Darknet Structure & Architecture
To understand the darknet, it helps to stop picturing it as a secret parallel Internet. It is not a place. It is a set of protocols and overlay networks that run on top of the ordinary Internet and deliberately hide who is talking to whom. This article explains the three layers of the Internet and the machinery — onion routing, relay circuits and hidden services — that makes anonymity work.
The three layers of the Internet
Internet content is usually described as three nested layers. The exact percentages are debated and vary by methodology, but the mental model is useful:
| Layer | What it is | How you reach it |
|---|---|---|
| Surface web | Public pages found by search engines — news, shops, social media, this site. | Any normal browser; indexed and searchable. |
| Deep web | Pages not indexed: email inboxes, bank accounts, databases behind forms and logins. Orders of magnitude larger than the surface web. | Any normal browser, but you need credentials or the exact URL. |
| Darknet | Anonymity networks (Tor, I2P, Freenet) where both traffic and services are encrypted and hidden. A small fraction of the deep web. | Special software such as the Tor Browser. |
A useful analogy: the surface web is the visible storefront of a city; the deep web is everything behind locked doors and in filing rooms; the darknet is the network of unmarked tunnels beneath it — technically part of the same city, but with its own entrances and its own rules.
Deep web vs. darknet
The most common confusion is treating "deep web" and "darknet" as synonyms. They are not.
This distinction matters because the darknet's defining feature is not secrecy of content but anonymity of communication. Deep-web pages are hosted on ordinary servers with ordinary IP addresses. Darknet services are designed so that no observer can tell who hosts them or who visits them.
Overlay networks
The darknet is built from overlay networks: logical networks layered on top of the physical Internet, using its connections but changing how addressing and routing work. On the ordinary Internet, every packet carries a destination IP address that routers can read. An overlay network replaces that with its own addressing and forwarding rules, so the underlying IP traffic is meaningless to an outside observer.
Each major darknet is its own overlay:
- Tor — the largest and best-known, based on onion routing; millions of users daily. (Details.)
- I2P — the "Invisible Internet Project," using garlic routing, optimized for hidden services rather than browsing the open web. (Details.)
- Freenet — a peer-to-peer distributed data store focused on censorship-resistant publishing. (Details.)
Onion routing, explained simply
Onion routing is the core trick. Instead of sending your request directly to a website, your client:
- Encrypts the message in several nested layers — like the layers of an onion.
- Chooses a path through three relays and addresses each layer to one relay in the chain.
- Sends the bundle to the first relay, which peels off the outermost layer, sees only the next hop, and forwards the rest.
- Each relay does the same until the final relay — the "exit" — peels the last layer, reads the destination, and delivers the request to the website.
Because every relay sees only its immediate neighbors in the chain, no single relay knows both where the traffic came from and where it is going. The path is also re-randomized periodically, so one compromised relay reveals nothing about your other sessions.
The three-node circuit
A standard Tor circuit has exactly three nodes, each with a distinct role:
| Node | Position | What it sees |
|---|---|---|
| Guard (entry) | First | Knows your IP address but not your destination. |
| Middle | Second | Sees neither your IP nor the destination — only two other relays. |
| Exit | Last | Sees the destination website but not your IP; delivers and receives the plaintext traffic. |
Three hops are a balance: more hops mean more anonymity but slower speeds, and research has shown that the endpoints are where the real risks live. If an attacker controls both the entry and the exit of the same circuit, they can link your IP to your destination. That "traffic correlation" attack is the fundamental threat to Tor — and the reason the system is designed to rotate circuits and guard nodes over time.
Hidden services and .onion
Onion routing also lets you hide a server, not just a client. A hidden service runs its traffic through the network so that its true IP address never appears; clients reach it through a special .onion address that is a hash of the service's public key. The introduction and rendezvous points coordinate the connection without either side learning the other's location. (Read the full guide to hidden services.)
This is what people usually mean by "darknet sites" — not websites, but hidden services that exist only within the anonymity network.
The major darknets compared
| Network | Primary design goal | Strengths | Limitations |
|---|---|---|---|
| Tor | Anonymous access to the open web + hidden services | Huge network, easy to use, mature software | Exit-node traffic visible; correlation attacks possible |
| I2P | Anonymized internal services (eepsites) | All traffic internal — no vulnerable exits; resistant to exit sniffing | Smaller network, slower to reach the open web |
| Freenet | Censorship-resistant distributed storage | Content survives as long as any node keeps it; strong deniability | Slow; not designed for real-time browsing or commerce |
Underneath all of them lies the same principle that began with David Chaum's 1981 mix concept and was industrialized by the Naval Research Laboratory's onion routing: separate the identity of the sender from the fact of the message, and the state of who-talks-to-whom becomes something no single observer can reconstruct.