Short answer: The surface web is what an ordinary search engine is allowed to list. The deep web is the much larger set of pages that engine does not list: mail, bank sessions, paywalls, unlinked files. The dark web is a smaller slice that you can open only through an overlay network such as Tor, I2P, or Hyphanet. Installing Tor Browser and reading a newspaper is not the same act as opening an onion service.
Headlines and link directories collapse the three names. They answer different questions: can a crawler find it, do you need an account, and do you need different software? This page keeps those questions apart. The short glossary lines are deep web and dark web. The network itself is What is Tor?.
Surface web
The surface web is the part a normal browser can open and a public search index is allowed to list. A news homepage, a reference article, a company page, a public blog: if you can paste the address into an ordinary browser and a crawler can follow a link to it, it sits on the surface.
Ranking is not the definition. A page can be public and still be obscure. What puts it on the surface is ordinary software plus a path a crawler can walk. When the conversation is about Tor, people call that same public internet the clearnet.
Deep web
The deep web is a search-engine term, not a place and not a crime category. Computer scientist Michael K. Bergman popularized the phrase in 2001 for pages that standard crawlers do not index. Earlier writers had already called the same gap the invisible web: a site that exists, but that a query will not surface, because nothing led a crawler to it.
Most of that material is ordinary. A webmail inbox, a bank statement, a hospital portal, a course page behind a login, a newspaper story behind a paywall, a result that exists only after you submit a form, a file with no inbound links, a page marked so robots should stay away. You open these with the same browser you use for the surface web. You often need an account, a direct address, or both. Nothing in that stack is an anonymity network.
Claims that the deep web is "most of the web" are directionally right and rarely measured the same way twice. The useful point is qualitative. Unindexed does not mean illicit. Your own email is deep web. So is the staff side of a shop.
Dark web
The dark web is online content that lives on a darknet: an overlay that uses the internet as transport but expects its own software. Tor onion services, I2P sites, and Hyphanet sites are the usual examples. A normal browser, pointed at a normal domain name, does not land on them. The address is meaningful only inside that network. On Tor, the address is a long string ending in .onion.
That slice is inside the deep web, because ordinary search engines do not index those addresses either. It is not the definition of the deep web. A password-protected forum on the public web is deep and not dark. An onion site is both unindexed and unreachable without the overlay.
The phrase spread in news writing around 2009 and then stuck to market seizures, especially Silk Road. That reporting treated a content category, criminal shops, as if it were the network category, overlay sites. Privacy tools, newsroom tip lines, and mirrors of blocked sites use the same kind of address. The address does not say which of those you opened, and it does not make the operator trustworthy. A key proves you reached the service that holds that key. It does not prove the service is honest. How this site treats directories is a separate guide: Tor myths.
Where Tor fits
Tor is an anonymity network, published as free software, whose design goal is private access to an uncensored internet. Traffic is encrypted in layers and passed through volunteer relays so that no single hop is supposed to see both who you are and where you are going. That job covers two different destinations.
Clearnet over Tor. Tor Browser can open ordinary websites. The path leaves the network at an exit relay, and the site sees the exit address, not yours. You are using Tor. You are not "on the dark web." People who publish Tor metrics have long treated onion-service traffic as a small share of what the network carries. Most of the bandwidth is people reaching the public web.
Onion services. A service that publishes a .onion address meets the visitor inside the network. There is no public exit. The service's network location stays hidden, which is why these used to be called hidden services. The Tor Project describes that path as staying inside Tor: both sides are on the network, which is why the connection does not depend on the public web's certificate system in the same way an exit hop does. Newsrooms use this pattern for tip lines. Some publishers also mirror their own sites as onions so readers on censored networks can reach them. Those are dark-web sites in the technical sense. They are not a market, and this page is not a shopping guide.
Other overlays exist. I2P and Hyphanet are not Tor, and a Tor Browser session does not open them. "Dark web" is the umbrella for that family of networks, not a brand name for one browser.
Why the three are not the same
Each name draws a different line:
- Surface versus deep is about indexing. The tool in question is a search crawler. The gate is often a login, a form, or a missing link.
- Deep versus dark is about the network you must join. The tool is special software. The gate is the overlay, not a password on the public web.
- Tor versus the dark web is about destination. Tor is a way to travel. The dark web, in the strict sense, is one class of destination: onion services and their cousins on other overlays. It is not every page the browser can open.
The popular iceberg drawing teaches the opposite. It puts a thin surface above the water and labels everything below as one hidden realm. That is a bad map. Unindexed pages are the bulk of the web, and they are mostly mundane. Overlay sites are a further, smaller set. Fraud and other crime show up on the surface web too. The layer does not decide the act. This page stops at the distinction. It does not describe how to buy, sell, or deceive anyone.
Common mix-ups
"Deep web" used as a synonym for "dark web." This is the oldest slip. Once market coverage used the phrases interchangeably, directories copied the habit. A page that calls every unindexed URL and every .onion a "deep web link" is using a slogan, not the indexing definition.
"I installed Tor, so I am on the dark web." You are on Tor. If the address is a normal domain, you are looking at the surface web or the deep web through an exit. The dark-web part begins when the address only resolves inside an overlay.
"If it is not on Google, someone hid it on purpose." A lot of deep-web material is unindexed because a crawler cannot submit your password, not because the publisher joined a darknet.
"A .onion is the whole of Tor." Onion services are one feature. Bridges, exits, and Tor Browser's fingerprint work are about reaching, or disguising the path to, the ordinary web. An onion hostname is an address. It is not the network.
"Dark means illegal." The overlay is a publishing and reading tool. Lawful and unlawful speech both use it, the same way both use the public web. What the law cares about is the act, not the layer. Running the browser is a different question from what someone publishes, and it is not legal advice to say so.
A compact comparison
| Question | Surface web | Deep web | Dark web |
|---|---|---|---|
| Typical tool | Ordinary browser | Ordinary browser | Overlay software (Tor, I2P, Hyphanet) |
| Search engines | Often indexed | Not indexed, or not meant to be | Not indexed by ordinary engines |
| Usual gate | A public link | Login, paywall, form, or no inbound link | The overlay itself |
| Example | A public article | Webmail, a bank, a paywalled story | A .onion site, an I2P site |
| Where Tor fits | Optional path, via an exit | Optional path, via an exit | Required for Tor onion services |
Sources
- Wikipedia, Deep web and Dark web: the indexing history and the overlay definition.
- Tor Project, anonymity online: Tor Browser is for private access to the web, not a synonym for onion sites.
- Tor Project, glossary: an onion service is a service only reachable through Tor.
- Tor Project, onion service properties: that path stays inside the network, unlike a visit to a normal site through an exit.