Dark Website Browser: Choosing the Right Tool

What a Dark Web Browser Actually Does (and Doesn't Do)

A dark web browser routes your traffic through an overlay network so you can open addresses that do not exist on the surface web. Tor Browser sends your connection through three random relays, and each relay knows only the node immediately before and after it in the chain[3]. The final relay—the exit node—sends your request to the public Internet if you are visiting a surface site, but .onion addresses never leave the Tor network because the service itself is hosted as a hidden service within that network[1]. Your local ISP sees that you connected to a Tor entry guard, but it cannot see which .onion sites you visited because the traffic is encrypted in layers[2].

This is not the same as a VPN. A VPN encrypts your connection to a single commercial server, and that server sees both your real IP address and your destination. A VPN cannot open .onion addresses because it does not route traffic through the Tor network's relay structure. If you paste an .onion URL into Chrome or Firefox without Tor, you will see a DNS error—the browser tries to resolve the address through your ISP's DNS server, which has no record of it. That error is the moment you realise a specialised tool is required.

A dark web browser is also not an antivirus or endpoint protection tool. It does not scan files for malware, block phishing domains, or prevent you from downloading a compromised archive. Its job is routing and rendering: it connects you to the overlay network and displays the page. You still need to verify downloads, check signatures, and treat every file as untrusted until you confirm its origin.

Surface web browsers with privacy modes versus true dark web browsers

Firefox's private browsing mode and Chrome's incognito mode delete local history and cookies when you close the window, but they do not route your traffic through an anonymity network. Your ISP, your employer's firewall, and the destination server all see your real IP address. These modes also do not prevent browser fingerprinting—websites can still identify you by your screen resolution, installed fonts, timezone, and dozens of other data points that standard browsers expose through JavaScript.

Tor Browser disables many of those fingerprinting vectors by default. It blocks canvas fingerprinting, spoofs a common screen resolution, and sets every user's timezone to UTC. It also rotates circuits every ten minutes, so even if a site tries to track you across sessions, your exit node changes. Each Tor relay rotates its onion key every four weeks, and when your client builds a circuit it demands proof that each relay knows its current key, preventing the first node from spoofing the rest of the path[4].

I2P and Freenet take different approaches. I2P is packet-switched rather than circuit-switched, so it can route around congestion and load-balance data across available resources[5]. An HTTP request and its response follow separate paths—outbound and inbound tunnels—which means an adversary observing traffic sees only half the conversation[5]. Freenet is a peer-to-peer small-world network where each peer connects to neighbours over UDP, and applications compile to WebAssembly with no central servers[6][7]. Neither I2P nor Freenet can open .onion addresses, and Tor Browser cannot open .i2p eepsites or Freenet freesites.

If you need to reach .onion sites, install Tor Browser from torproject.org and verify the GPG signature before you run the installer. If you need .i2p access, you need the I2P router with its bundled browser. If you need Freenet, you need the Freenet application. No single tool covers all three networks.

Tor Browser: The Default Choice and Its Real Limits

Tor Browser is the only browser officially supported for .onion sites, maintained by the Tor Project with public audits and open governance. It routes your traffic through three random relays, and each relay knows only its immediate predecessor and successor in the circuit[3]. The final relay—the exit node—sends your request to the public Internet if you are visiting a surface site, but .onion addresses never leave the Tor network because the service itself is hosted within it[1]. Each relay rotates its onion key every four weeks, and your client demands proof that each relay knows its current key, preventing the first node from spoofing the rest of the path[4].

Your ISP sees that you connected to a Tor entry guard, but it cannot see which .onion sites you visited because the traffic is encrypted in layers[2]. That metadata—timestamp, session duration, the fact that you used Tor—is visible and may be logged under UK data retention rules. If you need to hide Tor usage from your ISP, you need a bridge or a VPN, and each shifts trust to a different party.

What Tor does not solve

Exit node visibility matters when you visit surface sites through Tor. The exit relay sees the destination domain and can read unencrypted HTTP traffic, so you still need HTTPS for any site that handles credentials or sensitive data. For .onion sites, there is no exit node—the connection stays inside the Tor network—but the hidden service operator sees your exit circuit's final hop, not your real IP address.

Browser fingerprinting persists if you change default settings. Tor Browser ships with a three-level security slider: Standard allows JavaScript, Safer disables it on HTTP sites, and Safest disables JavaScript, SVG, and some fonts on all sites. If you install extensions, change the window size, or enable WebGL, you create a unique fingerprint that distinguishes you from other Tor users. The Tor Project's documentation recommends leaving settings untouched unless you have a specific reason to adjust them.

Speed is the most visible trade-off. Tor routes your connection through three relays in different countries, adding latency at each hop. Video streaming, large downloads, and interactive applications run slowly compared to a direct connection. I2P addresses this with packet-switched simplex tunnels that route around congestion and load-balance data[5], but I2P cannot open .onion sites, and Tor Browser cannot open .i2p eepsites.

Tor Metrics estimates the number of users by counting directory requests and dividing by ten to approximate concurrent users[8]. In 2024, Germany had 1,085,893 estimated daily users (35.14%), followed by the United States at 440,994 (14.27%)[9]. Those figures confirm Tor's scale, but they also show that Tor is a known network—your ISP recognises Tor traffic, and some services block connections from known exit nodes.

If you need .onion access, start with Tor Browser from torproject.org, verify the GPG signature and SHA256 hash, and set the slider to Safest before you open your first address. For step-by-step instructions, follow How to Access the Dark Web: A Step-by-Step Guide.

I2P and Freenet: When the Dark Web Isn't Only Onion Sites

Not every dark website ends in .onion. Some content lives on eepsites—addresses ending in .i2p—or freesites hosted on Freenet, and you cannot reach them with Tor Browser. These are separate overlay networks with their own routing protocols, trust models, and content ecosystems. If you are looking for a specific forum or file archive and find only an .i2p address, you need the I2P router; if the resource is a Freenet freesite, you need the Freenet application. Neither is a drop-in replacement for Tor, and no single browser covers all three networks.

I2P is a packet-switched network where the browser is just one component[5]. You install the I2P router, which runs as a background service on your machine, and then use a bundled browser or configure an existing one to proxy through the router. I2P uses 'garlic routing', in which multiple messages can be bundled into a single encrypted packet[10], and an HTTP request follows a different path from its response—outbound and inbound tunnels are separate, so an adversary observing traffic sees only half the conversation[5]. The network has no central directory servers; instead, each peer profiles other routers to determine how best to route data[5]. This self-organising structure means I2P can transparently route around congestion and load-balance across available resources[5], but it also means initial connection times are longer while your router discovers peers.

Freenet is a distributed datastore more than a browsing experience. Each peer is assigned a numerical location between 0.0 and 1.0 derived from its IP address, and peers form two-way connections with neighbours over UDP[6]. Applications compile to WebAssembly and run across the peer-to-peer network with no central servers[7]. You do not 'browse' Freenet the way you browse .onion sites—you install the Freenet application, wait for it to connect to the network, and then access freesites through a local web interface. Freenet manages bandwidth, memory, CPU, and storage based on limits you set, and it can perform firewall hole punching when necessary[6].

When you need I2P or Freenet instead of Tor

If a forum or marketplace publishes only an .i2p address, you need I2P. If a file archive or blog exists only as a Freenet freesite, you need Freenet. Tor Browser will not resolve .i2p addresses, and the I2P router cannot open .onion sites. This fragmentation is intentional—each network optimises for different threat models and use cases. I2P is built for what happens inside the privacy network rather than for accessing the outside internet[11], so outproxies to the surface web exist but are slow and unreliable. Freenet is fully distributed with no central controls[11], which makes it resilient to takedowns but also means content discovery is harder.

You cannot verify the authenticity of an eepsite or freesite the way you verify an .onion address. Tor's onion service protocol includes a cryptographic proof that the service you reach matches the address you requested, but I2P and Freenet rely on different mechanisms—peer reputation in I2P, content addressing in Freenet—that do not provide the same guarantees. Treat every link as untrusted until you confirm it through a second channel.

If you only need .onion sites, install Tor Browser and stop there. If you need .i2p access, download the I2P router from geti2p.net, verify the signature, and follow the setup wizard. If you need Freenet, download the installer from freenet.org, verify the hash, and configure your bandwidth limits before you connect.

Mobile Dark Web Browsers: What Changes on Android and iOS

The Tor Project publishes an official Tor Browser for Android, available on Google Play and as a direct APK download from torproject.org. It routes traffic through three relays the same way the desktop version does[1][3], and it includes the same security slider—Standard, Safer, and Safest—to control JavaScript and other fingerprinting vectors. You verify the download by checking the developer name 'The Tor Project' on Google Play or by confirming the GPG signature if you download the APK directly.

iOS has no official Tor Browser from the Tor Project. Apple's App Store policies prohibit apps from bundling their own network stack, so third-party developers built alternatives. Onion Browser is the most widely recommended iOS option; it uses Apple's WebKit engine and routes traffic through the Tor network, but it cannot match the fingerprinting protections of the desktop or Android versions because iOS restricts low-level browser modifications. The Tor Project links to Onion Browser on its official download page as the recommended iOS solution, but it does not maintain the app itself.

Third-party 'dark web browser' apps on Android

OrNET Browser appears at the top of Google Play search results for 'dark web browser'. The app bundles a VPN service and displays ads, which introduces two risks: the VPN operator sees your real IP address before your traffic reaches Tor, and ad networks can track your session across requests. The official Tor Browser for Android does not include a VPN, does not show ads, and does not require payment. If you search Google Play and see an app with 'VPN included' or 'ad-supported' in the description, it is not the official Tor Browser.

You check the developer name before you install. The official Tor Browser for Android lists 'The Tor Project' as the developer. Any other name—OrNET, Onion VPN, Tor VPN Browser—means the app is a third-party wrapper, and you have no way to verify what it does with your traffic. Some of these apps route through Tor correctly but log metadata; others route through a commercial VPN first, which shifts trust to a company that may comply with data requests.

What works and what does not on mobile

Tor Browser for Android supports .onion sites and applies the same circuit rotation every ten minutes that the desktop version uses. Each relay rotates its onion key every four weeks, and your client demands proof that each relay knows its current key[4]. Your ISP sees that you connected to the Tor network because communication is encrypted in layers and routed through proxies, but it cannot see which .onion addresses you visited[2]. The mobile app does not support bridges in the same interface as the desktop version—you configure bridges through the app's settings menu before you connect.

Onion Browser on iOS cannot disable JavaScript on a per-site basis the way Tor Browser's security slider does, because iOS forces all browsers to use the system WebKit engine. You set a global preference to block scripts, but many .onion sites break without JavaScript, and you cannot toggle it for individual addresses. The app also exposes more fingerprinting data than Tor Browser on Android or desktop, because Apple restricts access to the APIs needed to spoof screen resolution, timezone, and canvas data.

If you need .onion access on Android, download Tor Browser from Google Play or torproject.org and verify the developer name. If you need it on iOS, download Onion Browser from the App Store and accept that you will have weaker fingerprinting protections than on other platforms. Do not install apps that bundle VPNs or display ads, and do not assume that 'dark web browser' in the app name means the tool is safe. For step-by-step instructions on verifying and configuring Tor Browser, follow How to Access the Dark Web: A Step-by-Step Guide.

Criteria That Actually Matter for Choosing a Dark Web Browser

You need to evaluate five factors before you install any tool: which networks it supports, what security settings it applies by default, who maintains it and how often they release updates, whether it runs on your device, and what extras it bundles that may compromise your privacy.

Network compatibility

Tor Browser opens .onion sites by routing traffic through three Tor relays[1][3]. The I2P router opens .i2p eepsites using garlic routing and simplex tunnels[10][5]. Freenet accesses freesites through a peer-to-peer datastore with no central servers[6][7]. No single browser covers all three networks—if you need .onion access, you need Tor Browser; if you need .i2p access, you need the I2P router; if you need Freenet, you need the Freenet application. Check the address format of the site you want to visit before you choose a tool.

Default security posture

Tor Browser disables JavaScript, blocks canvas fingerprinting, and spoofs timezone data when you set the security slider to Safest. OrNET Browser enables JavaScript by default and displays ads, which means ad networks can track your session. Onion Browser on iOS cannot disable JavaScript on a per-site basis because Apple forces all browsers to use WebKit. A browser that requires you to manually harden settings after installation exposes you to mistakes—you want a tool that applies strong defaults before you open your first address.

Update frequency and maintainer reputation

The Tor Project releases updates every four to six weeks, and each Tor relay rotates its onion key every four weeks[4]. A browser that has not received updates in six months may use outdated cryptographic keys or fail to connect to the current network. Check the developer name before you install: Tor Browser lists 'The Tor Project' on Google Play and torproject.org; any other name means a third-party wrapper. I2P and Freenet are both community-maintained open-source projects—verify signatures and hashes from the official sites (geti2p.net, freenet.org) before you run the installer.

Mobile versus desktop availability

Tor Browser runs on Windows, macOS, Linux, and Android with the same three-relay routing[1][3] and security slider on all platforms. iOS has no official Tor Browser—Onion Browser is the recommended alternative, but it exposes more fingerprinting data because Apple restricts low-level browser modifications. I2P and Freenet are desktop applications with no official mobile versions. If you need .onion access on a phone, Android gives you stronger protections than iOS.

Bundled extras that reduce security

A browser that includes a VPN shifts trust to the VPN operator, who sees your real IP address before your traffic reaches Tor. A browser that displays ads gives ad networks metadata about your session timing and the sites you visit. Tor Browser bundles neither—it routes directly through three Tor relays with no intermediary[1], and it shows no ads. If an app description mentions 'built-in VPN' or 'ad-supported', it is not the official Tor Browser, and you cannot verify what it does with your traffic.

You verify the browser before you use it by checking the developer name, confirming the GPG signature or SHA256 hash, and testing the security slider on a known .onion address. If the tool does not publish signatures or hashes, or if the developer name does not match the official project, you have no way to confirm that the download has not been modified.

Typical Mistakes When Choosing a Dark Web Browser

Installing a browser from an app store without checking the developer name is the most common error. Google Play shows dozens of apps with 'dark web browser' or 'Tor browser' in the title, but only one comes from The Tor Project. OrNET Browser, Tor VPN Browser, and similar apps bundle commercial VPNs or display ads, which means a third party sees your traffic before it reaches the Tor network. You lose the protection that Tor's three-relay routing provides[1][3], because the VPN operator logs your real IP address and the timestamps of your connections. Check the developer field before you install—if it does not say 'The Tor Project', you are trusting an unknown entity with your anonymity.

Assuming a VPN makes any browser safe for .onion access is the second mistake. A VPN encrypts traffic between your device and the VPN server, but it does not route through three random relays or strip fingerprinting data. Your ISP sees that you connected to a VPN, the VPN operator sees which .onion addresses you visited, and the exit relay still sees your traffic leaving the Tor network. Tor Browser routes directly through the Tor network with no intermediary[1][2], so adding a VPN before Tor shifts trust to the VPN provider without improving security. If you need to hide Tor usage from your ISP, configure a bridge inside Tor Browser instead of layering a VPN underneath.

Using a regular browser in incognito mode for .onion links does not work. Incognito mode prevents your browser from saving cookies and history locally, but it does not connect to the Tor network. Chrome, Firefox, and Safari cannot resolve .onion addresses without a Tor proxy, so you will see a DNS error when you try to load the page. Even if you manually configure a SOCKS5 proxy to route through Tor, your regular browser still leaks fingerprinting data—timezone, screen resolution, installed fonts—that Tor Browser spoofs or blocks. You need Tor Browser to reach .onion sites and to apply the protections that prevent tracking across sessions.

Disabling Tor Browser's security settings to make sites load faster removes the fingerprinting protections that keep you anonymous. JavaScript allows a site to query your device's canvas data, WebGL renderer, and battery status, all of which create a unique identifier. Tor Browser blocks these queries when you set the security slider to Safer or Safest, but many .onion sites break without JavaScript. The correct approach is to leave the slider at Safest by default and lower it only for specific addresses you trust, then raise it again before you visit the next site. Lowering the slider globally exposes you to tracking across every .onion address you visit.

Confusing deep web access with dark web access leads to choosing the wrong tool. The deep web includes any page that requires authentication—your email inbox, a university library database, a company intranet—but you reach these pages with a regular browser over HTTPS. The dark web refers to .onion sites on the Tor network, .i2p eepsites on I2P, and freesites on Freenet, all of which require specialized routing. If you only need to access a paywalled journal or a private forum, you do not need Tor Browser. If you need to reach a .onion address, a regular browser with a VPN will not work.

You avoid these mistakes by verifying the developer name before you install, using Tor Browser without a VPN unless you specifically need a bridge, keeping the security slider at Safest until you confirm a site requires JavaScript, and checking the address format (.onion, .i2p, or a Freenet key) before you choose a tool.

Verifying Your Browser Setup Before You Browse

A correct download is only half the task. Before you visit any .onion site, confirm that the browser connects through the Tor network and that no modifications have weakened the protections you expect.

Confirm the download source

Check that you downloaded Tor Browser from torproject.org, I2P from geti2p.net, or Freenet from freenetproject.org. App stores display dozens of tools with 'Tor' or 'dark web' in the name, but only one comes from The Tor Project. Open the browser's About page—Tor Browser lists 'The Tor Project' as the developer; any other name means a third-party wrapper. If you downloaded from a mirror or a search result that redirected through an ad network, delete the file and download again from the official domain.

Verify the signature or hash

The Tor Project publishes GPG signatures for every release at torproject.org/download. Download the .asc signature file alongside the installer, import The Tor Project's public key, and run gpg --verify to confirm the signature matches. If you cannot verify GPG signatures, compare the SHA256 hash of your downloaded file against the hash listed on the official download page. A mismatch means the file was modified after the project released it, and you should not run the installer.

Check the version number from the project's release page

Do not rely on an app store description or a third-party site to tell you the current version. Open torproject.org/download, geti2p.net, or freenet.org and compare the version number on the official page to the version shown in your browser's About menu. Tor Browser updates every four to six weeks, and each Tor relay rotates its onion key every four weeks[4]. A browser that shows a version number more than two months old may fail to connect or use outdated cryptographic keys.

Run the Tor Browser security level check

Open Tor Browser, type about:preferences#privacy in the address bar, and scroll to Security Level. The slider should default to Standard. Set it to Safest, then visit a test .onion address—DuckDuckGo's .onion mirror works for this check. If the page loads with no images and no interactive elements, the security slider is working. If you see ads, videos, or a login form that requires JavaScript, the slider is not applying the blocks it should, and you need to reinstall from the official source.

Test that .onion sites resolve

Type https://www.torproject.org in the address bar and confirm the page loads. Then type a known .onion address—such as the Tor Project's own onion service listed on their homepage—and confirm it resolves. If the .onion address returns a DNS error or a proxy failure, Tor Browser is not routing through the Tor network[1][3]. Close the browser, check that no VPN or firewall is blocking Tor connections, and restart. If .onion addresses still do not resolve, delete the browser folder and download again from torproject.org.

Confirm no browser extensions are installed

Open Tor Browser's Add-ons menu and check that the list shows only NoScript and HTTPS Everywhere (or their equivalents in newer versions). Any other extension—ad blockers, password managers, translation tools—breaks the fingerprinting protections that keep you anonymous. Tor Browser is designed to look identical across all users, and an extra extension makes your configuration unique. If you see an extension you did not install, uninstall Tor Browser and download a clean copy from the official source.

You complete this checklist once, immediately after installation, and again after every update. A browser that passes all six checks is ready to connect to .onion sites with the protections you expect.

Legal and Operational Context: What the Browser Choice Doesn't Protect You From

Choosing the right browser gives you access to .onion sites and hides which specific addresses you visit, but it does not make illegal activity legal, does not conceal your physical location from your ISP, and does not protect you from malicious sites or social engineering. Your ISP sees that you are communicating with the Tor network because your connection passes through entry relays, even though the communication itself is encrypted in multiple layers[2]. Law enforcement agencies in the United Kingdom and across Europe have documented arrests of dark web users who assumed Tor Browser alone provided complete anonymity—these cases typically involved users who revealed identifying information through their behaviour rather than through a flaw in the browser.

The Tor Project's own documentation states that Tor does not guarantee total anonymity. A circuit built over three relays[3] hides the link between your IP address and the .onion site you visit, but it does not prevent you from logging into a service with your real email address, uploading files that contain metadata, or reusing a username that appears on the surface web. If you type your name into a form on a .onion site, the browser cannot undo that action. Similarly, if you download a file that contains a tracking pixel or a malicious script, opening that file outside Tor Browser can expose your real IP address.

What your ISP and network operator can observe

When you connect to Tor Browser, your ISP sees the IP address of the Tor entry relay you contacted and the volume of encrypted data you send and receive. It does not see which .onion addresses you visit or what you do on those sites[2]. In the United Kingdom, ISPs are required under the Investigatory Powers Act 2016 to retain connection logs for twelve months, which means a record of your Tor usage exists even if the content of your browsing remains private. Using Tor is legal in the UK, but the fact that you used it is not hidden from your ISP unless you route through a bridge—a relay not listed in the public Tor directory.

A bridge conceals Tor usage from network-level observation but does not change what the browser itself protects. You still connect through three relays[1][3], and your traffic still exits through a Tor exit node that can see unencrypted data if you visit an HTTP site. The exit node does not know your real IP address, but it sees the destination address and the content of any unencrypted request. If you enter a password on an HTTP .onion site, the exit relay operator could log that password. This is why Tor Browser warns you when a site does not use HTTPS.

What the browser does not protect against

Tor Browser routes your traffic through the Tor network, but it does not scan .onion sites for malware, phishing pages, or scams. A .onion address can host the same threats you encounter on the surface web—fake login forms, ransomware downloads, social engineering attempts. The browser's security slider blocks JavaScript and other active content at the Safest level, which reduces the attack surface, but it does not prevent you from voluntarily entering your details into a fraudulent form.

You protect yourself by treating every .onion site as untrusted until you verify its authenticity. Check that the .onion address matches the one published by the service operator on a separate channel—such as their surface web homepage or a signed message. Do not click links in unsolicited messages, do not download files unless you can verify their source, and do not reuse passwords across .onion services and surface web accounts. The browser hides your IP address; it does not make decisions about which sites are safe to use.

Illegal activity remains illegal regardless of the browser you choose. Accessing a .onion site is not a crime in the United Kingdom, but purchasing controlled substances, distributing illegal content, or engaging in fraud are offences under UK law whether they occur on the surface web or the dark web. How to Access the Dark Web: A Step-by-Step Guide explains the legal boundaries in detail. Tor Browser provides privacy; it does not provide immunity from prosecution if you break the law.

Typical Mistakes and Misconceptions

Assuming a VPN app gives you the same protection as a dark web browser

Many app stores list VPN applications under 'dark web browser' search terms, and users install them expecting .onion access. A VPN encrypts traffic between your device and a single commercial server, but it does not route your connection through the Tor network's three-relay circuit, and it does not open .onion addresses. The VPN provider also sees your real IP address and your destination, which means it can log both ends of the connection. If you need to reach .onion sites, install Tor Browser from torproject.org, not a VPN app that claims to offer 'dark web' features.

Believing Tor Browser reaches every dark web site

Tor Browser opens .onion addresses, but it cannot open I2P eepsites (.i2p) or Freenet freesites. These are separate networks with different routing models: I2P uses packet-switched, simplex tunnels and garlic routing, while Tor uses circuit-switched, duplex connections[5][10]. A site hosted only on I2P or Freenet will not resolve in Tor Browser, no matter how you configure it. If you need access to all three, you will need separate tools: Tor Browser for .onion, an I2P router with its bundled browser for .i2p, and Freenet's application for freesites.

Treating the Tor Browser for Android listing as interchangeable with desktop Tor Browser

The official Tor Browser for Android is published by the Tor Project and available through their site or the Google Play Store. Third-party browsers that claim 'Tor support' on Android often embed a Tor proxy without the same fingerprinting protections, security slider, or update cadence. Check the maintainer: if the app's developer is not 'The Tor Project' and the version string does not match the release on blog.torproject.org, you are not running the audited build. On iOS, the situation is different—Onion Browser is the primary option, but it does not have the same security slider as desktop Tor Browser, and its maintainer is an independent developer rather than the Tor Project.

Skipping signature and hash verification because 'the site looked official'

Downloading from a mirror, a third-party file host, or a search result that mimics the project's branding can deliver a modified installer. The Tor Project publishes GPG signatures and SHA256 hashes for each release so you can verify that the file you downloaded matches what the developers signed. If you skip this step, you cannot distinguish a legitimate build from one that has been altered to route your traffic through an attacker's relays. Verify the signature against the project's public key, and compare the hash to the one listed on the official release page before you install.

Assuming the security slider default is sufficient for all activity

Tor Browser's default security level allows JavaScript, which some .onion sites use to fingerprint visitors or exploit browser vulnerabilities. The 'Safest' level disables JavaScript, SVG, and some fonts, reducing the attack surface but breaking functionality on sites that require scripts. The correct setting depends on what you are doing: reading static pages works fine on Safest, while interactive marketplaces or forums may require you to lower it. You make that trade-off deliberately, not by leaving the default untouched and assuming it protects you.

Thinking your ISP cannot tell you are using Tor

Your ISP cannot see which .onion sites you visit, because traffic is encrypted in layers and routed through relays[2]. But it can see that you are connecting to a known Tor entry guard, and it logs the timestamp and session duration. In the United Kingdom, this metadata alone is not illegal, but it can attract scrutiny or be retained under data retention rules. If you want to hide the fact that you are using Tor from your ISP, you need a bridge or a VPN, and each of those introduces a different trust relationship—your ISP sees a VPN connection instead, but the VPN provider sees your Tor usage.

Conclusions

• Choose the browser by network first: Tor Browser for .onion, I2P for .i2p, Freenet for freesites. No single tool covers all three.

• Verify the installer before you run it. Check the GPG signature and SHA256 hash against the official release page, not the site that looked official.

• Set the security slider deliberately. 'Safest' blocks JavaScript and reduces attack surface, but it breaks interactive sites; lower it only when you need to.

• Treat Android listings with suspicion. The official app comes from 'The Tor Project' and matches the version on blog.torproject.org; anything else is not the audited build.

• Remember that Tor hides which .onion sites you visit, but your ISP still sees that you connected to a Tor entry guard.

Start with Tor Browser from torproject.org, verify the download, and set the slider to 'Safest' before you open your first .onion address. When you are ready to take that step, follow How to Access the Dark Web: A Step-by-Step Guide.