What is the dark web and should you use it
The phrase "dark web" sounds ominous, conjuring images of hoodie-clad figures trading in shady markets. In reality, the dark web is simply a layer of the internet that doesn't show up in Google searches and requires special software to reach. Curiosity about this hidden corner has grown in Australia, partly because high-profile data leaks at Optus, Medibank and Latitude Financial made everyday Australians more aware of how exposed their personal information really is. Learn more about How To Secure.
Beneath the familiar web of news sites, online shops and streaming platforms lies a much larger mass of unindexed content known as the deep web. The dark web is a small, intentionally hidden subset of that, accessible through anonymising networks. Whether it deserves its sinister reputation, or whether an everyday reader in Perth or Brisbane should ever bother visiting, is a different question entirely.
Beyond Google: how the dark web differs from the deep web
Most people use the terms "deep web" and "dark web" interchangeably, but they refer to quite different things. The deep web is everything a search engine can't see, including your email inbox, the back end of a university's enrolment portal, the contents of your account on a streaming service, or the records held inside MyGov. Nothing about that content is secret; it just isn't indexed. By some estimates, the deep web is several hundred times bigger than the visible web.
The dark web, by contrast, is a deliberately hidden overlay network that requires special software to access. Sites on it use non-standard addresses that don't resolve through the normal Domain Name System. The content varies wildly, from political dissident forums and academic archives to illicit marketplaces. Understanding the distinction matters for Australians deciding what kind of privacy they actually need.
| Layer | What it is | How you reach it | Typical content |
|---|---|---|---|
| Surface web | Pages indexed by Google, Bing or DuckDuckGo | Any standard browser | News, blogs, e-commerce, government portals |
| Deep web | Pages blocked from indexing | Login or direct URL | Online banking, health records, internal company wikis |
| Dark web | Overlay networks with hidden addresses | Tor, I2P, Freenet | Whistleblower drop boxes, privacy forums, illicit markets |
The plumbing: Tor, I2P and hidden services
The best-known route onto the dark web is the Tor browser, originally developed by US naval researchers and now maintained by a non-profit. Tor bounces a user's traffic through three random volunteer relays, peeling back a layer of encryption at every hop so no single relay knows both who you are and what you're requesting. Sites hosted inside this network use the .onion suffix and aren't reachable without Tor running on the visitor's machine.
Alternatives exist, though they have smaller audiences. I2P, or the Invisible Internet Project, focuses on hidden services rather than anonymising access to the public web. Freenet takes a different approach again, distributing encrypted content across a peer-to-peer network so that no single server can be raided and shut down. For most Australians reading this on an NBN FTTP connection in Sydney or a fixed-wireless service in regional Queensland, the practical choice remains Tor.
What's actually there: legitimate and illegitimate uses
The dark web isn't all black markets. Several well-known organisations run hidden services so that whistleblowers, journalists and activists in repressive regimes can submit tips safely. Major international newsrooms maintain .onion mirrors for sources in countries where the regular site might be blocked or monitored. Privacy advocates and security researchers also use it to study how criminal enterprises function, sharing findings with law enforcement.
That said, the same features that protect dissidents also shelter markets trading in stolen data, counterfeit documents and drugs. Stolen credentials from Australian breaches have, at various points, appeared for sale in these markets, alongside forged identification and remote-access tools. Knowing what to expect before browsing helps keep curiosity from drifting into genuinely harmful territory.
Reasons Australians sometimes consider using the dark web include:
- Reaching news sources and whistleblowing platforms without exposing their identity to an internet provider
- Researching cybersecurity topics in forums blocked by overzealous workplace filters
- Communicating more privately with journalists working on stories involving local courts or politics
- Checking whether their own email or phone number appears in leaked datasets from recent Australian breaches
Risks, scams and the Australian legal picture
The legal landscape is sharper than many people realise. Under the Criminal Code Act 1995, Australians can be prosecuted for offences committed online even if the server is in another country, and the Australian Federal Police work with overseas agencies through the Joint Criminal Investigation Unit. Several high-profile operations in the last decade have led to arrests in Melbourne, Sydney and Adelaide for buying or selling items that are legal in some countries and illegal in others.
Beyond the law, the day-to-day risks are practical. Scams on these networks are common, and there's almost no consumer protection if something arrives unwatched, broken, or not at all. Worse, simply visiting certain pages can expose a visitor's real IP address if their setup isn't configured correctly, particularly on JavaScript-heavy markets.
Red flags to watch for include:
- Listings that demand payment only in privacy coins like Monero or Zcash, with no escrow option
- Vendors with no transaction history, brand-new handles, or excessive pressure to finalise a deal quickly
- Requests for scans of a passport, driver's licence or Medicare card before any transaction
- Forum posts claiming to leak credentials from Telstra, AGL or other local providers that turn out to be recycled data
If a user's real details have appeared in a leak, the eSafety Commissioner and the Australian Cyber Security Centre both publish guidance on what to do next, including how to obtain a free credit report and how to report identity theft.
Should you use it? A practical guide
For most people in Australia, the answer is no, you don't need to. If the goal is simply more privacy online, a reputable VPN combined with disciplined password hygiene is usually enough. If the goal is accessing a specific legitimate service that genuinely requires Tor, such as a research database or a censored news site, then a careful approach is reasonable.
Before opening Tor for any reason, a few sensible steps reduce the risk dramatically. Download the browser only from the official Tor Project site, never from a third-party mirror. Avoid logging into any personal account while the browser is open, since cookies and JavaScript can pierce the anonymity layer. Run the browser inside a trusted operating system, ideally a Linux live session on a machine that doesn't contain the user's real identity. For more detail on locking down a device before any exploration, Cybernet Today's practical safeguards guide walks through the relevant settings.
It's also worth remembering that the dark web is not faster, easier, or more reliable than the regular internet. Pages load slowly, search tools are clunky, and many links are dead. Most of what people go looking for can be found on the open web through legitimate channels, including ABC News investigations, the Australian Government's cyber.gov.au portal, and academic databases accessed through a university library.
Stay informed before you explore
The dark web is a real place with real consequences, not a myth, but not a tourist attraction either. Treating it as a curiosity to be approached carefully, the same way someone might approach a deserted industrial site, keeps a casual reader in Melbourne or a journalist in Canberra out of trouble. Most Australians will never have a reason to visit, and for those who do, preparation matters far more than bravado.
Cybernet Today covers the practical side of online safety, from how to recognise a phishing text aimed at a Telstra customer to what to do after a data breach. Readers who want to keep their browsing private without venturing into the hidden web can browse the site's other guides, subscribe to updates, and share the resources with family members who might be about to click something they shouldn't.
