Who Uses the Dark Web — and Why
Research shows most dark web users are privacy-seekers, journalists, and dissidents — not criminals. This guide breaks down who actually uses Tor and why.
The popular image of the dark web user — a hooded figure buying contraband — is a caricature. Research by the Oxford Internet Institute (2019) found that the most common uses of Tor were ordinary privacy-seeking and censorship circumvention, not criminal activity. The Tor Project's own metrics show somewhere between 2 and 3 million daily users worldwide. Understanding who those users actually are changes the conversation significantly.
Journalists and Whistleblowers
SecureDrop — maintained by the Freedom of the Press Foundation — is perhaps the clearest example of dark web infrastructure serving a democratic function. It is a Tor-based document submission system used by The Guardian, The Washington Post, The New York Times, The Intercept, and dozens of other outlets. Sources submit sensitive documents through SecureDrop because Tor's anonymity layer makes it significantly harder to trace the submission back to the source.
The most consequential whistleblower case in recent memory — Edward Snowden's 2013 NSA disclosures — involved Tor as part of the communication infrastructure. The Committee to Protect Journalists (CPJ) includes Tor guidance in its digital safety toolkit for journalists operating in high-risk countries.
This is not a theoretical use case. It is active, documented infrastructure that investigative journalism depends on.
Political Dissidents and Censorship Circumvention
In countries where governments block access to independent media, social platforms, or communication tools, Tor is a way through the firewall. The pattern is visible in Tor's own usage data: during Iran's 2022 protests, Tor connections from Iran spiked sharply in the days following the government's internet restrictions.
Freedom House's 2023 Internet Freedom report documented internet restrictions in 70 countries. For users in Belarus, Russia, China, or Iran, accessing the BBC, Wikipedia, or a messaging app may require Tor. The BBC and The New York Times both maintain official .onion mirrors of their sites precisely for this reason.
What looks like a dark web access from the outside is, for many of these users, simply reading the news.
Cybersecurity Researchers
Security firms including Recorded Future, DarkOwl, and Flashpoint employ analysts whose job is to monitor dark web forums for threat intelligence. They track data breach listings, malware command-and-control infrastructure, zero-day exploit pricing, and criminal forum discussions as part of commercial threat-intelligence services.
Academic researchers study the dark web's structure, markets, and user behavior. The RAND Corporation published a report in 2019 — "Identifying Law Enforcement Needs for Conducting Criminal Investigations Involving Evidence on the Dark Web" — specifically examining the research and policy gaps in dark web criminal activity.
These researchers are not criminal actors. They are a significant portion of consistent Tor users.
Ordinary Privacy Seekers
Not every Tor user is a journalist or a researcher. A substantial share is simply people who would rather their internet traffic not be visible to their ISP, their government, or the ad networks tracking them across the web.
ISP data collection, government mass surveillance programs (documented since 2013), and the commercial data-broker industry have all contributed to growing interest in privacy tools. Tor, for this audience, is less about the dark web specifically and more about encrypted, untracked browsing. Many Tor users never visit a .onion site at all — they use the network to access ordinary clearnet sites with additional anonymity.
Understanding what the dark web is versus what Tor itself does clarifies why "Tor user" and "dark web user" are not the same category.
Criminal Elements — The Part Everyone Focuses On
This section exists because leaving it out would be dishonest. Drug markets, fraud forums, stolen credential markets, and malware distribution networks do operate on the dark web. They are a real part of the ecosystem.
The RAND Corporation's research (2019) found that drug markets represent the largest single category of criminal activity on the dark web, measured by transaction volume. Darknet markets like Silk Road, AlphaBay, and Hydra processed billions of dollars collectively before law enforcement shut them down.
But scale matters here. The Oxford Internet Institute research found that a minority of Tor traffic is attributable to dark web criminal sites. Most Tor users are accessing ordinary websites with additional privacy protection. The dark web myths that dominate coverage — that it's a vast criminal underground — do not hold up to the available data.
The relevant framing is not "is the dark web dangerous?" but "what specific activities and sites pose what specific risks?" That question has a more tractable answer.
Frequently Asked Questions
Is the dark web only used for illegal activity?
No. Research from the Oxford Internet Institute (2019) found that censorship circumvention and privacy were the most common stated motivations for Tor use. Journalists, security researchers, activists, and ordinary privacy-conscious users make up a substantial share of daily Tor traffic.
Do journalists really use the dark web?
Yes. SecureDrop, the document submission system used by major investigative outlets including The Guardian and The Washington Post, operates on Tor. The Freedom of the Press Foundation maintains SecureDrop specifically because Tor's anonymity protections reduce the risk of source identification.
Can ordinary people safely browse the dark web?
With precautions, yes. Downloading Tor Browser from the official Tor Project site is safe. What you access with it determines your risk level. Browsing legitimate .onion news sites or using Tor for privacy on the clearnet carries different risks than visiting unknown market sites or clicking unverified links.
How many people use Tor daily?
The Tor Project's public metrics at metrics.torproject.org report approximately 2–3 million daily users as of 2024, though these figures measure connections to Tor relays, not unique individuals. Usage spikes noticeably during political events in countries with internet restrictions.