Think about the twenty things you searched for most recently. A symptom you were worried about, a company you might apply to, a street near where you live, someone’s name. Put together, a list like that reveals more about a person than almost anything else they do on the internet. People tell search engines things they wouldn’t tell their friends.
That is why the search engine is the first thing to get right when you begin using Tor, and why two well-known search companies, DuckDuckGo and Brave, run official onion versions of their search. Tor Browser already uses DuckDuckGo as its default, so a large number of Tor users rely on one of these two engines without ever having thought about it.
This page goes beyond simply giving the two addresses and looks at a search from the point of view of an observer. Who can see that you searched? Who can see what you searched for? Which of those things does Tor hide, which does the onion hide on top of that, and which does nothing hide at all? Once you understand where each form of protection ends, it becomes clear how to search safely, and why we don’t include the so-called dark web search engines that appear in so many link lists.
The two official search onions#
Both addresses below passed at least 13 of the last 14 daily reachability checks as of October 11, 2026, and both are served over HTTPS with a certificate issued to the onion name, which is the hardest kind of proof to forge. They are the same two listed in our Official Onion Mirrors Directory.
| Search engine | Address | Proof |
|---|---|---|
| DuckDuckGo | duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onionListed in our directory as DuckDuckGo (Search).duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad |
TLS certificate |
| Brave Search | search.brave4u7jddbv7cyviptqjc7jusxh72uik7zt6adtckl5f4nwy2v72qd.onionListed in our directory as Brave Search (Search).brave4u7jddbv7cyviptqjc7jusxh72uik7zt6adtckl5f4nwy2v72qd |
TLS certificate |
DuckDuckGo#
DuckDuckGo has been Tor Browser’s default search engine since version 6.0.6. Before that, the browser used Disconnect, a meta search engine, which fell back to Bing’s results when it lost access to Google’s. The Tor Project says it chose DuckDuckGo because it doesn’t log, collect or share users’ personal information or search history.
The onion is the same search engine, reached without leaving the Tor network. The Tor Project’s support pages also mention a shortcut. When you use DuckDuckGo in Tor Browser, an Onionize option takes you straight to the onion version.
Brave Search#
Brave Search is the search engine from Brave, the company that makes the Brave browser. The key difference from DuckDuckGo is under the hood. Rather than relying mainly on another company’s results, Brave runs its own crawler and builds its own index of the web, so it can give quite different answers to the same query. That alone makes it worth having as a second opinion.
Brave’s onion story is a brief history lesson in itself. The company first launched a short version 2 onion for its website. When v2 addresses were retired, it switched to the 56-character v3 address above, which serves both brave.com and, on the search. subdomain, Brave Search. Brave also explained publicly how it set the service up, including generating an address that begins with its own name and recommending that other websites add an Onion-Location header. The company also runs Tor relays.
Note the search. at the start of Brave’s address. It’s a subdomain of the same onion service, just as www. is on a regular website. If you leave it out, you’ll land on Brave’s main website instead of its search page.
What a search reveals, and what each layer hides#
A single search leaves traces in several places at once. Some are visible to the search company, some to your network provider, and some to the machines in between. Here is how the picture changes when you add Tor, and then the onion.
| What could be seen | Normal browser | Tor Browser, normal search site | Tor Browser, search onion |
|---|---|---|---|
| Your IP address and rough location, seen by the search company | Visible | Hidden | Hidden |
| That you’re using this search engine, seen by your network provider | Visible | Hidden (it sees only that you use Tor) | Hidden (it sees only that you use Tor) |
| The lookup of the search engine’s name in DNS | Seen by your DNS resolver | Done by the Tor exit relay | No DNS lookup at all |
| A Tor exit relay between you and the search engine | Not applicable | Yes, it sees which site you connect to, but not the query inside HTTPS | No exit relay |
| Proof you’ve reached the real search engine | HTTPS certificate | HTTPS certificate | The onion address itself, plus a certificate |
| Your search history tied to cookies or an account | Depends on your settings | Cleared when you close Tor Browser or use New Identity | Cleared when you close Tor Browser or use New Identity |
| The words you type into the search box | Seen by the search company | Seen by the search company | Seen by the search company |
Two things stand out.
Most of the protection comes from Tor itself. The biggest change is moving from a normal browser to Tor Browser. With Tor Browser, your IP address, your location and the fact that you use a particular search engine all disappear from view. Searching DuckDuckGo’s normal website through Tor Browser already gets you most of the way.
The onion adds a smaller but real layer on top. By removing the exit relay and the DNS lookup, it means no third party sits between you and the search company, and nobody can interfere with the connection as it leaves Tor. The address itself also proves you’ve reached the right service. And since an onion can’t be blocked by name, it’s harder for a censor to cut it off.
The one row nothing can change#
Look at the last row. Whatever you do, the search company sees what you search for. That isn’t a weakness in Tor or in the onion. It’s simply how search works. DuckDuckGo and Brave both say they don’t build profiles from your searches, and because you’re using Tor, they can’t link a query to your IP address. But the query itself still reaches their servers.
This matters more than people realise, because a query can identify you on its own. Search for your name, your street, your employer’s internal project, or a rare medical condition together with your town, and the words do the identifying that your IP address no longer can. A few habits follow from this.
- Keep identifying searches separate from sensitive ones. If you need to look up your own address and also research something private, do the two in separate sessions and use New Identity between them.
- Don’t combine details that narrow things down. One search for a rare condition reveals little about you. Add your town and your age range to the same search, and it comes close to a name.
- Search engines aren’t the only ones who see queries. When you click a result, the website you land on often learns what brought you there, depending on the site and the engine’s settings.
Tor Browser’s built-in search#
If you type a search into Tor Browser’s address bar or its home page, it goes to DuckDuckGo. That has been the default since Tor Browser 6.0.6, and it’s a reasonable choice for most people. By default, though, it goes to DuckDuckGo’s normal website through a Tor exit relay, not to the onion.
As the table above shows, that is still private in the ways that matter most. If you want the extra layer the onion provides, there are two simple ways to get it.
- Use the Onionize option. According to the Tor Project’s support pages, when you use DuckDuckGo in Tor Browser, an Onionize option switches you to DuckDuckGo’s onion. Then carry on searching from that page.
- Bookmark the onion and start there. Copy the address from the table above, check all 56 characters and save it as a bookmark. Whenever you want to search, open the bookmark instead of typing into the address bar. Do the same for Brave Search if you’d like a second engine.
You can also change the default search engine in Tor Browser’s settings, under Search, if you’d rather use a different one. Bear in mind the point from the earlier section, though. The engine you choose will see your queries, so pick one whose privacy promises you’re comfortable with, and don’t install search extensions or toolbars to get there. Every add-on makes your browser look different from everyone else’s, which works against the way Tor Browser protects you. How to Download and Install Tor Browser Safely explains why the browser is best left as it ships.
The same applies on a phone. In Tor Browser for Android, check which engine the address bar uses, and bookmark the onion in the same way. If you use Onion Browser on an iPhone, check which search engine it’s set to before you rely on it. Our guide to using Tor on Android and iPhone covers the genuine apps.
Using them well#
Having the right address is the first step. How much protection you actually get depends on how you use it.
Security levels and the search page#
Ordinary search results are mostly text and links, so they cope well with Tor Browser’s higher security levels. DuckDuckGo also offers a lightweight HTML version of its search for browsers that don’t run JavaScript, which is another advantage. The features that don’t cope well are the newer interactive ones, which brings us to AI.
The AI features#
Both engines have added AI to search. DuckDuckGo offers Search Assist, which shows short AI-generated answers above the results, and Duck.ai, a chat service that gives anonymised access to AI models from other companies. DuckDuckGo says these features are optional and can be switched off in its settings. Brave builds AI answers into its results using its own index, and also offers a chat interface called Ask Brave.
If you use them over Tor, two points are worth knowing.
They usually need JavaScript. At the Safest security level, expect AI answers and chat to stop working while ordinary results still load. If you rely on them, you’ll need Standard or Safer. For an explanation of the trade-off, see our guide to Tor Browser security levels.
Anything you type goes further than a normal search. DuckDuckGo says it removes identifying metadata before passing chat prompts to the AI companies, and that those companies must delete them within a set period. But DuckDuckGo’s own privacy policy also makes clear that if you include personal information in a prompt, it can end up on the AI provider’s servers. Tor hides where you are. It can’t take back what you’ve written. Treat an AI chat like any other website you’re telling something to.
Results lead off the onion#
This catches people out. The onion protects your connection to the search engine. As soon as you click a result, you leave it. Most results point to ordinary websites, so Tor Browser reaches them through an exit relay in the usual way. That is still Tor and still private, but you are no longer inside the onion.
DuckDuckGo’s bangs work the same way. Type !w followed by a word, and DuckDuckGo takes you straight to that search on another site, Wikipedia in this case. It’s useful, but it also means your query goes to that other site, outside the onion.
If the website you’re heading to has its own onion, use it. A number of the services in our directory do, from news sites to secure email providers such as Proton Mail and Riseup, and the open-source projects behind Debian, Qubes, Whonix and OnionShare.
Don’t sign in, and start fresh#
Neither engine needs an account to search. Preferences such as region or language are usually stored in cookies, which Tor Browser deletes when you close it or choose New Identity. That is a feature, not a nuisance. Don’t sign up for anything just to keep your preferences, because an account links every search back to you, however you connect.
Watch for lookalike search onions#
Because search is such a common first step, fake search onions are an obvious trap. A clone might show genuine results while recording every query, or slip in links to phishing sites. The first few characters of an address are easy to imitate, which is exactly what DuckDuckGo’s own address shows. It begins with the name because DuckDuckGo generated it that way, and anyone else could generate an address that starts the same. Before you trust one, compare all 56 characters with our table or with the company’s own website. Our guides How to Verify an Onion Address Is Official and Onion Phishing: How Fake Mirrors Clone Real Addresses explain how. The same goes for apps, as we explain in Fake ‘Dark Web’ Apps in 2026.
Why we don’t list “dark web search engines”#
Search for onion sites and you’ll soon come across tools that call themselves dark web search engines. They claim to index the onion network the way Google indexes the regular web. DuckDuckGo and Brave aren’t like that. Their onions give you private access to ordinary web search. Since they don’t set out to catalogue onion sites, searching them for onion addresses usually just brings up clearnet pages that talk about those sites.
We’ve made a deliberate choice here too. We don’t include any third-party onion search tools in our directory, for reasons that come straight from how they work.
They can’t vouch for what they index. A crawler that follows every onion link it finds will index scams, phishing clones and markets alongside genuine sites, with no way to tell them apart. To a machine, a clone of a real service looks just as valid as the real one.
Ranking is easy to game. Without the kind of reputation system the regular web has built up over decades, results are easy to push around. Paid placement and spam are common, and the sites that pay to be seen are rarely the ones you want.
Many have no accountable owner. DuckDuckGo and Brave are companies with public websites, privacy policies and an onion address they confirm on their own domains. Most onion search tools are anonymous, with no proof page and no way of checking that the version you’ve found is the original rather than a copy.
Some are traps themselves. A search tool is the ideal place to record what people are looking for, or to send them to a fake version of whatever they searched for. The cloning technique that works on any onion address works on a search engine’s too.
None of that is a reason to fear onion sites in general. It’s a reason to start from sources you can verify. For official sites, that means each organisation’s own proof page, or a directory like ours that shows the proof for every entry. We explain how link lists and directories go wrong in Why Most ‘Hidden Wiki’ Lists Are Full of Scams, and how we decide what goes on our list in About thehidden.wiki.
If you’re unsure whether using Tor or visiting onion sites is legal where you are, see Is Tor Legal? Using Onion Services Responsibly.
Where to go next#
- Want every verified onion in one place? See the Official Onion Mirrors Directory, including the Tor Project’s own official onion sites.
- Need private email to go with private search? Read Secure Email Over Tor: Proton Mail and Riseup Onions.
- Reading the news over Tor? See News Onion Sites: BBC, DW, The Guardian and SecureDrop.
- Want to know why an onion address can prove itself? Read What Is an Onion Service? .onion Addresses Explained.
- Is Tor blocked where you are? Our guide to bridges, Snowflake and WebTunnel will help you connect.
- Need more protection than a browser can give? Read about Tails 7.14, which routes your whole computer through Tor.
Sources#
- Why is DuckDuckGo the default search engine in Tor Browser?, Tor Project support, read October 13, 2026
- Update: new onion addresses for Brave website and Brave Search, Brave Community
- Brave.com now has its own Tor Onion Service, Brave blog
- DuckDuckGo AI Features, DuckDuckGo Help Pages
- DuckDuckGo leans further into GenAI as its AI chat interface exits beta, TechCrunch, March 6, 2025
- Real-World Onion Sites, daily status checks to October 11, 2026
3 comments