The dark web sounds more mysterious than it is. It’s a set of websites that Google can’t find and ordinary browsers can’t open, with addresses that end in .onion instead of .com. Some people go there out of curiosity. Others use it to read news that’s censored where they live, or to join forums without revealing who they are.
Getting in is free and takes a few minutes. Getting in safely takes a little more care, because a fake copy of a site or the wrong download can expose your identity or infect your computer. Whether a VPN helps depends on where you live and who can see your connection. Here’s the whole setup, one step at a time.
How to Access the Dark Web Safely: Short Version
- Download Tor Browser from the official site, torproject.org.
- Connect a VPN first if you’d rather your internet provider didn’t see you using Tor. NordVPN has an independently audited no-logs policy.
- Open the Tor Browser and click Connect.
- Set the security level to Safest before you visit any site.
- Enter a .onion address you’ve verified with a source you trust.
How to Access the Dark Web Safely in 5 Steps
Step 1: Download Tor Browser From the Official Site
Tor Browser is a free browser that opens .onion sites, and the only safe source for it is the official site, torproject.org. Fake copies have turned up on download sites, in forum links, and in unofficial app stores, and a tampered Tor Browser can undo the protection you installed it for.
There are versions for Windows, macOS, Linux, and Android. On Android, the official app is also on Google Play, published by The Tor Project. However, there’s no Tor Browser for iPhone or iPad.
Step 2: Connect a VPN First, if You Want One
A VPN isn’t required to browse the dark web. It changes who can see that you use Tor. Without one, your internet provider can. With one, only the VPN company can.
That helps in two cases: in a country or network where using Tor draws attention, such as a workplace that monitors its network, and when you don’t want Tor’s entry relay to see your IP address. That relay is the first of three volunteer-run servers your traffic passes through, and a few have turned out to be malicious.
Connect the VPN before you open Tor Browser, never after. If Tor Browser is already open, close it, connect the VPN, and then reopen it. Since the VPN company now sees your connection to Tor, choose a VPN with an audited no-logs policy.
NordVPN‘s policy is independently audited, and its regular servers work with Tor Browser, as do those of the other VPNs in our best VPN for the dark web rankings. Skip its Onion Over VPN servers for this setup. They already send your traffic into Tor, so adding Tor Browser sends it through Tor twice and slows pages down.
They don’t replace Tor Browser either: when we tested Chrome, Firefox, and Edge on them, onion sites failed to load in every one.
Step 3: Open Tor Browser and Connect
Open Tor Browser and click Connect. It takes a few seconds to build a circuit, a chain of three relays, and pages then load more slowly than you’re used to. A wait of several seconds per page is normal, because every request passes through those relays first.
If it won’t connect, the network or country you’re in probably blocks Tor relays. Bridges fix that. A bridge is a relay that isn’t on Tor’s public list, so a network filter can’t block it by its IP address. To use one, open Settings, then Connection, then Bridges, and try obfs4 first, which disguises Tor traffic so filters don’t recognize it.
If a school or office network still blocks it, switch to Snowflake, which makes the connection look like an ordinary video call. Bridges and VPNs do different jobs. A bridge connects you to the Tor network when it’s blocked, while a VPN hides that you’re using it.
Step 4: Set the Security Level to Safest
Before you visit a single site, click the shield icon next to the address bar, choose Settings, then Change, and set the security level to Safest. Tor Browser restarts to apply it. This disables JavaScript on every site. JavaScript is the code that makes web pages interactive, and it’s the most common way attackers break into a Tor user’s browser.
As a result, some pages will look broken. A few fonts, icons, and images won’t show, and audio and video play only after a click. Given the protection, that’s a fair trade.
Step 5: Visit a Verified Onion Address
Now paste an onion address into the address bar, but check every address before you use it. Onion addresses are impossible to read at a glance, and fake copies of well-known sites are common, so compare each one with two independent sources.
A site you already know is a safer place to start than a link directory. For example, the BBC and ProPublica publish onion versions of their own sites. Tor Browser also helps here: when a regular website has an onion version, an .onion available button appears in the address bar, and clicking it opens the genuine one.
What Is the Dark Web and How Does It Work?
The dark web is the part of the internet that search engines don’t index and ordinary browsers can’t open. People often confuse it with the deep web, which is much bigger and far more ordinary:
| Layer | How you reach it | Examples |
| Surface web | Any browser, through search engines | News sites, online stores, Wikipedia |
| Deep web | Any browser, once you log in | Email inbox, bank account, company intranet |
| Dark web | Tor Browser only | .onion sites: forums, privacy tools, censored news |
Each onion address is generated from the site’s own encryption key, so no company registers it, and it reveals nothing about where the server is. To reach these sites, Tor, short for The Onion Router, sends your traffic through three volunteer-run relays.
The first relay sees your IP address but not the site, and the last sees the site but not you, so no single relay can link you to what you’re reading. Accessing the dark web is legal in the US, the UK, Canada, Australia, and most of Europe. Buying illegal goods isn’t, and a VPN won’t change that.
Tor Over VPN vs VPN Over Tor
You can combine a VPN and Tor in two ways, and we recommend only one.
Tor Over VPN, the Practical Choice
Pros
- Simple to set up
- ISP can’t see Tor use
- Entry relay never sees your IP address
Con
- Some sites block Tor
This is the order we recommend: the VPN first, then Tor Browser. It hides Tor from your internet provider and your IP address from the entry relay, so even a malicious relay can’t trace the connection to your home.
The one downside is the same as with Tor alone: sites that block Tor’s exit relays, the last relay in the chain, still block you. For those sites, close Tor Browser and use a normal browser with the VPN connected, knowing you lose Tor’s protection for that visit.
VPN Over Tor, and Why We Skip It
Pros
- Works on sites that block Tor
- ISP can’t see the VPN
Cons
- Tedious manual setup
- VPN sees your activity
- Entry relay sees your IP address
- ISP sees Tor use
With this method, you connect to Tor first and the VPN second. Few VPNs support it, so it usually means setting up a server by hand. Your internet provider can see you’re using Tor, because nothing encrypts that connection first, and the entry relay sees your own IP address.
Worse, the VPN company sees every site you visit through it, which undoes the point of Tor. The main advantage is access to sites that block Tor exit relays. It also hides VPN use from your internet provider, but VPNs are legal in most countries, so that rarely helps.
How to Get on the Dark Web on Your Phone
On Android, the setup matches a computer. Install Tor Browser from Google Play or torproject.org, switch on your VPN first if you use one, and then open Tor Browser and connect. The security level is in its settings, under Privacy and security.
An iPhone is harder, because Tor Browser has no iOS version. Apple’s browser rules block the privacy protections Tor Browser relies on, so the Tor Project lists Onion Browser and Orbot instead, while saying neither matches the desktop browser.
Background apps can also send data outside Tor, so use a computer for anything sensitive. For a quick look out of curiosity, Onion Browser with a VPN on the iPhone lowers the risk, but it doesn’t remove it.
Is It Safe to Use the Dark Web?
Parts of it are, and the risk depends on what you do there. Reading is low risk, since most onion sites work like any other website. The risk starts when you interact. Marketplaces and any site requesting personal details or payment attract scams, and there’s no way to recover your money when a scam succeeds.
Malware is also more common on the dark web than on the ordinary web. The Safest setting blocks most of that malware before the first page loads. A few habits lower the risk further:
- Download no files, because a document from an onion site can reveal your real IP address if you open it outside Tor Browser.
- Share nothing that identifies you, from your name to photos of your surroundings.
- Don’t reuse a username or an email address from other sites.
- Update Tor Browser as soon as it offers a new version, since updates close the flaws attackers look for.
For higher-stakes work, such as a journalist protecting a source, Tails goes a step further. It’s a free operating system from the Tor Project that starts from a USB stick, sends everything through Tor, and leaves no trace on the computer once you shut it down.
Final Thoughts
The safe setup is short: the official Tor Browser, set to Safest, and onion addresses you’ve verified before you paste them. Each of those closes a different risk, from tampered downloads to malicious scripts to fake copies of genuine sites. A VPN is optional for most people.
It helps when Tor use draws attention where you live or work, and NordVPN is the one we’d connect before opening Tor Browser. If you’d rather not pay, the free VPNs that work with Tor Browser are another option.
One last tip: bookmark the onion sites you’ve verified, so you don’t have to look for them again. If a bookmark stops working, check the new address with two sources before you use it.
Dark Web FAQ
Do you need a VPN to access the dark web?
No. Tor Browser opens .onion sites on its own. A VPN only hides Tor use from the internet provider and keeps the real IP address away from Tor's first relay.
Can you get a virus from the dark web?
Yes, mostly through downloaded files and malicious scripts. Tor Browser's Safest security level turns off JavaScript, and skipping downloads removes the most common way malware reaches a computer.
Can your ISP see that you're on the dark web?
It can see a connection to the Tor network, but not the sites visited through it. Connecting a VPN before opening Tor Browser hides the Tor connection as well.
How do you find .onion sites?
There's no Google for onion sites. Many organizations list their onion address on their regular website, and Tor Browser flags a site's onion version when one exists. Link directories often contain fakes.
Is Tor Browser safe to download?
Yes, from the Tor Project's official website or its Google Play listing. Copies from download portals, forum links, or unofficial app stores can be tampered with and expose the user.
Do onion sites change their addresses?
Usually not. An onion address comes from the site's encryption key and stays the same while the operator keeps it, but some sites move to a new address after security problems or attacks.