The dark web works by running on top of the Tor network, which wraps your traffic in three layers of encryption and routes it through three volunteer relays. Each relay peels one layer and sees only the next hop, so no single relay knows both who you are and where you're going. Onion services take this further so a site's location stays hidden too.
- The dark web is an overlay on the normal internet, reached via Tor
- Onion routing wraps traffic in three encryption layers, one per relay
- No single relay knows both who you are and your destination
- Onion services hide the website's location as well as the visitor's
- Tor protects routing, not what you personally reveal
The dark web can seem like technological magic, but it rests on three understandable ideas: it runs on top of the ordinary internet, it hides you by routing your traffic through multiple relays, and it uses self-authenticating addresses. Grasp those and you understand the whole thing.
It's an overlay network
The dark web is not a separate internet buried underground. It runs on the same cables and servers as everything else — it is a layer laid on top, reachable only with the right software. The software, for almost all of the dark web, is Tor, short for The Onion Router.
Onion routing: the core idea
When you use Tor, your traffic is wrapped in three layers of encryption and bounced through three volunteer-run computers, called relays, before reaching its destination. The three relays are given deliberately unequal knowledge:
- The guard knows your real address but not where you're going.
- The middle relay knows neither end.
- The exit knows the destination but not who you are.
Each relay peels off one layer of encryption — like an onion, hence the name. The result: no single point can link you to your activity. This is also why tracking someone on Tor is so hard, and why the network is run by thousands of independent volunteers worldwide.
It's worth making the division of knowledge concrete, because it's the whole trick. Imagine passing a sealed letter through three people to reach someone across a room without anyone knowing both the sender and recipient. The first person knows who handed it over but not the final destination; the last knows the destination but not who started it; the middle knows neither. Tor does exactly this with encryption: each relay can unwrap only its own layer, revealing just the next hop. Compromising your anonymity would require the same party to control multiple specific relays in your circuit at once — which, across thousands of independent volunteer relays worldwide, is impractical for anyone targeting an ordinary user.
Onion services
The dark web sites you cannot reach any other way are onion services. Instead of the visitor connecting to the site directly, both sides meet at an agreed relay inside the network, so the traffic never leaves Tor and neither side learns the other's location. This is why an onion service hides the website as well as the visitor — and why leak sites and whistleblowing tools alike rely on it. Their .onion addresses are derived from cryptographic keys, so connecting proves you've reached the genuine service.
How you reach a hidden site
Connecting to an onion service raises an obvious puzzle: if both you and the site are hiding your locations, how do you ever meet? The answer is elegant. The service publishes a few “introduction points” to a distributed directory. You reach one through your own three-relay circuit and, together, you agree on a rendezvous point — a relay where your circuit and the service's circuit meet in the middle.
From then on, your traffic travels through your three relays to the rendezvous, and the service's traffic travels through its three relays to the same spot. The result: roughly six relays between you and the site, no exit relay involved, and traffic that never leaves the Tor network. Neither side ever learns the other's location, because neither is ever contacted directly. This is why an onion service can't simply be “traced to its server” the way an ordinary website can — and why the same property protects both a whistleblower's dropbox and a ransomware leak site. The network shelters both equally, because it was built not to judge.
Why it's slow
Tor is noticeably slower than an ordinary browser because your traffic takes three hops, often across different continents, instead of a direct route. That latency is not a flaw — it is the cost of the anonymity, and it is why the dark web is almost entirely text-based and lightweight.
What it doesn't protect
Tor protects the routing of your traffic, not your behaviour. Logging into a personal account, downloading a file that phones home, or revealing an identifying detail defeats the anonymity instantly. Most people who get caught do so through their own mistakes, not by anyone breaking Tor.
Frequently asked questions
How does the dark web work in simple terms?
Your traffic is encrypted in three layers and bounced through three volunteer relays before reaching a site. Each relay only knows the next step, so no one can link you to what you're doing. Special onion sites meet you inside the network so their location stays hidden too.
What is onion routing?
Wrapping traffic in multiple layers of encryption and passing it through a chain of relays, each removing one layer and learning only the next hop. It's what the ‘onion’ in Tor and .onion refers to.
Why is the dark web so slow?
Because your traffic takes three hops, often across different continents, instead of a direct route. That indirection is exactly what makes you hard to trace — the slowness is the price of the anonymity.
Can Tor be traced?
Tracing Tor itself is extremely hard and generally requires a well-resourced state adversary. In practice, people are almost always identified through their own mistakes — reused identities, personal details, or downloads — not by breaking the network.
What is an onion service?
A site reachable only inside Tor, at a .onion address. You and the site meet at an agreed relay, so neither side learns the other's location and the traffic never leaves the network.
What is a Tor relay?
A volunteer-run computer that passes traffic through the Tor network. A circuit uses three: the guard (which knows your address), the middle (which knows neither end), and the exit (which knows your destination). Thousands of independent relays worldwide make the network hard to compromise.
How do onion services stay hidden?
You and the service meet at an agreed rendezvous relay, each reaching it through your own three relays. No exit is involved, the traffic never leaves Tor, and neither side learns the other's location — so an onion service can't simply be traced to its server the way an ordinary website can.
Can the dark web be shut down?
Not easily or entirely. Because the network is run by thousands of independent volunteer relays worldwide and onion services hide their locations, there's no central server or company to shut down. Individual sites get seized, usually through operator mistakes, but the network itself has no single point to switch off.