Deep Web vs Dark Web: Key Differences Explained

Understanding the Surface Web: The Starting Point

Most people spend their entire online lives on the surface web without realising it. The surface web contains indexed content easily accessible with traditional search engines like Google¹. When you search for a news article, check the weather, or browse an online shop, you're navigating the surface web. Search engine crawlers—automated programs that scan and catalogue web pages—can reach this content without authentication or special software. The result is a searchable index of billions of pages, from BBC News to Amazon product listings.

The surface web represents only a fraction of the total internet. Common examples include news sites, e-commerce stores, public blogs, Wikipedia, government information pages, and social media profiles set to public. These sites actively invite search engines to index their content, using sitemaps and meta tags to ensure visibility. For most people, the surface web is synonymous with 'the internet'—the visible, searchable layer where daily tasks happen.

Understanding the surface web establishes a baseline for comparison. When we say the deep web constitutes approximately 90% of the entire internet², that proportion becomes meaningful only when you recognise how small the surface web is. The surface web is not inherently safer or more legitimate than the deep web; it simply lacks access barriers. A phishing site on the surface web is indexed and searchable, while your secure online banking portal—part of the deep web—requires login credentials. The distinction is about accessibility and indexing, not legality or risk.

Before exploring the deep web and dark web, recognising this baseline helps clarify what makes those layers different. The surface web is where search engines work; the deep web is where they cannot reach; the dark web is where anonymity tools are required. Each layer serves different purposes, and conflating them leads to misunderstanding both the infrastructure you use daily and the threats that may affect you.

For a detailed exploration of the next layer, see Understanding the Deep Web: What You Need to Know.

What is the Deep Web?

The deep web is content that search engines cannot index. When you log into your online banking portal, access your company's cloud storage, or check a subscription-based database, you're using the deep web. Google, Bing, and other search engines cannot reach these pages because they sit behind login screens, paywalls, or dynamically generated queries. The deep web constitutes approximately 90% of the entire internet and contains company databases, streaming servers, and online memory storage².

This lack of indexing is not a security flaw—it's intentional design. Your bank does not want Google crawling your account balance. Your employer does not want competitors finding internal documents through a simple search. The deep web exists to protect private, sensitive, or personalised content from public access. It is not hidden in the sense of requiring special software; you access it every day with a standard browser and valid credentials.

Why Content Resides on the Deep Web

Three main factors keep content off search engine indexes:

• Authentication barriers: Login screens prevent search engine crawlers from accessing content. Your email inbox, CRM system, and payroll portal all require credentials that crawlers do not possess.

• Dynamic content: Pages generated in response to specific queries—such as flight search results or database lookups—do not exist as static URLs for crawlers to find. Each query creates a unique page that disappears after the session ends.

• Explicit exclusion: Site owners use robots.txt files and meta tags to instruct search engines not to index certain pages, even if those pages are technically accessible without login. Internal documentation, staging environments, and archived content often fall into this category.

The deep web is not a single place or network. It is a functional category describing any content that standard search engines cannot catalogue, whether that content is mundane, sensitive, or proprietary.

Practical Examples for Everyday Use

Consider the services you use regularly:

• Online banking portals: Your account dashboard, transaction history, and payment forms are all deep web content. No search engine can access them without your credentials, and your bank actively blocks indexing to protect your privacy.

• Cloud storage: Files stored in Dropbox, Google Drive, or Microsoft OneDrive remain unindexed unless you explicitly share a public link. Even then, the parent folder and your account structure stay hidden.

• Subscription services: Academic journals, legal databases, and industry reports require paid access. Search engines may index the landing page, but the full-text articles and datasets remain on the deep web until you authenticate.

• Private intranets: Company wikis, project management tools, and internal forums are accessible only to employees via VPN or direct network access. These systems are intentionally isolated from public search engines.

For a small business, the deep web includes your CRM database, employee timesheets, client invoices stored in accounting software, and any shared folders restricted to team members. None of this content is sinister or unusual—it is simply private by design.

The Deep Web is Essential, Not Dangerous

The deep web is not a threat landscape. It is infrastructure. The same authentication and access controls that keep your content off Google also protect it from unauthorised access. The risks associated with the deep web are the same as those for any password-protected system: weak credentials, phishing attacks, and inadequate access management. These are routine cybersecurity concerns, not unique properties of the deep web.

Conflating the deep web with the dark web—a much smaller, intentionally anonymous segment requiring tools like Tor²¹—leads to misplaced anxiety. When someone warns you about 'the hidden internet', they are almost always referring to the dark web, not the deep web. Your online banking is hidden from search engines, but it is not anonymous, encrypted beyond standard HTTPS, or associated with illicit activity. The deep web is where you manage your finances, store your files, and run your business. Understanding this distinction prevents both unnecessary fear and complacency about real threats.

For a deeper exploration of how the deep web functions and its role in daily operations, see Understanding the Deep Web: What You Need to Know.

What is the Dark Web?

The dark web is a small, intentionally hidden portion of the deep web that requires specific software to access²¹. While the deep web includes everyday services like online banking and cloud storage, the dark web is designed for anonymity. You cannot reach it with Chrome, Firefox, or Safari alone—you need tools like Tor Browser, which routes your connection through multiple encrypted relays to mask your identity and location. This architectural difference separates the dark web from the rest of the internet: it is not merely unindexed, but actively concealed.

The dark web operates on overlay networks—systems built on top of the standard internet infrastructure. Tor ('The Onion Router') is the most widely used, encrypting your traffic in layers and bouncing it through volunteer-operated servers worldwide before reaching the destination². Each relay knows only the previous and next hop, not the full path, making it difficult to trace activity back to you. Other anonymisation networks exist, but Tor dominates: in 2023, the dark web had an average of 2.5 million daily visitors via Tor³. In the first ten months of 2024, the mean number of daily Tor users in the United States was 430,054, representing 13.7% of total mean daily Tor users worldwide⁴.

Why the Dark Web Exists: Privacy and Anonymity

The dark web serves two purposes. First, it provides privacy-enhancing tools for people who need to communicate securely. Journalists in countries with state surveillance use the dark web to protect sources. Whistleblowers submit documents to platforms like SecureDrop, which operates as a Tor hidden service, without revealing their identity. Activists in oppressive regimes access uncensored information and organise without government interference. For these users, the dark web is not a criminal hideout—it is a lifeline.

Second, the same anonymity attracts illicit activity. Marketplaces selling stolen credentials, counterfeit documents, and illegal goods operate openly on the dark web. In 2023, there was a 44.8% increase in compromised account credentials and other valuable data circulating on the dark web compared to 2022⁵. Threat actors use Tor to mask their identity when conducting reconnaissance, exfiltrating data, and delivering ransomware payloads⁶. The average number of monthly blog posts by threat actors on public platforms and the dark web surged to 476 in 2023, peaking at 634 posts in November⁷. The dark web is not inherently criminal, but its design makes it attractive to those who need to hide their actions—whether those actions are legitimate or illegal.

What You Find on the Dark Web

Dark web content falls into several categories:

• Encrypted communication platforms: Forums, messaging services, and email providers designed to protect user identity. These are used by activists, journalists, and privacy advocates, but also by criminals coordinating illegal activity.

• Whistleblowing platforms: Sites like SecureDrop allow anonymous submission of documents to news organisations. These platforms rely on Tor to protect sources from retaliation.

• Illicit marketplaces: Vendors sell stolen data, hacking tools, counterfeit currency, and illegal substances. Payment typically occurs in cryptocurrency to further obscure identity. Law enforcement regularly shuts down these markets, but new ones emerge.

• Data breach repositories: Compromised credentials, credit card numbers, and personal information harvested from breaches circulate on dark web forums and marketplaces. Small businesses often discover their data here after a breach.

The dual nature of the dark web means that the same technology protecting a journalist in Belarus also shields a ransomware operator in Eastern Europe. The distinction lies in intent and action, not the tool itself.

Accessing the Dark Web: Technical Requirements

You cannot stumble onto the dark web by accident. Standard browsers do not support .onion addresses—the domain suffix used by Tor hidden services. You must download Tor Browser, configure it correctly, and understand the risks. Using a VPN before accessing the dark web can conceal your IP address and encrypt your traffic, adding an extra layer of security⁸. Running Tor inside a virtual machine reduces the risk of infection or compromise, as the virtual layer can be erased if infected⁹. The risk of malware spreading is significantly higher on the dark net than on the clear web², so precautions are not optional—they are essential.

For individuals and small business owners, the dark web is not a place to explore casually. If your business data appears there, you need monitoring services—not direct access. If you are researching the dark web for informational purposes, understand that anonymity cuts both ways: you cannot see who operates a site, and they cannot see you, but malicious actors exploit this opacity to distribute malware and scams.

For further context on how the dark web fits within the broader hidden internet, see Understanding the Deep Web: What You Need to Know.

Key Differences: Deep Web vs. Dark Web

The terms 'deep web' and 'dark web' are often used interchangeably, but they describe fundamentally different parts of the internet. The confusion stems from a simple fact: all dark web content is part of the deep web, but the vast majority of the deep web is not part of the dark web. Understanding this relationship clarifies why accessing your email is routine, while accessing the dark web requires deliberate technical steps.

The deep web constitutes approximately 90% of the entire internet and contains company databases, streaming servers, and online memory storage². It is defined by a single characteristic: search engines cannot index it. Your online banking portal, cloud storage, and subscription services all reside on the deep web because they require authentication or are explicitly excluded from indexing¹. This content is unindexed by design, not by anonymity.

The dark web is a comparatively small part of the deep web, where communication is encrypted, and content creators and visitors seek anonymity². It is a segment of the deep web that is intentionally hidden and generally requires special software like Tor to access¹. The distinction is architectural: the deep web is simply unindexed, while the dark web is actively concealed through encryption and routing protocols. In 2023, the dark web had an average of 2.5 million daily visitors via Tor³—a fraction of the billions who access the deep web daily through standard browsers.

Accessibility and Technical Requirements

You access the deep web every day without realising it. Logging into your email, checking your bank balance, or opening a shared document in cloud storage—all of these actions involve the deep web. No special software is required; you use Chrome, Firefox, or Safari with standard HTTPS encryption. The barrier is authentication, not technology.

The dark web requires specific tools. You cannot reach .onion sites with a standard browser. Accessing the dark net typically requires anonymisation networks such as Tor ('The Onion Router') or dark net search engines². Tor Browser routes your connection through multiple encrypted relays to mask your identity and location. Using a Virtual Private Network (VPN) before accessing the dark web can conceal your IP address and encrypt your traffic, adding an extra layer of security⁸. Using a virtual machine (VM) can reduce the risk of infection or compromise when browsing the deep or dark web, as it provides a virtual layer of security that can be erased if infected⁹.

This technical barrier is intentional. The dark web is not designed for casual browsing—it exists for users who need anonymity, whether for privacy protection or illicit purposes.

Indexing and Discoverability

The surface web contains indexed content easily accessible with traditional search engines like Google¹. The deep web contains unindexed content that cannot be accessed with a simple Google search, including private intranets and commercial databases¹. The dark web is also unindexed, but it goes further: even if you know the exact .onion address, you cannot reach it without Tor or similar anonymisation networks.

Search engines on the dark web exist, but they catalogue only a small fraction of available sites. Most dark web content is shared through forums, encrypted messaging platforms, or word of mouth. Discoverability is deliberately limited to protect anonymity.

Legality and Common Content

Accessing the deep web is legal and routine. Every time you log into a password-protected service, you are accessing the deep web. The content itself—banking records, medical files, corporate databases—is lawful and essential to daily operations.

Accessing the dark web is not illegal in most jurisdictions, including the United Kingdom. Downloading Tor Browser and visiting .onion sites does not violate the law. However, engaging in illegal activities on the dark web—purchasing stolen data, distributing malware, or coordinating criminal operations—is prosecuted under existing laws. Malicious cyber actors use Tor to mask their identity when engaging in activities such as reconnaissance, penetrating systems, exfiltrating data, and delivering ransomware payloads⁶.

The dark web hosts both legitimate and illicit content. Whistleblowing platforms, encrypted communication tools, and privacy-focused forums operate alongside marketplaces selling stolen credentials and illegal goods. In 2023, there was a 44.8% increase in compromised account credentials and other valuable data circulating on the dark web or accessible on messaging platforms compared to 2022⁵. The average number of monthly blog posts by threat actors on public platforms and the dark web surged to 476 in 2023, peaking at 634 posts in November⁷.

The legal distinction is clear: the tool is neutral, but the actions taken with it are not. For individuals and small business owners, the practical takeaway is simple: you access the deep web daily without risk; you should approach the dark web with caution and a clear purpose, understanding that the risk of malware spreading is significantly higher on the dark net than on the clear web².

For a more detailed exploration of how the deep web functions in everyday contexts, see Understanding the Deep Web: What You Need to Know.

Accessing the Deep Web vs. Dark Web: Practicalities

You access the deep web every day without thinking about it. Logging into your email, checking your bank balance, opening a shared document in cloud storage, or accessing your company's CRM system—all of these actions involve the deep web. No special software is required. You use Chrome, Firefox, or Safari with standard HTTPS encryption. The barrier is authentication, not technology. You enter a username and password, and the server grants access to content that search engines cannot index.

The dark web requires deliberate technical steps. You cannot reach .onion sites with a standard browser. Accessing the dark net typically requires anonymisation networks such as Tor ('The Onion Router') or dark net search engines². Tor Browser routes your connection through multiple encrypted relays to mask your identity and location. In 2023, the dark web had an average of 2.5 million daily visitors via Tor³, and the mean number of daily Tor users in the United States across the first 10 months of 2024 was 430,054, representing 13.7% of total mean daily Tor users worldwide⁴. This technical barrier is intentional—the dark web is not designed for casual browsing.

What You Need for Each

For the deep web, you need:

• A standard web browser (Chrome, Firefox, Safari, Edge)

• Login credentials for the service you want to access

• An internet connection with HTTPS support

For the dark web, you need:

• Tor Browser or a similar anonymisation tool (such as I2P)

• A VPN to conceal your IP address before connecting to Tor⁸

• A virtual machine (VM) to isolate your browsing environment and reduce the risk of infection⁹

• The specific .onion address of the site you want to visit

The risk of malware spreading is significantly higher on the dark net than on the clear web², so precautions are not optional—they are essential. Using a virtual machine can reduce the risk of infection or compromise when browsing the deep or dark web, as it provides a virtual layer of security that can be erased if infected⁹.

Implications for Small Businesses

Employees routinely access deep web resources as part of their daily work: internal databases, project management platforms, customer relationship management systems, and cloud storage. These systems are protected by authentication and encryption, but they remain part of the standard internet infrastructure. Access is controlled through role-based permissions and monitored through audit logs.

Unauthorised dark web access from a business network carries different implications. Malicious cyber actors use Tor to mask their identity when engaging in activities such as reconnaissance, penetrating systems, exfiltrating data, and delivering ransomware payloads⁶. If an employee downloads Tor Browser on a work device, it may indicate legitimate privacy concerns—or it may signal an attempt to exfiltrate data or communicate with threat actors. IT policies should address this clearly: personal use of anonymisation networks on business devices should be prohibited unless explicitly authorised for security research or legal purposes.

For further context on how the deep web functions in everyday contexts, see Understanding the Deep Web: What You Need to Know.

Security and Risks: Deep Web vs. Dark Web

The deep web and dark web carry different security profiles. The deep web—your email, banking portal, cloud storage—faces the same risks as any authenticated service: phishing attacks, weak passwords, and data breaches of legitimate platforms. These threats are familiar and manageable through standard practices: two-factor authentication, password managers, and regular software updates. The attack surface is known, and the defences are well-documented.

The dark web introduces heightened risks. The risk of malware spreading is significantly higher on the dark net than on the clear web². Malicious cyber actors use Tor to mask their identity when engaging in activities such as reconnaissance, penetrating systems, exfiltrating data, and delivering ransomware payloads⁶. Scams are pervasive: marketplaces disappear overnight with users' funds, phishing sites mimic legitimate .onion addresses, and malware is distributed through seemingly benign downloads. Exposure to illegal content—even unintentional—can have legal consequences depending on jurisdiction and intent.

Risks for Individuals

For individuals, deep web risks centre on account security. Phishing emails that mimic your bank or email provider attempt to steal credentials. Data breaches of legitimate services—streaming platforms, retailers, healthcare providers—expose personal information that can be sold on dark web marketplaces. In 2023, there was a 44.8% increase in compromised account credentials and other valuable data circulating on the dark web or accessible on messaging platforms compared to 2022⁵. Weak or reused passwords amplify the damage: one breach becomes many.

Dark web risks escalate. Downloading Tor Browser is legal, but visiting .onion sites exposes you to malware, scams, and content that may be illegal to view or possess. Using a virtual machine (VM) can reduce the risk of infection or compromise when browsing the deep or dark web, as it provides a virtual layer of security that can be erased if infected⁹. Using a Virtual Private Network (VPN) before accessing the dark web can conceal your IP address and encrypt your traffic, adding an extra layer of security⁸. Without these precautions, a single compromised download can infect your device, steal your files, or enrol your machine in a botnet.

Risks for Small Businesses

Small businesses face deep web risks through employee accounts and third-party services. A compromised employee email account can grant attackers access to internal systems, customer data, and financial records. Phishing campaigns targeting employees remain the most common entry point for breaches. Data breaches of cloud storage providers or SaaS platforms expose business information even when your own security practices are sound.

Dark web threats to small businesses are more insidious. Stolen credentials, ransomware, and intellectual property theft circulate on dark web marketplaces and forums. The average number of monthly blog posts by threat actors on public platforms and the dark web surged to 476 in 2023, peaking at 634 posts in November⁷. Threat actors discuss vulnerabilities, share stolen data, and coordinate attacks. Your business may be targeted without your knowledge: credentials harvested from a third-party breach, customer data sold on a marketplace, or ransomware deployed after reconnaissance conducted through Tor.

Monitoring dark web activity is not paranoia—it is due diligence. Services that scan dark web marketplaces and forums for your domain, employee email addresses, or leaked credentials provide early warning. If your data appears, you can act: reset passwords, notify affected customers, and investigate the breach source. Without monitoring, you learn about the compromise only after the damage is done.

Why the Distinction Matters for Small Businesses

The deep web is not a threat—it is the infrastructure your business runs on. Every time you log into your accounting software, access your CRM, or retrieve files from cloud storage, you are using the deep web². These systems are unindexed by design: they contain sensitive business data that should never appear in a Google search¹. Understanding this removes unnecessary anxiety. Your employees are not 'entering the deep web' when they check email or update a project management tool—they are performing routine tasks on secure, authenticated platforms.

The dark web requires a different mindset. It is a comparatively small part of the deep web, where communication is encrypted and content creators and visitors seek anonymity². For small businesses, the dark web matters for one reason: it is where your stolen data ends up. In 2023, there was a 44.8% increase in compromised account credentials and other valuable data circulating on the dark web or accessible on messaging platforms compared to 2022⁵. Employee credentials, customer records, and proprietary information are traded on marketplaces and discussed in forums. The average number of monthly blog posts by threat actors on public platforms and the dark web surged to 476 in 2023, peaking at 634 posts in November⁷.

Consider this scenario: you learn that a third-party service your business uses suffered a data breach. Employee email addresses and passwords were exposed. You reset passwords and notify staff, but you do not check whether those credentials have appeared on dark web marketplaces. Weeks later, an attacker uses a reused password to access your internal systems. The breach could have been contained if you had monitored dark web activity for your domain and employee email addresses.

Monitoring services scan dark web marketplaces and forums for your business information. If compromised credentials appear, you receive an alert and can act immediately: force password resets, audit access logs, and investigate whether the breach has already been exploited. Without monitoring, you discover the compromise only after the damage is done—data exfiltrated, ransomware deployed, or customer information sold.

The practical distinction is this: the deep web is where you conduct business securely; the dark web is where you monitor for threats. Both require attention, but for opposite reasons. The deep web demands strong authentication and access controls to protect legitimate operations. The dark web demands vigilance to detect when your defences have failed and your data has been stolen. Confusing the two leads to either complacency—dismissing the dark web as irrelevant—or paranoia—treating every authenticated system as a security risk. Neither serves your business well.

Common Misconceptions and Mistakes

All unindexed content is part of the dark web.

Many people assume that if content isn't on Google, it must be on the dark web. In reality, the deep web—which includes online banking portals, private cloud storage, and subscription services—makes up about 90% of the internet and is not indexed by search engines²¹. The dark web is a much smaller, intentionally hidden segment of the deep web that requires specific software like Tor to access²¹. Failing to differentiate means you might view your legitimate cloud storage as inherently suspicious, overlooking the actual security risks of credential compromise.

Accessing the deep web or dark web is illegal.

Accessing the deep web is a daily occurrence for most people, involving activities like logging into email or using online banking, and is perfectly legal. The dark web itself is not illegal to access in most jurisdictions; for example, using Tor to browse is legal in the UK. However, engaging in illegal activities on the dark web, such as purchasing illicit goods or stolen data, is unlawful. Misunderstanding this distinction can lead to unnecessary fear or, conversely, a false sense of security regarding illegal actions.

A VPN is sufficient for dark web anonymity.

While a VPN encrypts your traffic and conceals your IP address from your internet service provider, it does not provide full anonymity on the dark web⁸. The Tor network itself is designed for anonymity, but a VPN only adds a layer before you enter Tor. Relying solely on a VPN for dark web activities can expose your identity within the Tor network if not used correctly, potentially compromising your privacy.

The dark web is primarily for criminals.

While the dark web is used by malicious actors for activities like data exfiltration and ransomware delivery⁶, it also serves legitimate purposes. It provides a platform for secure communication for journalists, whistleblowers, and activists in oppressive regimes. For example, in 2023, the dark web had an average of 2.5 million daily visitors via Tor³, many of whom may be seeking privacy or circumventing censorship. Conflating the entire dark web with criminality overlooks its role in protecting freedom of speech and privacy.

Small businesses have no reason to be concerned about the dark web.

Small businesses are often targets of cybercrime, and their compromised data frequently appears on the dark web. In 2023, there was a 44.8% increase in compromised account credentials and other valuable data circulating on the dark web compared to 2022⁵. Ignoring the dark web as a threat source means missing critical intelligence about potential breaches affecting your business, employees, or clients. Proactive monitoring, rather than direct access, is crucial for protecting your assets.

Key Takeaways

We have explored the critical differences between the deep web and the dark web. To summarize:

• The deep web comprises the vast majority of the internet, including cloud services and online banking, and is accessed daily without special tools.

• The dark web is a small, intentionally hidden part of the deep web, requiring tools like Tor for access and offering anonymity.

• Deep web risks primarily involve credential compromise and data protection, while dark web risks include malware, scams, and exposure to illicit content.

• For small businesses, the deep web is essential infrastructure, while the dark web is a source of threat intelligence regarding compromised data.

• Proactive dark web monitoring is crucial for small businesses to detect compromised credentials and intellectual property.

To better understand the foundational concepts, we recommend reviewing our article on What is Deep Web? An Overview.

Explore More on Deep and Dark Web

Discover additional insights and resources on our site.