The Hidden Wiki is a directory of .onion sites on the Tor network. Opening a link is easy. Protecting your privacy, avoiding scams and steering clear of malware takes more care. This guide brings together our privacy, safety and communication advice in one place.
What the Hidden Wiki is (and isn’t)
The Hidden Wiki is a directory, not a search engine or a marketplace. Many independent sites use the same name, and no directory can guarantee that every listing is safe. A site can also change after it has been listed. Check the address, stay skeptical and use our known scam list as one reference, not as proof that anything else is trustworthy.
The deep web means ordinary web content that search engines cannot reach, such as an account behind a login. The dark web is a smaller part of the internet that needs special software, such as Tor. Tor is also used for privacy, journalism, activism and access to information under censorship. Using privacy tools does not make an illegal activity legal.
Start with the official Tor Browser
Download Tor Browser only from the Tor Project. It connects your browser traffic through the Tor network so the sites you visit do not see your usual IP address. Keep the browser updated, and do not install extra extensions: they can weaken privacy or make your browser easier to distinguish.
Read our Tor Browser setup guide for the Hidden Wiki for the installation steps. If Tor is blocked on your network, Tor Browser’s connection settings offer bridges. These are alternative ways into the network, not an extra anonymity guarantee.
Choose a security level that fits the site
Tor Browser’s Safer setting disables JavaScript on non-HTTPS sites. Safest disables JavaScript by default on all sites and restricts more web features. This can break pages, so choose the level deliberately instead of trusting every site with the same settings. The Tor Project explains the security levels.
Tor Browser uses letterboxing to reduce identifying differences in window sizes. Leave its window sizing and default privacy features alone rather than making your setup stand out.
Check the address before you trust a site
- Get an address from a source you trust and compare it with another reliable source when you can.
- Check the whole address, not just the first or last few characters. Phishing copies can look very similar.
- Bookmark an address after you have verified it. Do not trust a listing just because it appears on the Hidden Wiki.
- Current v3 onion addresses have 56 characters before .onion. Old 16-character v2 addresses no longer work in current Tor Browser versions.
- Use HTTPS when a site supports it. Tor protects traffic within its network, but it does not make every website or every internet connection secure.
Keep personal information out of your activity
Tor can hide your IP address; it cannot stop you from identifying yourself. A reused username, a linked account or one careless conversation can undo your other precautions.
- Do not enter your real name, home address, phone number, ordinary email address or links to your social profiles.
- Use a separate username and a unique password that is not tied to your everyday identity. Never reuse passwords.
- Do not upload personal photos. Documents and images can contain details about you or metadata about the file.
- Decline requests for access to your contacts, location, camera or microphone unless you fully understand and accept the consequences.
- Do not open attachments from strangers. Avoid logging into an anonymous account and an identifying account in the same session.
Protect against malware and scams
Common risks include phishing pages, fake escrow, impersonators, stolen-data offers, malicious downloads and criminals pretending to be someone they are not. Illegal goods and exploitation material are also promoted in some corners of the dark web. Do not assume that encryption, anonymity or a listing on a directory makes an offer genuine.
Keep your operating system and browser current. Do not download or enable something just because a stranger tells you it is necessary. A downloaded document can request outside connections or contain malicious content; leave files closed rather than opening them casually in your normal work environment. If a site pressures you to pay, hurry or disable a safety feature, stop and reassess it.
Do you need a VPN with Tor?
No. Tor Browser works on its own. A VPN routes traffic through the VPN company, adding another party you must trust. It can hide your internet use from the network you are on, but it does not automatically make you anonymous. Tor bridges may be more relevant when your goal is to get around blocking. Do not treat a paid VPN as a replacement for Tor or safe habits.
Other privacy and communication tools
Tails
Tails is a portable operating system designed to run from a USB stick without relying on the computer’s installed system. Its internet connections are routed through Tor, and it is designed to leave no trace on the computer by default. It can help separate sensitive work from your usual files, but no operating system protects you from every mistake or compromised device.
PGP
PGP uses a public key to encrypt material for a recipient and a private key to decrypt it. Keep the private key private. Check fingerprints through a separate trusted channel before relying on a key. Our PGP key guide explains the basics.
Encrypted messaging
Apps such as Signal can protect message contents with end-to-end encryption. That is different from anonymity: registration details, contacts and account metadata can still identify people. Check an app’s current requirements and privacy model before relying on it. Older advice to use Wickr Me is outdated because that service has closed.
Cryptocurrency
Cryptocurrency is not automatically anonymous. Bitcoin transactions, for example, are recorded on a public ledger. Other coins have different privacy properties, but none should be treated as a guarantee that a payment cannot be linked to you. Payment choice is no substitute for protecting your identity.
Quick safety checklist
- Download Tor Browser from the official Tor Project and keep it updated.
- Choose a suitable security level and avoid extra browser extensions.
- Verify full onion addresses and keep bookmarks for those you trust.
- Keep names, passwords, accounts and personal files separate from your everyday identity.
- Decline unnecessary permissions and treat downloads as untrusted.
- Question any request for money or personal information, even when it came through a familiar directory.
Ready for the next step? Return to our Tor Browser and the Hidden Wiki guide or browse the Hidden Wiki directory with a skeptical eye.
Questions and answers
What do I need before opening any .onion link?
Only one thing is essential: Tor Browser, downloaded from torproject.org and kept up to date. Everything else — a VPN, a separate device, a fresh identity for a service — depends on what you plan to do. Start with the steps in this guide, in order.
Can my internet provider see what I do on Tor?
Your provider can see that you are using Tor, but not which .onion sites you open or what you send. If being seen using Tor is itself a problem where you live, a VPN or a Tor bridge can hide the Tor use as well.
How do I know an .onion address is the real one?
Compare all 56 characters with the address published on the service’s ordinary website, or another source you already trust. Scam copies differ by a character or two and rely on you not checking. Cross-check the name on our Dark Web Scam List before paying for anything.
What should I never do on the dark web?
Never use your real name, email address or payment card. Never download files from services you do not trust. Never reuse passwords from your ordinary accounts. And never send cryptocurrency to an address you have not checked twice. Most dark web losses come from those four mistakes, not from hacking.
