October 19, 2026
Latest
Subscribe

Dark Web Glossary

Last updated: 3 October 2026 · 97 words explained · By Ehtijad Ali

Simple meanings for the words used on this site. Most confusion about the dark web comes from a few words being used wrongly, starting with “dark web” itself. Where a word is often misused, we say so.

How to use this glossary

  • Look up a word: click it in the A to Z list below.
  • Browse a topic: pick one of the 8 topic cards.
  • Follow the links: blue words inside a meaning jump to another word on this page.
  • Watch for warnings: when a word is often used wrongly, we tell you.

Browse by topic

A to Z list of every word

The web and its layers

Surface Web

The part of the internet that Google and other search engines have found and listed. It is what most people think of as “the internet”. It is actually only a small piece of what is out there.

Deep Web

Everything online that search engines have not listed. Your email inbox. Your online banking. Your school or work login. Medical records. Anything behind a password or a paywall. The deep web is huge, completely normal, and you use it every single day. It is not the same as the dark web. Mixing up these two words is the most common mistake in news stories about this subject.

Dark Web

A small part of the deep web that you can only reach with special software like Tor. Dark web sites are not just hidden from Google. They use a different kind of address that normal browsers cannot even understand. Yes, there are criminal shops there. There are also news sites and safe drop boxes for whistleblowers. Human rights groups also run copies of websites for people in countries that block them.

Darknet

A network that sits on top of the normal internet, but needs special software to join. Tor and I2P are darknets. People often use this word to mean the same as “dark web”. Strictly, the darknet is the road and the dark web is the shops along it.

Clearnet

A slang word for the ordinary internet. Everything you can reach without Tor. People who spend time on darknets needed a word for “everywhere else”, and this is it.

Tor

Short for “The Onion Router”. It is free software and a network of computers run by volunteers. It hides where you are by bouncing your connection through several computers first. It began as research at a US Navy laboratory and is now run by a non-profit called the Tor Project. Journalists, activists, researchers, police and criminals all use it. Tools like this do not care who you are.

Onion Routing

The trick that makes Tor work. Your data gets wrapped in several layers of code, like the layers of an onion. It then passes through a chain of computers, and each one peels off just one layer. So each computer knows only who passed it the message and who to pass it to next. No single computer knows both who you are and what you are looking at.

Onion Service

A website you can only visit inside the Tor network. Its address ends in .onion. They used to be called “hidden services”. Neither you nor the website learns where the other one is. Real addresses are 56 characters long. If you see a short, easy-to-remember .onion address, it is almost certainly fake.

Exit Node

The last Tor computer in the chain, which passes your request out to the normal internet. It can see which website you visit. If that site does not use HTTPS, it can also see what you are reading. It cannot see who you are. Exit nodes are not used at all when you visit a .onion site.

Entry Guard

The first computer in your Tor chain. Tor deliberately sticks with the same few for a while. If it picked a new one every time, sooner or later you would pick a bad one.

Bridge

A secret Tor computer that is not on the public list. People use them in countries where Tor is blocked. Because the address is not published, a government cannot simply block the whole list.

Pluggable Transport

Software that disguises Tor traffic so it looks like ordinary web traffic. Used where governments inspect connections and block anything that looks like Tor.

I2P

The Invisible Internet Project. Another anonymity network, but built mainly for sites that live inside the network, rather than for reaching the normal web. It uses a similar idea to onion routing, but bundles several messages together at once.

Hyphanet (Freenet)

A system where files are stored in pieces across everyone computers, instead of on one server. Because no single machine holds the whole file, there is no obvious server for anyone to switch off.

Tor Browser

A special version of Firefox that sends everything through Tor. It makes all its users look the same, so websites cannot tell you apart. This only works if you leave the settings alone. Making the window full screen, adding extensions, or turning on extra features can make you stand out. That ruins the whole point.

Privacy and staying anonymous

Anonymity

Doing something without anyone being able to find out who you are. This is different from privacy, which means controlling what people know about you. It is also different from pseudonymity, where you have a steady nickname that is not linked to your real name. Most products sold as “anonymous” actually give you one of the other two.

VPN (Virtual Private Network)

A private tunnel between your device and a company server. It hides what you do from your internet provider and from the wifi you are on. It also swaps your real location for the server’s location. It does not make you anonymous. The VPN company can now see everything your internet provider used to see. You have moved your trust, not removed it. And a “no logs” promise is only worth as much as the audits and the laws behind it.

IP Address

The number that identifies your device on the internet. It is not your name, but combined with your internet provider records it usually points at your household. It is the most common starting point for finding someone online.

Metadata

Information about your messages rather than what they said. Who you contacted, when, from where, for how long, how often. Metadata often tells people more about you than your actual words. It is also easier to collect in large amounts, and the law often protects it less.

Browser Fingerprinting

Recognising you by the unique combination of settings on your device, instead of by cookies. Your screen size, fonts, time zone, language and graphics card all add up. If your combination is unusual enough, websites can follow you around even if you block every cookie.

Deanonymisation

Working out who was behind anonymous activity. In real cases this almost never involves breaking the encryption. It is usually a human mistake, a money trail, a badly set up server, or someone informing on them.

Traffic Correlation

A way of unmasking someone by watching both ends of a connection and matching the timing and size of the traffic. No code needs to be broken. Tor’s own documents admit it cannot protect you from someone powerful enough to watch both ends at once.

OPSEC (Operational Security)

The habit of not ruining your own protection through careless behaviour. Reusing a username. Logging into your personal account during an anonymous session. Always posting at the same time of day. Writing in a style people recognise. Nearly every famous dark web arrest came down to an OPSEC slip, not to broken technology.

Threat Model

Your answer to three simple questions. What am I protecting? Who am I protecting it from? What happens if I fail? Without this, security advice is meaningless. Hiding your shopping from advertisers is very different from hiding a source from a government. A tool that helps with one can be useless for the other.

Warrant Canary

A notice a company publishes regularly saying it has not received a secret government order. The idea is that being forced to lie is different, in law, from being forced to stay quiet. So if the notice quietly disappears, readers can guess what happened. Whether this actually works in law has never been properly tested.

Doxxing

Publishing someone private details, like their home address, workplace or phone number, usually so that other people will harass them. It is a common form of revenge in this world, including against researchers.

Encryption and secret codes

Encryption

Scrambling information so that only someone with the right key can read it. Modern encryption is almost never beaten by cracking the code. The methods are public, and thousands of experts have tested them. It is beaten by stealing keys, finding bugs in the software, or getting to the person holding the key.

End-to-End Encryption (E2EE)

Encryption where only you and the person you are talking to have the keys. The company carrying the message cannot read it. So always ask what else the app still records. Who you talked to, and when, can reveal more than what you said.

Public-Key Cryptography

A clever system using two matching keys. One is public and you can give it to anybody, so they can send you secret messages. The other is private and only you have it, so only you can open them. It solves the old problem of how to talk secretly with someone you have never met.

PGP / GnuPG

Long-established tools for encrypting and signing messages and files. Still the normal way to contact journalists and security teams securely. Also famously fiddly to use correctly.

TLS / HTTPS

The encryption between your browser and a website. The padlock in your address bar means the connection is scrambled and the certificate matches the web address. That is all it means. It does not mean the website is honest, safe, or run by who it claims.

Hash Function

A one-way calculation that turns any data into a short fixed-length fingerprint. The same input always gives the same fingerprint, and you cannot work backwards from the fingerprint to the original. Used for storing passwords, checking files have not been changed, and identifying viruses.

Salt

Random text added to a password before it is hashed. This way, two people with the same password do not end up with the same stored fingerprint. Leaving it out is why some stolen password databases get cracked within hours. If a breach report mentions “unsalted” passwords, that is a serious failure.

Zero-Knowledge

A method that lets you prove something is true without revealing the thing itself. In adverts, the phrase is often used loosely to mean “we cannot see your data”. So check which meaning a company really means.

Forward Secrecy

A design where the keys for each conversation are thrown away afterwards. So even if someone saves your secret messages today and steals your main key years later, they still cannot read those old chats.

Dark web shops and how they work

Darknet Market

An illegal shop running as an onion site, usually selling drugs, stolen data or fake documents. They are built exactly like normal online shops, with product listings, seller ratings, refunds and commission. That is what makes them work, and also what leaves trails for investigators.

Vendor

A seller on one of these markets, using the same nickname over time so buyers can see their rating. But a nickname that builds up trust over years also builds up years of evidence. Vendor accounts are one of the most useful things investigators can study.

Escrow

When the market holds the buyer’s money until the item arrives. It stops individual sellers cheating buyers. It also means the market operators are sitting on an enormous pile of other people’s money, which leads directly to the next entry.

Exit Scam

When market owners suddenly shut down and run off with all the money being held in escrow. This happens again and again. A business built for people who cannot call the police has no reason to behave honestly at the end.

Initial Access Broker (IAB)

A criminal who specialises in breaking into company networks and then selling that access to someone else, usually a ransomware gang. Their existence is why modern cybercrime works like a supply chain rather than one hacker doing everything.

Ransomware-as-a-Service (RaaS)

A business where one group builds the ransomware and rents it to others. The renters carry out the attacks, and everyone splits the money. This is what turned ransomware into an industry, because now an attacker does not need any real skill.

Leak Site

A website, usually an onion site, where ransomware gangs publish data stolen from victims who refused to pay. The public embarrassment is the pressure. It is also why paying to stop a leak is a completely different deal from paying to unlock your files.

Combolist

A big list of usernames and passwords collected from many different breaches and traded between criminals. This is the fuel for credential stuffing, and the reason using the same password twice is such a serious mistake.

Fullz

Criminal slang for a complete set of someone’s personal information, including name, address, date of birth and financial details. Enough to pretend to be them.

Hidden Wiki

Any of the many pages listing onion addresses. They are out of date, unchecked, and stuffed with fake links and scams. We do not link to them, and no honest source should.

Viruses and attacks

Malware

Any software written to cause harm. It is a general word, not a specific thing. The entries below describe what a particular piece of malware actually does, which matters much more than the label.

Ransomware

Malware that locks up your files and demands money to unlock them. Today, gangs usually steal a copy of the files first and threaten to publish them. So having a backup no longer solves the problem on its own.

Double Extortion

Demanding money twice: once to unlock your files, and again to stop your data being published. This broke the old advice of “just restore from backup and refuse to pay”, and it is now the standard method.

Trojan

Malware disguised as something useful, so that you install it yourself. Named after the wooden horse. Still works, because it attacks the person rather than the computer.

Worm

Malware that spreads from computer to computer on its own, with nobody clicking anything. Worms cause the fastest and most damaging outbreaks, because nothing slows them down except the speed of the network.

RAT (Remote Access Trojan)

Malware that hands someone else full remote control of your device, including your files, camera and microphone. Used in crime, and also in stalking and harassment.

Spyware

Software that secretly watches what you do. This includes spying tools that companies sell to governments. Researchers have found them on the phones of journalists, lawyers and human rights workers.

Keylogger

A tool that records every key you press. Old and simple, but still one of the best ways to steal passwords. It grabs the password before any website protection can help.

Botnet

A large group of infected computers controlled by one person, and rented out for attacks, spam or mining. Most of the machines belong to ordinary people who have no idea they are part of it.

Command and Control (C2)

The system a criminal uses to send orders to all those infected machines. Taking over or seizing it is a standard goal when police shut down a criminal network.

Cryptojacking

Secretly using someone else computer to mine cryptocurrency. Barely noticeable on one machine, very profitable across thousands. Often the first clue that something worse has got in.

Phishing

Fake messages designed to trick you into giving away a password or installing something. They usually pretend to be a company you trust and try to make you panic. It is still the most common way attackers first get into a company, because it targets people rather than software.

Spear Phishing

Phishing aimed at one specific person, using real details about them, like their manager name or a genuine project they are working on. Far more convincing than ordinary phishing, and behind many of the biggest break-ins on record.

Smishing and Vishing

Phishing by text message (smishing) or by phone call (vishing). Both work because we assume phones are more trustworthy than email. Neither one actually proves who is contacting you.

Social Engineering

Tricking people instead of tricking computers. This is the bigger category that phishing belongs to. It works because it takes advantage of normal, helpful human behaviour, which is why “just train the staff better” is never a complete answer.

SIM Swapping

Tricking or bribing a phone company into moving someone number onto a new SIM card. The attacker then receives their text message codes and takes over their accounts. This is the main reason text messages are the weakest form of two-step login.

Credential Stuffing

Taking usernames and passwords stolen from one website and automatically trying them on hundreds of others. It works purely because people reuse passwords, and it needs no skill at all.

Zero-Day

A security hole the software maker does not know about yet, so there is no fix available. The name comes from them having had zero days to fix it. These are valuable and fairly rare. Most real attacks use old holes that people simply never patched.

Exploit

The actual code or trick that takes advantage of a security hole. The hole is the weakness, the exploit is the tool that uses it. We never publish working exploits.

CVE

A public ID number given to each known security hole, like CVE-2021-44228. It means everyone in the world can talk about the same flaw without confusion.

Data Breach

When data is stolen or accessed by someone who should not have it. Slightly different from a data leak, where information is exposed by mistake, such as a database left open with no password. For the people whose data it was, the result is the same.

APT (Advanced Persistent Threat)

A rich, skilled attacker, usually working for a government. It hides inside a network for a long time, instead of grabbing something and leaving. The label gets used loosely in marketing, so treat company claims as opinions rather than proof.

Indicator of Compromise (IoC)

A technical clue that a system has been broken into, such as a suspicious file, web address or setting change. Security teams share these with each other so everyone can check their own systems.

Digital money

Blockchain

A shared record of transactions, copied across many computers, where nothing can be edited once written. For most cryptocurrencies this record is completely public. That means it is permanent and searchable, which is the opposite of what many users assume they are getting.

Bitcoin

The first widely used cryptocurrency. It is not anonymous, only nicknamed. Every payment is public and stays forever. So once one address is linked to a real person, all their past payments are linked too. Several major criminal cases were built on exactly this.

Monero

A cryptocurrency built for privacy, which hides the sender, the receiver and the amount. Much harder to follow than Bitcoin. That is why some criminal markets moved to it, and why several exchanges stopped offering it.

Mixer / Tumbler

A service that throws lots of people cryptocurrency together and hands it back mixed up, to break the trail. Heavily used for laundering money, and several of the big ones have been seized or banned.

Chain Analysis

Studying the public blockchain to follow the money and link it to real people. This usually works best when someone swaps crypto for normal cash. This is why the idea of untraceable digital money keeps falling apart in court.

Wallet

Software or a small device that holds the secret keys controlling your cryptocurrency. The coins live on the blockchain. The wallet just holds the keys. Whoever has the keys has the money, which is why seizing them is often the turning point in an investigation.

Cold Storage

Keeping those keys on a device that never touches the internet. Excellent against remote thieves. No help at all against someone standing next to you.

Finding the truth online

OSINT (Open-Source Intelligence)

Working things out using only information anyone can see: public records, social media, photos, company documents, old saved web pages. The hard part is not finding information. The hard part is proving it is real and knowing what it does not prove.

Sock Puppet

A separate account a researcher uses so they do not have to investigate from their real profile. Normal practice in this kind of work.

Searching using a picture instead of words, to find everywhere else that picture has appeared. One of the quickest ways to prove that a “breaking news” photo is actually eight years old and from a different country.

Geolocation

Working out exactly where a photo or video was taken. You match buildings, signs, plants, shadows and hills against maps and satellite pictures. A core skill in open-source investigation, and it needs no special access at all.

Chronolocation

Working out when something was filmed, using shadow angles, weather records or visible building work. Usually done together with geolocation to confirm or destroy someone claim about an event.

WHOIS

The registration record for a website address. Much of it is hidden by privacy services now. But old saved copies often still show the first owner’s details, and that has solved many mysteries.

Certificate Transparency

Public logs of every security certificate ever issued for a website. Certificates list the web addresses they cover. So these logs often reveal hidden parts of a website that were never meant to be found.

Digital Forensics

Examining devices and data to work out what happened, in a way that will hold up in court. It is as much about careful procedure and paperwork as it is about technical skill. A sloppy process makes even perfect evidence useless.

Chain of Custody

The written record of who held a piece of evidence, when, and what they did with it. If there is a gap in that record, a court may throw the evidence out, no matter how convincing it is.

Write Blocker

A device that lets investigators read a hard drive without changing anything on it. Basic practice, because evidence that has been altered is evidence you can no longer use.

Forensic Image

An exact copy of a storage device, checked with a hash so any later change would be obvious. Investigators work on the copy and leave the original untouched.

Attribution

Working out who was actually behind an attack. This is the hardest claim in security, and the one people overstate most. Technical clues can be copied, stolen, or planted on purpose. So good attribution always shows its evidence and says how sure it is.

Staying safe

Two-Factor Authentication (2FA)

Needing a second proof of identity as well as your password. Not all second steps are equal. A physical security key is the strongest. An authenticator app is very good. Text messages are the weakest, because of SIM swapping. Any of them is still far better than none.

Password Manager

An app that creates and remembers a different strong password for every account. It fixes password reuse, which is the root cause of most account takeovers. For most people, this is the single biggest improvement they can make.

Patch

An update that fixes a security hole. Most successful break-ins use old holes that were never patched, not clever new ones. Installing updates is boring and extremely effective.

Air Gap

Keeping a computer completely disconnected from any network. Very strong protection, regularly defeated by someone plugging in a USB stick because they needed to move a file.

Sandbox

A sealed-off space for running software you do not trust, so it cannot touch the rest of the machine. Used both for safety and for studying how viruses behave.

Honeypot

A computer left deliberately exposed to attract attackers, so their methods can be watched. Investigators use these too, which is one reason anything on a darknet that looks unusually convenient should make you suspicious.

Tails

An operating system that runs from a USB stick, sends everything through Tor, and forgets everything when you shut down. Widely used by journalists and their sources for exactly that reason.

Whonix

A setup split into two virtual machines. One handles all the Tor traffic, the other is where you work. Even if the working machine gets infected, it never learns your real location.

Responsible Disclosure

Telling a company about a security hole privately and giving them time to fix it before going public. The alternative is publishing immediately, which some researchers do when a company refuses to act. Which approach is right is a long-running argument.

Bug Bounty

A programme that pays researchers for reporting security holes. It gives people a legal way to get paid for finding flaws. It competes with shady buyers who want the same flaws to attack people.

About this glossary

These meanings are written to be clear rather than perfectly technical. A few of these words are genuinely argued over, especially “dark web” and “APT”. Where that happens, we say so instead of quietly picking a side.

This page is written and kept up to date by Ehtijad Ali, under our Editorial Policy. If a meaning here is wrong, out of date, or just confusing, please tell us at ehtijadalee@gmail.com.

Keep reading