browser. Sites there use non-standard addresses (typically ending in .onion) and route traffic through layers of encryption and relay servers, which anonymizes both the visitor and the site operator.
It's important to distinguish three layers. The surface web is everything indexed by Google and reachable through a normal browser. The deep web is any content behind a login or paywall — your email inbox, banking portal, or a company intranet — and makes up the vast majority of the internet. The dark web is a small subset of the deep web that is deliberately hidden and requires specific tools to access. While it hosts legitimate uses like secure communication for journalists, activists, and whistleblowers in censored regions, it's best known as the marketplace where stolen credentials, breached data, malware kits, and illicit goods are bought and sold.
What is the difference between the dark web and the deep web?
The two are often used interchangeably, but they're not the same. The deep web is simply any online content that search engines don't index, which includes an enormous amount of entirely ordinary material: email accounts, online banking, medical records, subscription content, and private company databases. Accessing it requires nothing more than a login. By some estimates it accounts for well over 90% of the internet. The dark web is a small, deliberately concealed subset of the deep web that requires anonymizing software like Tor to reach. The key distinction is intent: deep web content is private but not hidden, while dark web content is built specifically to conceal both the site and its visitors.
What is on the dark web?
The dark web hosts a mix of criminal and legitimate activity. On the criminal side, marketplaces trade in stolen credentials, credit card data, breached databases, forged documents, drugs, and weapons. Forums sell malware kits, ransomware-as-a-service subscriptions, and access to already-compromised corporate networks. Infostealer logs — bundles of passwords and session cookies harvested from infected devices — are among the fastest-growing commodities. But it also serves legitimate purposes: journalists and whistleblowers use it for secure, untraceable communication, major news organizations run SecureDrop portals there, and people in countries with heavy internet censorship use it to reach blocked information and communicate safely.
How do I know if my information is on the dark web?
Individuals can use free breach-check services to see whether their email address has appeared in known data breaches, then rotate any exposed passwords immediately. For organizations, the stakes are higher and the approach needs to be continuous. Dark web monitoring services scan criminal marketplaces, forums, paste sites, and infostealer logs for credentials, domains, and data tied to your company — surfacing exposures before attackers put them to use. Solutions like the ones Fortra offers combine this monitoring with threat intelligence and takedown capability, connecting what's found on criminal marketplaces to the brand impersonation and phishing infrastructure built from it. The practical value is time: the gap between a credential appearing for sale and being used is often measured in days, so early detection is what turns an exposure into a non-event rather than a breach.