Reference

Dark web glossary

Every dark web and privacy term, defined in plain language and cross-linked to the full guides. 47 entries, A to Z.

A

Advance-fee fraud: A scam where the victim pays a small fee upfront to unlock a much larger payout that never arrives. Common on dark web markets. Learn more →
AlphaBay: A large dark web marketplace seized by law enforcement in 2017 after its operator was linked to the site through a personal email. Learn more →

Bitcoin: A cryptocurrency used widely on dark web markets. It is pseudonymous, not anonymous — every transaction is on a permanent public ledger. Learn more →
Blockchain: The permanent public ledger that records every cryptocurrency transaction. Its transparency is what makes Bitcoin traceable. Learn more →
Bridge: An unlisted Tor entry relay that disguises the fact you are using Tor from your ISP. The free alternative to a VPN for that purpose. Learn more →

Chain analysis: The practice of tracing cryptocurrency transactions across the blockchain to link pseudonymous addresses to real identities. Learn more →
Clearnet: The ordinary, indexed internet reachable with a normal browser — as opposed to the dark web. Also called the surface web. Learn more →
Controlled delivery: When law enforcement allows an intercepted illegal package to reach its destination under surveillance, to identify the recipient. Learn more →
Credential stuffing: An attack that tries username-password pairs leaked in one breach across many other sites, exploiting password reuse. Learn more →
Cryptocurrency: Digital money secured by cryptography, used for payments on dark web markets because it needs no bank and is hard to reverse. Learn more →

Dark web: The part of the internet reachable only through anonymity software like Tor, using .onion addresses ordinary browsers cannot open. Learn more →
Deep web: Everything behind a login or paywall — email, banking, private files. Most of the internet, and distinct from the dark web. Learn more →
Double extortion: A ransomware tactic: steal a copy of the data before encrypting it, then threaten to publish it, defeating backups. Learn more →

Escrow: A system where a market holds a buyer's cryptocurrency until delivery is confirmed. Its flaw: the market itself can seize it all. Learn more →
Exit node: The final relay in a Tor circuit, which contacts the destination site. It sees the destination but not who you are. Learn more →
Exit scam: When a market or vendor builds up trust and escrow, then vanishes with the money at the point of maximum funds held. Learn more →

Guard node: The first relay in a Tor circuit. It knows your real address but not your destination. Learn more →

Hansa: A dark web market secretly taken over and run by Dutch police in 2017 as a honeypot before being shut down. Learn more →
Have I Been Pwned: A free service that checks whether your email appears in known data breaches. The core function paid monitoring charges for. Learn more →
Hidden service: Another name for an onion service — a website reachable only inside Tor, whose location is hidden. Learn more →

Infostealer: Malware that harvests passwords, cookies, and wallets from an infected device, bundling them into a stealer log for sale. Learn more →
Initial access broker: A criminal who breaks into a network and sells the entry point to others, usually ransomware crews. Abbreviated IAB. Learn more →

Monero: A privacy cryptocurrency that hides sender, receiver and amount by default — the actual privacy money Bitcoin was assumed to be. Learn more →

.onion address: The 56-character address of a dark web site, derived from a cryptographic key so it proves its own authenticity. Learn more →
Onion routing: Wrapping traffic in layers of encryption and passing it through a chain of relays, each peeling one layer. The basis of Tor. Learn more →
Onion service: A website reachable only inside Tor at a .onion address, whose location stays hidden from visitors. Also 'hidden service'. Learn more →
Onion-Location: A feature where a legitimate site advertises its official onion address from its verified clearnet site, so you can reach it safely. Learn more →

PGP: Pretty Good Privacy — encryption that scrambles a message so only the intended reader can open it. Used for market order details. Learn more →
Phishing clone: A fake copy of a real dark web site at a look-alike address, designed to steal credentials or payments. Learn more →
Pluggable transport: Technology like obfs4 that disguises Tor traffic so it isn't recognisable as Tor. Used with bridges. Learn more →
Pseudonymous: Identified by a pseudonym rather than a name — but still potentially traceable. Bitcoin is pseudonymous, not anonymous. Learn more →

Ransomware: Malware that encrypts a victim's files and demands payment. Modern gangs add data theft and dark web leak sites. Attackers often gain access through phishing, exploited VPNs or stolen credentials, encrypt files with strong algorithms, and demand cryptocurrency for a decryptor. Many operations now use double extortion: exfiltrating sensitive data before encryption and threatening to publish it on a dedicated .onion leak site if the ransom is not paid. Even after payment, decryption is not guaranteed, and restored files may be damaged. Learn more →
Ransomware-as-a-service: A model where operators rent ransomware and infrastructure to affiliates for a cut of the ransom. IABs supply the access. Learn more →
Relay: A volunteer-run computer in the Tor network that passes traffic. A Tor circuit uses three: guard, middle, and exit. Learn more →
Rendezvous point: A relay where a visitor's circuit and an onion service's circuit meet, so neither learns the other's location. Learn more →

SecureDrop: An onion-based system that lets sources send documents to journalists anonymously. A legitimate use of the dark web. Learn more →
Session cookie: A token proving you are already logged in. Stolen in a stealer log, it lets an attacker bypass the login and 2FA. Learn more →
Silk Road: The first major dark web marketplace, launched in 2011 and seized in 2013. Its founder was sentenced to life in prison. Learn more →
Stealer log: The complete data harvest an infostealer pulls from one device — passwords, cookies, wallets — sold in bulk on markets. Learn more →
Surface web: The ordinary, indexed internet reachable by search engines and normal browsers. Also called the clearnet. Learn more →

Tails: An amnesic operating system that runs from a USB stick, routes through Tor, and leaves no trace on the computer. Learn more →
Tor: The Onion Router — free software and a volunteer network that anonymise traffic and make the dark web reachable. Learn more →
Tor Browser: A free, modified Firefox that routes browsing through the Tor network automatically. Download only from torproject.org. Learn more →
Traffic correlation: A theoretical attack that links a Tor user to their activity by watching both ends of the network. Needs a state-level adversary. Learn more →
Two-factor authentication: A second login step beyond a password (2FA). It guards the login but can be bypassed by a stolen session cookie. Learn more →

Vendor bond: A deposit a market vendor posts, forfeited for misbehaviour. Meant to signal trust, but gameable like reviews. Learn more →
VPN: A virtual private network routing traffic through one company. It gives privacy from your ISP but not anonymity like Tor. Learn more →