Type "dark web" into any search engine and you get warnings about drugs, scams, and stolen data. That reputation is not wrong, but it is incomplete. There are also legal uses of Tor onion sites, run by news organizations, privacy companies, and human rights groups, for reasons that have nothing to do with crime.
What a .onion address actually is
A .onion address is not a normal web address. It is not registered in the internet's regular DNS system at all. Instead, it points to what Tor calls an onion service, reachable only through the Tor network.
The name comes from onion routing, the layered encryption technique Tor uses to move traffic through several relays before it reaches its destination. Onion services were specified in 2003 and have been running on the Tor network since 2004.
Because these addresses are not listed in any public directory by design, you cannot stumble onto one the way you stumble onto a website through a search engine. You need to already know the address or find it through a source you trust.
Who actually runs these sites
Several well-known organizations maintain an onion version of their regular site. The New York Times and The Guardian are commonly cited examples. Facebook has run one for years. Proton, the company behind Proton Mail, also operates an onion site of its own service.
The Tor Project itself, the nonprofit behind Tor Browser, has existed since 2006 and continues to document and support onion services as part of its core mission.
None of these are hidden in the criminal sense. They are ordinary organizations offering an extra way to reach their existing, publicly known service.
Why a legitimate organization bothers with an onion site
The appeal is not really "hiding." Security researcher Alec Muffett, who helped build Facebook's onion site, has described it in terms of discretion and trust rather than pure anonymity.
Discretion means your internet provider or employer cannot see which site you are visiting, only that you are using Tor. Trust means something specific to onion addressing: if you land on the correct .onion address for an organization, you know you reached that organization's real server, because there is no DNS system or certificate authority in the middle that could be tricked or censored.
For people living under internet censorship or trying to reach independent journalism without being blocked or monitored, that combination matters a great deal. It is a legal, practical reason for an onion site to exist, separate from anything illicit.
The traps to know about
Not everything wearing a "directory" label deserves your trust. The Hidden Wiki is often mentioned as a starting point for exploring onion sites. It is not one. There is no single, authoritative Hidden Wiki anymore.
What actually exists under that name today is a scattered collection of clones and copycats, many stuffed with outdated, fake, or outright scam links. Treat any page calling itself "the Hidden Wiki" as a warning sign, not a map.
It is also worth being blunt about the other end of the spectrum: some onion sites exist purely to enable harassment, stalking, or the publication of private information about targeted individuals. A working onion mirror or clearnet version does not make a harassment platform legitimate. Functioning is not the same as trustworthy.
How to actually find a legal onion site
The safest method is unglamorous but reliable: get the onion address directly from an organization you already trust on the ordinary surface web and check it against that organization's official page.
Onion links are often shared through channels like Pastebin, social media, or forums, but none of those channels can vouch for accuracy on their own. Verifying against a source you already trust is what protects you, not the platform where you found the link.
- Check an organization's official surface-web site or its official social accounts for its onion address.
- Be skeptical of "directory" or "wiki" sites promising a curated list of onion links.
- Never treat a familiar-sounding name alone as proof you are in the right place.
What Tor does, and does not, guarantee
Tor Browser routes your traffic through multiple relays and encrypts it along the way, which makes it much harder for your provider or a network observer to see what you are doing.
That is not the same as full anonymity. If you log into a personal account, download and open a file, or reuse a username you use elsewhere, you can undo a lot of that protection yourself. Tor protects the connection, not every choice you make once you are connected.
Understanding this distinction is part of using the dark web responsibly: Tor is a tool for a specific kind of privacy, not a blanket guarantee that nothing you do can be traced back to you.
The realistic picture
The dark web's reputation for crime is not invented. The rise and collapse of the Silk Road marketplace is the case most people already know, and illegal activity is a real part of what exists on these networks.
But that is only part of the picture. Legal uses of Tor onion sites, from independent journalism to companies offering censorship-resistant access to their own services, are a documented, ordinary part of how the technology gets used every day.