QUICK ANSWER
Do you need a VPN to use Tor or onion sites?
No. Tor Browser is designed to access onion services directly. Tor and VPNs are separate technologies with different trust models, and combining them does not guarantee anonymity.
Use Tor Browser from the official Tor Project, verify legitimate onion addresses through each organization’s normal official website, and avoid third-party directories, downloads and unlawful marketplaces.
The surface web, deep web and dark web are not the same
The surface web is content ordinary search engines can index. The deep web includes routine non-public material such as email, account dashboards and private databases. The “dark web” usually refers to intentionally hidden services reached through specialized networks, most commonly Tor onion services.
The legacy article mixed legitimate resources with unsafe directory and marketplace material. This migration keeps the educational distinctions and legitimate uses, while removing illicit recommendations, marketplace categories and obsolete onion addresses.
What an onion service is
An onion service uses a .onion address and is reached through the Tor network. The Tor Project explains that onion services provide location privacy for the service and end-to-end authentication within the Tor protocol. That does not mean every operator is trustworthy or every page is safe.
Use the official Tor Project website to obtain Tor Browser and current documentation. Avoid third-party installers.
Legitimate reasons organizations publish onion services
Journalism and access to news
News organizations may publish official onion addresses so readers can reach their reporting through Tor. Verify the address on the organization’s normal official domain; do not reproduce an old address from an unaffiliated directory.
SecureDrop
SecureDrop is an open-source system used by newsrooms and public-interest organizations for source submissions. Each participating organization publishes its own instructions and onion address. It is not a guarantee of personal safety, legal protection or anonymity in every circumstance.
Privacy and research
Researchers, civil-society groups and software projects can use onion services to study censorship resistance, make public information available through another route, or reduce exposure of service location.
Why “best dark web sites” is the wrong safety model
Ranked link lists age quickly and are easy to impersonate. A copied character can lead to a phishing service, and abandoned addresses can disappear. Generic directories such as “Hidden Wiki” variants have no single authoritative operator and can mix benign links with scams or unlawful content.
This guide therefore does not publish marketplace links, stolen-data sites, hacking services, weapons or drug markets. It also does not reproduce addresses that cannot be verified through an official first-party website.
A safety-first checklist
- Download Tor Browser only from the Tor Project.
- Keep it updated and do not add unnecessary extensions.
- Get an onion address from the organization’s official normal website.
- Check the entire address; do not trust a familiar-looking title or logo.
- Avoid downloads and do not open unknown files outside the protected browser environment.
- Do not share identifying, financial or credential information with an unverified service.
- Leave immediately if content appears unlawful or harmful.
- Follow applicable law and organizational policy.
Tor and VPNs are separate technologies
Tor Browser routes traffic through the Tor network. A VPN creates an encrypted tunnel to one VPN provider. Combining them changes which parties observe the first connection and can introduce new trust and configuration issues. It does not create a blanket guarantee of anonymity.
The Tor Project advises that VPN use with Tor is generally not recommended unless the user is advanced and understands how to configure both. This page does not prescribe “VPN first, then Tor” as a universal safety step.
For the general network model, read VPN privacy and security and what an ISP can see. Neither a VPN nor Tor prevents phishing, malware, account identification or consequences from unlawful activity.
Useful answers
Frequently asked questions
Do you need a VPN to use Tor or onion sites?
No. Tor Browser is designed to access onion services directly. Tor and VPNs have different trust models; adding a VPN is not a universal Tor Project recommendation and does not guarantee anonymity.
Are onion sites illegal?
Onion services are a technology with legitimate and unlawful uses. Legality depends on the activity, content and jurisdiction. The technology itself should not be equated with criminal conduct.
How should an official onion address be verified?
Obtain it from the organization's normal official website or another first-party channel. Do not trust link directories, search snippets or lookalike addresses.
Does Tor protect against malware and phishing?
No. Tor changes network routing but cannot make a malicious download, impersonation page or unsafe disclosure harmless. Keep Tor Browser updated and avoid unnecessary downloads.