**Tor Browser** (latest stable — 15.0.14 as of May 2026) **A basic understanding** of how Tor works (see the beginner's guide) **No expectations** — the dark web is mostly slow, ugly, and boring

What Is Tor? A Beginner's Guide — How Tor works, key terms, and the dark web explained What Is Tails OS? The Amnesic Operating System — A complete OS that leaves no traces Tor Bridges and Pluggable Transports — How to bypass censorship when Tor is blocked

How to Stay Safe on the Dark Web: A Complete Security Guide

The dark web isn’t as scary as movies make it look. Most .onion sites are ordinary — forums, blogs, email services, file repositories. But it’s also where people with bad intentions operate, and mistakes that would be annoying on the regular internet can have serious consequences on the dark web.

The difference between safe and unsafe dark web browsing comes down to habits. Boring, repeatable habits. Here’s a complete guide to developing them.

The golden rule: Anonymity is not invincibility. Tor hides your IP, not your identity. Don’t act differently just because you feel invisible.
Three rules of safe browsing:
1. Disable JavaScript by default (use Safer security level)
2. Never enter personal information on a .onion site
3. Never download and open files while connected to Tor
What Tor protects against: Your ISP, mass surveillance, website tracking, censorship
What Tor does NOT protect against: Human error, malware, browser fingerprinting (mostly), timing attacks, physical device compromise

Before You Start

What You Need

Tor Browser (latest stable — 15.0.14 as of May 2026)
A basic understanding of how Tor works (see the beginner’s guide)
No expectations — the dark web is mostly slow, ugly, and boring

What You Should NOT Do

Do NOT use your regular email, name, passwords, or usernames
Do NOT enable JavaScript except on trusted sites
Do NOT torrent over Tor (slow, disruptive to the network, and can leak your IP)
Do NOT enter payment information or crypto wallet addresses on untrusted sites
Do NOT use Tor on a device that contains identifying personal files

Configuring Tor Browser for Safe Dark Web Browsing

Set the Security Level to Safer

Before browsing any .onion site, change the security level:

Click the shield icon in the address bar
Select Safer

This disables JavaScript on HTTP sites, disables risky fonts, and blocks WebGL, Web Audio, and other potential fingerprinting surfaces. Most .onion sites still work fine at this level.

For high-risk browsing, use Safest — disables JavaScript everywhere, but many sites will break.

Disable First-Party Isolation (Temporarily)

Tor Browser’s default setting isolates each site’s data. This is good for privacy but breaks some .onion sites. If a site doesn’t load correctly:

Go to about:preferences#privacy
Search for “first-party isolation”
Toggle if needed (restart after changing)

Keep Tor Browser Updated

Always use the latest version. Dark web sites are sometimes designed to exploit older browser vulnerabilities. Tor Browser updates automatically, but restart periodically to apply updates.

Verifying .onion Sites

Fake .onion sites are a major risk. Scammers create convincing copies of legitimate services (crypto exchanges, email providers, forums) to steal credentials.

Check the Site’s Fingerprint

Legitimate .onion services provide a .onion fingerprint — a cryptographic hash that verifies the site’s identity. You can find fingerprints on:

The service’s official website (on the surface web)
The Tor Project’s list of official onion services
Trusted directories and forums

Site	Official .onion Address	Where to Verify
DuckDuckGo	duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion	DuckDuckGo surface site
SecureDrop (each outlet)	Varies	`securedrop.org` directory
ProtonMail	protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion	ProtonMail support page
Facebook	facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion	Facebook help center

Use Onion-Location Headers

Many legitimate services redirect automatically to their .onion address when accessed through Tor. If you visit proton.me in Tor Browser and it offers to redirect you to the .onion version, that’s verified through the site’s HTTPS certificate.

Verify PGP Signatures

For high-risk communications (whistleblowing, journalism), verify PGP signatures. Legitimate services publish their PGP key alongside their .onion address. Cross-check the fingerprint across multiple sources.

The Tails OS Option

For high-risk browsing, use Tails OS instead of Tor Browser on your regular OS. Tails runs from a USB stick and leaves no traces on the host computer.

When to use Tails instead of Tor Browser:

You’re accessing sensitive content where exposure has real consequences
You’re using a shared or untrusted computer
You need to create documents or files that leave no trace
You want the maximum possible protection against forensic analysis

Read the full Tails OS guide for installation and setup instructions.

The VPN + Tor Debate

Should you use a VPN with Tor when accessing the dark web? Here’s the honest assessment:

VPN Before Tor (VPN → Tor)

Your traffic: You → VPN → Tor Network → .onion Site

Pros:

Your ISP cannot see you’re using Tor (only the VPN)
The VPN adds encryption before Tor

Cons:

The VPN company can see your real IP and that you’re connecting to Tor
If the VPN logs, your anonymity is compromised
Adds complexity

Verdict: Use this if you need to hide Tor usage from your ISP. Don’t use it for “extra security” — it doesn’t provide that.

Tor Before VPN (Tor → VPN)

Your traffic: You → Tor Network → VPN → .onion Site

Pros:

The website sees a VPN IP instead of a Tor exit IP
Avoids sites that block Tor exit nodes

Cons:

The VPN company knows both your Tor exit IP and the site you’re visiting
Eliminates most of Tor’s anonymity benefits

Verdict: Rarely useful. Only consider if you need to access a specific site that blocks Tor.

The Short Answer

For dark web browsing, use Tor alone or Tails. Don’t add a VPN unless you understand exactly what threat you’re mitigating and have verified that the VPN doesn’t log.

What Tor Does NOT Protect Against

This is the most important section in this guide. Knowing Tor’s limits is as important as knowing its strengths.

Malware

Tor cannot protect you from malicious files. If you download and run an executable while using Tor, your device can be compromised regardless of the network you used. The malware can then see everything on your device — including anything you do over Tor.

Rule: Never download files on Tor. If you absolutely must, open them in an isolated environment (Tails, a VM, a disposable device).

Browser Fingerprinting

Tor Browser includes extensive anti-fingerprinting measures (uniform window size, standardized headers, disabled WebGL, limited fonts). But determined adversaries can still fingerprint users through less common methods — installed system fonts (outside the browser), screen resolution, audio context fingerprinting, and timing patterns.

Rule: Use Tor Browser’s Security Slider at Safer or Safest. Don’t resize the window. Don’t install extensions.

Human Error

You are the weakest link in any security setup. Using your real username, logging into your real email, or mentioning identifiable information while connected to Tor can undo all technical protections.

Rule: Assume everything you do on the dark web could be traced back to you. Act accordingly.

Timing Analysis

A sophisticated adversary monitoring both your Tor entry guard and the target .onion site could correlate traffic patterns — matching the timing and volume of traffic at both ends. This is extremely difficult and requires significant resources, but it is possible.

Rule: Be boring. Consistent patterns (same websites at the same times) make timing analysis easier. Randomize your browsing behavior.

Physical Device Compromise

If law enforcement or an adversary gains physical access to your device, Tor cannot protect you. Encryption (full-disk encryption, encrypted Tor Browser profiles) is your defense here, not Tor.

Rule: Use full-disk encryption on your regular OS. Use Tails (which is encrypted by default) for sensitive work.

Safety Checklist

Run through this checklist before every dark web session:

If Something Goes Wrong

You accidentally clicked a suspicious link

Don’t panic. Close the tab. Use “New Identity” in Tor Browser (Ctrl+Shift+U) to clear all state and establish a fresh circuit.

You entered personal information

Change the relevant passwords immediately from a clean connection (not Tor). Monitor your accounts for suspicious activity.

You downloaded a file

Do not open it. Delete it immediately. If you’ve already opened it, disconnect from the internet, scan with up-to-date antivirus, and consider the device compromised.

You feel unsafe

Shut down. Physically disconnect from the internet. The dark web will be there tomorrow. No information is worth compromising your safety.

Frequently Asked Questions

Is it illegal to browse the dark web?

No. Browsing .onion sites is legal in most countries. What you do on them can be illegal. Accessing illegal content is a crime. Selling or buying prohibited goods is a crime. Simply browsing a .onion site is not.

Can police track me on the dark web?

Tor makes tracking extremely difficult but not impossible. Law enforcement agencies have successfully identified Tor users through:

Human error (users revealing identifying information)
Compromised .onion sites (law enforcement running them)
Browser exploits (targeted zero-days)
Traffic correlation (monitoring entry and exit simultaneously)

Should I use a dedicated device for dark web browsing?

If you have the resources, a dedicated laptop that you only use for Tor-related activities is the safest option. It eliminates the risk of leaking personal data from your regular OS. Tails on USB is the budget-friendly version of this approach.

Is HTTPS important on .onion sites?

Yes. While .onion connections are encrypted end-to-end within the Tor network, HTTPS adds another layer of verification. Look for the padlock icon even on .onion sites.

What’s the single most important safety tip?

Don’t mix your identities. The people who get caught on the dark web almost always make the same mistake — they use the same username, email, or password they use on the surface web. Keep your dark web identity completely separate from your real identity.