List of deep web search engines

Technical Criteria for Indexing .onion Hidden Services

Deep web search engines index .onion hidden services using specialized methods that differ from traditional DNS systems. These engines rely on the Tor network to access content, bypassing standard web protocols. The indexing process involves several technical criteria.

Crawlers used in these engines operate within the Tor network and must handle unique challenges. Unlike typical web crawlers, they cannot rely on DNS resolution. Instead, they connect directly to .onion addresses through Tor's anonymity-focused architecture. This approach allows them to access and index hidden services, but it presents limitations.

One significant limitation is the dynamic nature of .onion content. Many hidden services update frequently or require user interaction. For example, password-protected forums or invitation-only marketplaces cannot be indexed, as their content remains inaccessible without authentication (3). This restricts the range of searchable material.

Database schemas play a crucial role in how search engines store indexed data. They often utilize systems like Elasticsearch for efficient searching and retrieval. Ahmia, for example, employs Elasticsearch in its architecture, allowing for robust querying capabilities (4). This structure helps manage metadata and content efficiently.

Engines like Torch and Ahmia have developed unique methods to index active .onion addresses. In October 2026, Tor Metrics reported about 665,000 unique onion addresses accessed daily (5). In contrast, a 2025 study revealed around 36,000 active addresses indexed in a single day (5). This discrepancy highlights the varying effectiveness of different search engines.

Handling dynamic content is another challenge. Advanced features like autocomplete suggestions often require JavaScript execution, which can compromise user anonymity (2). Search engines must balance functionality with the need for user privacy.

In summary, indexing .onion hidden services requires specialized techniques, careful consideration of crawler limitations, and robust database architectures. Understanding these criteria is essential for effectively navigating the deep web.

Ahmia: Metadata Filtering and Clear-Web Accessibility

Ahmia is a distinctive deep web search engine that prioritizes user safety and content filtering. Developed initially as an academic project at the University of Helsinki, Ahmia launched in 2014 with backing from the Tor Project and Google Summer of Code (4). Its primary feature is the ability to filter out abusive content while providing access to both Tor hidden services and the clear web.

Ahmia employs a robust indexing mechanism that utilizes Scrapy for web crawling, Elasticsearch for indexing, and Django for its web interface (4). This technical architecture allows Ahmia to index .onion addresses efficiently while ensuring that search results are relevant and safe. In October 2023, Ahmia expanded its content filtering policies to block all sexually related search terms and domains, addressing the high frequency of abusive material encountered in previous research (4).

Users can access Ahmia via the clear web at ahmia.fi, which enables searching for Tor hidden services without needing to use the Tor Browser directly (6). However, to access the actual .onion endpoints, users must utilize the Tor Browser, maintaining the anonymity that the Tor network provides.

Ahmia's filtering mechanism is crucial for its operation. Unlike unfiltered engines like Torch, which expose users to potential scams and illegal content without warnings (7), Ahmia ensures that users are directed toward safer content. This makes it a preferred choice for users who prioritize security and content integrity.

For system administrators and network engineers seeking to explore the deep web, Ahmia presents a reliable option. Its combination of clear-web accessibility and metadata filtering allows users to navigate the complexities of hidden services without compromising safety.

Torch: Legacy Indexing and Large Database Architecture

Torch is one of the oldest search engines on the .onion network, operating since the early 2010s. It has built an extensive index of over a million pages, making it a significant resource for users seeking hidden services (1). The scale of Torch's database presents unique engineering challenges, particularly in managing outdated links and dead records.

Handling dead links is crucial for maintaining the reliability of search results. The dynamic nature of the deep web means that many .onion addresses may become inactive shortly after being indexed. For instance, in October 2026, Tor Metrics reported approximately 665,000 unique onion addresses accessed daily, indicating a constantly shifting landscape (5). As a result, search engines like Torch must frequently update their indexes to reflect current content accurately.

The challenge of outdated records is compounded by the sheer volume of entries. With millions of indexed pages, it becomes increasingly difficult to verify the status of each link. This can lead to user frustration when searching for specific content. A 2025 study found that around 36,000 active addresses were indexed in a single day across several major search engines (5). This suggests that while Torch has a vast index, the actual number of reliable links may fluctuate significantly.

Moreover, unlike filtered search engines, Torch does not provide automated warnings about potential scams or illegal content. Users may encounter phishing clones or other malicious sites without any prior alerts (7). This lack of filtering increases the importance of user diligence when navigating results.

To effectively use Torch, users should employ additional verification methods, such as PGP verification for sensitive transactions and being cautious with links that seem suspicious. Understanding the risks associated with unfiltered searches is essential for a safe experience on the dark web. Torch remains a valuable tool, but users must approach it with an awareness of its limitations and the inherent risks of the deep web.

Haystak and OnionLand: Database Size and Query Performance

Haystak and OnionLand Search are two prominent deep web search engines that cater to users seeking .onion hidden services. Both have unique features, capabilities, and performance metrics that make them suitable for different types of queries.

Database Size

Haystak boasts a substantial index, containing over 1 million pages, which positions it as one of the largest search engines in the .onion space. This extensive database allows users to access a wide array of hidden services. In contrast, OnionLand Search differentiates itself by indexing not only Tor hidden services but also I2P nodes and selective clearnet entries. This multi-network approach enhances its versatility but may result in a smaller dedicated .onion index compared to Haystak.

Query Performance

When using SOCKS5 proxies, query response times can significantly affect user experience. Haystak is optimized for fast retrieval, providing quick results even over these proxies. Users can expect response times in the range of 1 to 3 seconds, depending on the complexity of the query and network conditions.

OnionLand Search, while capable of concurrent querying across multiple networks, may experience slightly longer response times due to its broader scope. Users might notice response times averaging 3 to 5 seconds when searching for specific .onion services. This delay can be attributed to the need for the engine to aggregate results from various sources.

Paid Tier Features

Both Haystak and OnionLand offer paid tiers with advanced features that enhance usability. However, focusing on technical capabilities, Haystak provides robust indexing and search functionalities, while OnionLand excels in its ability to query multiple networks simultaneously. This capability allows users to access a wider range of content but may require more complex processing, impacting speed.

For users navigating the deep web, the choice between Haystak and OnionLand will depend on specific needs. If speed and extensive indexing are priorities, Haystak is a strong contender. For those seeking versatility across different networks, OnionLand may be the better option. Understanding these differences can help users select the right tool for their deep web searches.

DuckDuckGo Onion Service: Privacy-Focused Routing

DuckDuckGo operates an official .onion service, emphasizing user privacy while providing search capabilities within the Tor network. Unlike traditional search engines, DuckDuckGo's architecture focuses on stateless query execution and does not index dark web hidden services. Instead, it exclusively indexes the surface web, making it a unique player in the deep web search engine landscape (8).

Architectural Implementation

DuckDuckGo's .onion endpoint leverages several key architectural components to ensure user privacy and efficient routing. One critical aspect is TLS termination. This process secures the connection between the user and DuckDuckGo's servers, ensuring that all data transmitted remains encrypted. This approach protects users from potential eavesdropping while accessing the service.

Stateless query execution is another essential feature. DuckDuckGo processes each search query independently, meaning no user-specific data is stored between requests. This method minimizes the risk of user tracking and enhances privacy. In a typical scenario, when a user submits a query, the system processes it without retaining any identifiable information, allowing for a more anonymous search experience.

Log Policy

DuckDuckGo maintains a strict log policy, which is vital for user privacy. The service does not store personal information, search history, or IP addresses, ensuring that user activity remains untraceable. This policy aligns with the overarching goal of the Tor network, which is to provide anonymity and protect users from surveillance.

In summary, DuckDuckGo's .onion service is designed to prioritize user privacy through its architectural implementation. The combination of TLS termination, stateless query execution, and a strict log policy creates a secure environment for users navigating the Tor network. For system administrators and network engineers, understanding these features can help in evaluating the effectiveness of privacy-focused routing solutions within the deep web.

Evaluating Index Freshness and Uptime in Onion Search Engines

To effectively evaluate the performance of onion search engines, consider key engineering metrics like index freshness, uptime, and resilience against common threats. These metrics are crucial for system administrators and network engineers.

Index Freshness

Index freshness refers to how up-to-date the search results are. In the deep web, content can change rapidly, making timely updates essential. For instance, Tor Metrics reported approximately 665,000 unique onion addresses accessed daily in October 2026 (5). A search engine must frequently update its index to reflect this dynamic environment.

To measure index freshness, track the following:

• Frequency of index updates (e.g., daily, weekly).

• Percentage of active links versus dead links.

• Time taken to remove outdated entries.

Engines like Torch, with its extensive index of over a million pages, face challenges in maintaining freshness due to the high volume of links (1). Regular audits of indexed content can help reduce user frustration.

Uptime and Reliability

Uptime is another critical metric. High uptime ensures that users can access search services when needed. A search engine should aim for 99.9% uptime, which translates to less than 9 hours of downtime annually.

To enhance uptime, consider:

• Load balancing across multiple servers.

• Implementing redundancy in infrastructure.

• Monitoring server performance and health.

Handling Node Churn and DDoS Attacks

Frequent node churn is common in the Tor network. Search engines must adapt to new .onion addresses while removing inactive ones. A proactive approach involves:

• Utilizing crawlers that can handle dynamic content and identify dead links.

• Regularly updating routing tables to reflect current nodes.

DDoS attacks pose further challenges. To mitigate these threats, search engines can:

• Implement rate limiting to control traffic.

• Use distributed server architectures to absorb attacks.

• Monitor traffic patterns for unusual spikes.

Maintaining a reliable and up-to-date onion search engine involves addressing these technical challenges. By focusing on index freshness, uptime, and resilience against attacks, you can improve user experience and search reliability.

System Administrator Checklist for Secure .onion Resource Verification

To ensure secure interactions with .onion resources, follow this technical checklist. It covers verifying PGP keys, checking TLS certificates on onion endpoints, and isolating query traffic using dedicated network namespaces.

PGP Key Verification

1. Obtain the PGP public key from the service provider.

2. Verify the key's fingerprint through a trusted channel.

3. Use GnuPG to import the key:

   gpg --import publickey.asc
   

4. Verify the key:

   gpg --fingerprint <email-or-key-id>
   

5. Encrypt messages or files using the verified key:

   gpg --encrypt -r <recipient-key-id> file.txt
   

TLS Certificate Checking

1. Use the Tor Browser to access the .onion service.

2. Click on the padlock icon in the address bar.

3. View the certificate details:

   • Check the validity period.

   • Verify the issuer.

   • Ensure the certificate is issued to the correct .onion address.

4. Use OpenSSL to manually check the certificate:

   openssl s_client -connect <onion-address>:443
   

5. Look for any discrepancies in the certificate chain.

Isolating Query Traffic with Network Namespaces

1. Create a dedicated network namespace for onion traffic:

   ip netns add onion-net
   

2. Set up a virtual Ethernet pair:

   ip link add veth0 type veth peer name veth1
   

3. Assign one end to the namespace:

   ip link set veth1 netns onion-net
   

4. Configure the virtual interfaces:

   ip addr add 10.0.0.1/24 dev veth0
   ip netns exec onion-net ip addr add 10.0.0.2/24 dev veth1
   

5. Bring up the interfaces:

   ip link set veth0 up
   ip netns exec onion-net ip link set veth1 up
   

6. Route traffic through the namespace:

   • Use a SOCKS5 proxy to direct .onion queries through the isolated environment.

By following this checklist, you can enhance security when interacting with .onion resources, minimizing risks associated with unverified content and ensuring safe communications.

Final Insights

• Review the uptime reliability metrics to select engines that maintain at least 99.5% availability for continuous directory operations.

• Implement network isolation protocols using dedicated namespaces before executing queries across different .onion protocols.

• Perform regular audits of indexed content to mitigate the impact of dynamic node churn on search accuracy.

• Check TLS certificates manually on onion endpoints to ensure proper encryption and validate authenticity.

To explore more directory structures, read the Topic Links 3.0 Onion guide.