Every fake app has a business model#
Search any app store for “dark web” and you’ll see a screen full of onion icons. The names all follow a pattern, some mix of dark web, deep web, onion, Tor, hidden and private. Many of them have thousands of downloads and plenty of five-star reviews. Yet almost none of them come from the Tor Project.
The standard advice is to steer clear of them, and that’s correct. But it doesn’t explain why there are so many of them, or how to spot a new one that looks better than the last. The answer to both questions is the same. Nobody publishes a fake privacy app just for the sake of it. Each one exists because it earns money for whoever made it, and the way it earns money shapes everything about it, from the permissions it asks for to the wording of its description.
Once you’ve learned the handful of business models these apps use, a store listing starts to read like a confession. The app that shows adverts everywhere is selling your attention. The one with a weekly subscription is selling you something that’s free elsewhere. The one that wants your contacts is selling you. And the most dangerous ones aren’t in the app stores at all, but on download sites, where a fake installer can quietly steal your cryptocurrency.
This guide walks through those business models, shows how to read a listing the way an investigator would, and ends with the short list of genuine apps. As a rule of thumb, there’s only one genuine Tor Browser, made by the Tor Project, and it never asks you to pay, subscribe or unlock anything. As the Tor Project’s own support pages put it, any browser that forces you to pay and claims to be Tor Browser is fake.
The five business models#
Almost every fake or unofficial “dark web” app fits one of five models. Some combine two or three.
| Model | How it makes money | What usually gives it away |
|---|---|---|
| The ad wrapper | Shows adverts around a basic browser | “Contains ads” label, full-screen ads, a browser that isn’t Tor Browser |
| The paywall | Charges for something that’s free | A free trial that turns into a weekly or yearly subscription, “premium” or “unlock” buttons |
| The data collector | Sells or uses what it learns about you | Permissions it doesn’t need, such as contacts, location or your accounts |
| The link trap | Sends you to phishing sites | Built-in lists of “dark web links”, “hidden wiki” pages or “featured sites” |
| The trojan installer | Steals money or data directly | Downloaded from anywhere other than the Tor Project, often as a password-protected archive |
The ad wrapper#
This is the most common type and, in a way, the least harmful. It’s a standard web browser, sometimes with Tor included and sometimes without, surrounded by adverts. Since it isn’t Tor Browser, it lacks Tor Browser’s protections against tracking and fingerprinting, and the ads themselves come from ad networks that can track you.
This model is older than most people realise. Back in 2013, a third-party app called “Tor Browser” appeared in Apple’s App Store. The Tor Project’s bug tracker described it as a fake full of adware and spyware, and the project complained to Apple that December. In March 2014 it was still available, and Tor developers made the complaint public. A security company that analysed it found it used the Tor network and contained ads, but didn’t find spyware. That nuance is worth keeping. The problem with an ad wrapper isn’t always that it’s malware. It’s that it pretends to be something it isn’t, and you can’t easily find out what else it does.
The paywall#
Tor Browser is free and open source. So are Orbot and Onion Browser, and so is the Tor Project’s own Android VPN. Any app that charges for “dark web access”, sells a “premium” version, or quietly turns a free trial into a weekly subscription is charging you for something you can get for nothing. The Tor Project’s support team has received enough questions from people asked to pay or “donate” inside apps calling themselves Tor Browser that it planned a dedicated support answer about it. If you’ve already paid, the Tor Project suggests asking Apple or Google for a refund, or contacting your bank to report the charge.
The data collector#
A browser needs very little from your phone. It doesn’t need your contacts, your precise location, your call log or access to your accounts. An app that asks for these is collecting data, either to sell it or to sharpen its advertising. For an app sold as private, that’s exactly backwards. It can’t make you anonymous to websites while sending your contacts to an analytics company.
The link trap#
Some apps come pre-loaded with lists of onion sites. These lists are often called “hidden wiki”, “featured” or “popular” links. This is the most dangerous kind of app for everyday users, because those lists are exactly where phishing clones live. An app that hands you a lookalike address for a genuine service has already done the hardest part of the scam for the scammer. We explain how these clones work in Onion Phishing: How Fake Mirrors Clone Real Addresses, and why such lists can’t be trusted in Why Most ‘Hidden Wiki’ Lists Are Full of Scams.
The trojan installer#
The last model usually isn’t in an app store at all, which is why it gets its own section below. It’s a genuine Tor Browser with an extra component hidden inside, and it’s designed to steal.
Reading a store listing like an investigator#
You don’t need to install an app to find out most of what it’s up to. App store listings contain a surprising number of clues, if you know where to look. Work through these in order, and nearly all the fakes give themselves away within the first three.
- Who made it? Check the developer name directly below the app title. Tor Browser for Android and Tor VPN are published by The Tor Project. Orbot and Onion Browser come from the Guardian Project team. Any other app using Tor’s name or the onion logo isn’t one of theirs. Tap the developer’s name too. A developer that also publishes flashlights, PDF readers, “free VPNs” and phone cleaners is running an app factory, not a privacy project.
- What does the store say about money? Google Play shows small labels under the title, such as “Contains ads” and “In-app purchases”. The genuine Tor apps show neither. On Apple’s App Store, in-app purchases are listed on the listing page. A free trial that turns into a subscription is a clear giveaway.
- What data does it collect? Google Play has a Data safety section and Apple has an App Privacy section, sometimes called the privacy label. Both list what data the app collects and whether it’s shared with others. A genuine privacy tool should collect very little. An app that collects your location, contacts or identifiers and links them to you is not a privacy tool, whatever it claims.
- What permissions does it ask for? A browser needs network access and not much else. Contacts, call logs, SMS, precise location or accessibility access are all red flags.
- On Android, what’s its ID? Every Android app has a unique package name in its Google Play web address. Tor Browser’s is org.torproject.torbrowser, and Orbot’s is org.torproject.android. A fake can copy a name and an icon, but not the ID.
- How does it talk about itself? Genuine privacy projects are careful with their wording. Fakes promise to “unlock” the dark web, offer “100% anonymity”, advertise a built-in “hidden wiki” or “deep web links”, or show screenshots full of site lists and cryptocurrency. Real tools don’t do any of that.
- Is it kept up to date? Tor Browser follows Firefox’s security releases closely. The current version, 15.0.24, was released on September 29, 2026, as we cover in our release notes. An app that hasn’t been updated in months is running old code with known security holes, even if it’s honest.
- What do the worst reviews say? Ratings and download counts can be bought, and fake apps often have more of both than genuine ones. Skip the five-star reviews and read the one-star ones. Complaints about surprise charges, endless adverts or the app failing to connect tell you far more.
A special note on iPhone#
There is no Tor Browser for iPhone or iPad. Apple requires every iOS browser to use its WebKit engine, and Tor Browser’s protections can’t be rebuilt on top of it. So any App Store listing called “Tor Browser” is, by definition, not from the Tor Project. The browser the Tor Project recommends for iOS is Onion Browser, used together with Orbot. Our guide to Using Tor on Android and iPhone explains both, and covers plans for a full Tor Browser for iOS.
The safest shortcut#
All of that helps when you’re judging an app you’ve come across. But the easiest way to avoid fakes is never to search the store at all. Go to the project’s own website and follow its link to the store. For Tor Browser and Tor VPN, that’s download.torproject.org. The link takes you to the right listing every time, and skips every lookalike in the search results.
Fake installers outside the app stores#
App stores at least have some rules. Download sites, file-sharing links, torrents and “helpful” videos have none. That’s where the most harmful fakes are found, and they look nothing like the ad-stuffed apps above. They look exactly like Tor Browser, because they are Tor Browser, with something added.
The 2023 clipper campaign#
In March 2023, Kaspersky researchers described a campaign built around trojanised Tor Browser installers. Victims downloaded what they thought was Tor Browser from a third-party website, usually as a password-protected archive. When they ran it, the real Tor Browser was installed and started, so nothing seemed wrong. In the background, a small program called a clipper was installed too.
A clipper watches your clipboard, the place where text sits when you copy and paste. Most of the time it does nothing at all, which is what makes it so hard to notice. But when you copy a cryptocurrency wallet address to make a payment, it swaps that address for one belonging to the attacker. You paste what you think is the right address, send the money, and it’s gone. Kaspersky counted more than 15,000 attacks across 52 countries, covering Bitcoin, Ethereum, Litecoin, Dogecoin and Monero, and estimated losses of at least $400,000, warning that the real figure was probably higher.
Two details from that case matter most.
- Most victims couldn’t reach the real site. Most detections were in Russia, where the Tor Project’s website has been blocked. In 2022, Russia’s regulator also demanded that Google remove Tor Browser from Google Play in the country. When the official source is blocked, people look elsewhere, and that’s exactly where the trojans were waiting.
- The official installers were clean. As reported at the time, the installers from the Tor Project were digitally signed and showed no trace of the malware. Every victim had got their copy from somewhere else.
Other places fakes hide#
- “Portable” and “pre-configured” builds. Versions shared on forums or file-sharing sites, “set up for you” with extensions or settings changed. Even when the changes aren’t malicious, they make you stand out from other Tor users.
- Software download portals. Large freeware sites sometimes wrap Tor Browser in their own installer with extra “offers”, and their copies are often out of date.
- Video and social media links. Clickbait videos about the dark web often put a download link in the description. It rarely points to the Tor Project.
- Messages telling you to ignore warnings. Since September 2026, Windows users installing the latest Tor Browser from scratch may see a “bad signature” warning, because the Tor Project’s Windows code-signing certificate expired and its renewal has been delayed. The warning on the genuine file is harmless, but a scammer could use the same story to talk you past a warning on a fake. Our Tor Browser 15.0.24 release notes explain the situation, and the cure is to check the PGP signature yourself.
The fix#
Get Tor Browser only from the Tor Project. That means download.torproject.org, its official mirrors, or its GetTor service if the site is blocked where you are. Then check the signature, which takes about five minutes the first time. Our guide How to Download and Install Tor Browser Safely walks through every step, including the mirrors and GetTor. If Tor itself is blocked once it’s installed, see Bridges, Snowflake and WebTunnel.
The genuine apps, for comparison#
After all those fakes, the real list is reassuringly short. These are the apps the Tor Project makes or recommends, as of October 2026. All of them are free, none of them show ads, and none of them need your contacts or location.
| App | Platform | Made by | Where to get it |
|---|---|---|---|
| Tor Browser | Windows, macOS, Linux | The Tor Project | download.torproject.org, official mirrors, or GetTor |
| Tor Browser for Android | Android | The Tor Project | Google Play, or the APK from download.torproject.org |
| Tor VPN (beta) | Android | The Tor Project | Google Play, F-Droid, or the APK from download.torproject.org |
| Orbot | Android and iOS | Guardian Project | Google Play or the App Store |
| Onion Browser | iPhone and iPad | Guardian Project | App Store |
A few notes on that list.
- Tor Browser for Android is the real thing. It’s the same browser as the desktop version, with the same security levels, released at the same time.
- Tor VPN is the Tor Project’s own device-wide app. It sends the apps you choose through Tor, each on its own circuit. It’s still in beta, and we cover it in our Tor VPN beta overview.
- Orbot and Onion Browser come from a long-standing partner. The Guardian Project team has worked with Tor on mobile for more than a decade, and the Tor Project recommends both apps for iPhone.
For a fuller explanation of which app to use for what, and the phone-specific leaks to watch out for, see Using Tor on Android and iPhone: The Legitimate Apps.
What about “dark web monitoring”?#
You may also come across apps and services offering “dark web monitoring” or “dark web scans”. These are a different thing entirely. Legitimate ones are breach-alert services that watch for your email address or passwords appearing in leaked data, and some password managers and identity-protection services include them. They don’t let you browse onion sites, and they’re not a substitute for Tor Browser. Judge them by who runs them, as you would any other service, and be wary of any “scan” that asks for your passwords in order to check them.
If you’ve already installed one#
Lots of people have, so there’s no need to feel bad. What matters is cleaning up properly, and in the right order.
On a phone#
- Remove any special permissions first. On Android, check in your settings whether the app has been given accessibility access or device administrator rights, and turn those off before uninstalling. Some apps use them to make themselves harder to remove.
- Uninstall the app. On iPhone, deleting it is enough. On Android, uninstall it from your app settings.
- Cancel any subscription separately. Deleting an app doesn’t cancel its subscription. On iPhone, open Settings and check the Subscriptions section under your Apple account. On Android, check Payments and subscriptions in the Google Play app.
- Ask for your money back. The Tor Project can’t refund purchases made to another company, but it suggests requesting a refund from Apple or Google, or contacting your bank to report a fraudulent charge.
- Change any passwords you typed into it. If you logged in to anything through the fake app, change those passwords from a device and browser you trust, and turn on two-factor authentication where you can.
- Treat any onion sites it suggested as clones. If the app came with a list of links and you used them, assume those addresses were fakes. Check the real ones as described in How to Verify an Onion Address Is Official, or use our Official Onion Mirrors Directory.
- Install the genuine app from the list above, following the link from the project’s own website.
On a computer#
If you installed Tor Browser from anywhere other than the Tor Project, the stakes are higher, because a trojanised installer can run with full access to your system.
- Stop using cryptocurrency on that computer. If you hold any, move it to a new wallet set up on a device you know is clean. In the meantime, don’t copy and paste wallet addresses on the suspect computer.
- Treat the computer as compromised. An antivirus scan may find a known clipper, but the safest course is to back up your personal files and reinstall the operating system from a trusted source. If you can’t do that straight away, consider using Tails from a USB stick for anything sensitive. See Tails 7.14.
- Change your important passwords from a clean device, starting with email and anything financial.
- Install the real Tor Browser from download.torproject.org and check its signature, as described in How to Download and Install Tor Browser Safely.
Report it#
Reporting a fake helps the next person. Use the report option on the app’s store listing. The Tor Project’s support pages also invite reports of fake Tor Browsers by email at [email protected]. And if a fake app or installer sent you to a clone of a service in our directory, tell us so we can warn other readers.
Where to go next#
- Setting Tor up on a phone? Read Using Tor on Android and iPhone: The Legitimate Apps.
- Installing on a computer? Follow How to Download and Install Tor Browser Safely.
- Want to see how the clones that fake apps link to work? Read Onion Phishing: How Fake Mirrors Clone Real Addresses.
- Want addresses you can trust? Start with the Official Onion Mirrors Directory, including the Tor Project’s own official onion sites.
- Choosing a security level once you have the real browser? See Tor Browser Security Levels: Standard vs Safer vs Safest.
- Not sure whether using Tor is legal where you are? Read Is Tor Legal? Using Onion Services Responsibly.
- New here? Find out how we choose what to list in About thehidden.wiki.
Sources#
- Is there a fake Tor Browser?, Tor Project support, including refund and reporting advice
- Add a new question about fake Tor Browsers in App Store and malicious websites, Tor Project issue tracker
- New clipper malware steals US$400,000 in cryptocurrencies via fake Tor Browser, Kaspersky, March 2023
- Clipper attacks use Trojanized TOR Browser installers, Security Affairs, March 2023
- Fake Tor app has been sitting in Apple’s App Store for months, Tor Project says, PCWorld, March 2014
- Tor Browser in Apple’s App Store still packed with spyware and adware, Bitdefender, 2014, including its update finding ads but no spyware
- Tor Browser vs. Dark Web App: What Really Happened in 2026, PC Tech Magazine, August 2026
- App privacy labels, Apple, and Data safety section, Google Play Help
- New Release: Tor Browser 15.0.24, Tor Project blog, September 29, 2026
5 comments