If you’ve watched any crime drama in the past ten years, you’ve heard someone mention the dark web in hushed, ominous tones. It’s portrayed as this shadowy digital underworld where anything goes and terrible things happen.

That’s… not entirely inaccurate. But it’s also not the whole story.

Let me clear up some of the mystery, because understanding what the dark web actually is — and what criminals actually do with it — is far more useful than being scared of it.

The Internet Has Layers

Think of the internet like an iceberg.

The surface web is what you use every day — Google, Amazon, Facebook, YouTube, this blog. It’s anything you can find with a search engine. Estimates suggest it represents only about 4-5% of the total internet.

The deep web is everything that search engines can’t index — your online banking dashboard, your email inbox, medical records, private databases. This is completely normal and boring. You use it constantly.

The dark web is a small, intentionally hidden slice of the internet that requires special software — most commonly a browser called Tor (The Onion Router) — to access. The content on the dark web is deliberately obscured so that users and servers can’t easily be identified.

So What’s Actually on the Dark Web?

The dark web has legitimate uses. Journalists use it to communicate with sources in authoritarian countries. Activists and dissidents use it to avoid government surveillance. Privacy advocates use it for research.

But yes — it’s also a marketplace for illegal activity. And that’s the part relevant to your security.

According to researchers, dark web marketplaces trade in stolen credentials, credit card data, counterfeit documents, and hacked account access. Some examples of what’s for sale and at what price:

  • A stolen credit card with billing info: $5–$120
  • A “fullz” — a complete identity package (name, SSN, DOB, address): $16–$228
  • Access to a hacked corporate network: thousands of dollars

It’s essentially a black market, running on cryptocurrency to avoid tracing payments, with buyer reviews and customer service — the dark web has its own grim version of Amazon. In 2024, analysts tracked over 720,000 sales totaling $17.3 million in stolen personal data on a single market.

How Does Your Data End Up There?

When a company gets breached — Target, Equifax, a healthcare provider, a retailer you bought something from in 2018 — the stolen records don’t just disappear. They get packaged up and sold on dark web markets. The criminals who buy them then use the data to commit fraud, open accounts, or launch targeted phishing attacks.

This is the real danger of data breaches: not the breach itself, but the downstream market for the data.

How Do You Know If Your Data Is There?

Here’s the good news: you don’t need to go anywhere near the dark web to check. Security researcher Troy Hunt built a completely legitimate, free service that monitors known data dumps and lets you check whether your email address has appeared in any breach.

It’s called Have I Been Pwned — and yes, “pwned” is internet slang for “owned” or compromised. You just type in your email address and it tells you if it’s shown up. No download, no account required.

You can also sign up for free email alerts, so if your address appears in a future breach, you’ll know quickly.

If your email address shows up: change the password you used at that site, and if you used that same password anywhere else, change it there too.

What About Those “Dark Web Monitoring” Services?

You may have seen advertisements or credit monitoring services offering “dark web monitoring” — often as an upsell. These services automatically scan known data dumps for your information and alert you.

They can be useful, but read the fine print. Most are scanning the same public data dumps that Have I Been Pwned already monitors. A legitimate service won’t actually access dark web criminal forums on your behalf — they’re scanning databases that have already been exposed publicly.

Bottom line: The dark web is real, and it’s where your stolen data ends up when companies get breached. You don’t need to go there yourself, but you should check regularly at haveibeenpwned.com to find out if your information has been exposed. Knowledge is the first step — knowing you’ve been breached means you can act before a criminal does.