August 13, 2026
Updated: November 2, 2026
Torch is one of the oldest onion search engines, but its billion-page claim collapses against Tor Metrics. What it indexes, what it misses, and where it fits.
Abdalla Mohamed
The Torch search engine is one of the oldest keyword search engines running on the Tor network, and it does one thing that no clearnet engine does: it crawls .onion services and makes them findable by keyword. It applies no moderation, says it keeps no query logs, and verifies nothing it lists. That combination makes it genuinely useful for research and genuinely risky for casual browsing. This guide covers what Torch indexes, what it quietly misses, and where it belongs in a security team's workflow.
Torch, sometimes styled TORCH or TorSearch, is a search engine that indexes Tor onion services and returns them for keyword queries. It runs as an onion service itself, which means it is reachable only through Tor Browser and not through Chrome, Safari, or Firefox on the normal internet. Functionally it behaves like a stripped-down Google for the dark web: you type a term, you get a list of .onion results with short snippets.
Security vendors such as SOCRadar describe it as operating since the early 2010s, which makes it one of the longest-running services of its kind. Third-party guides put its launch anywhere from 2012 to 2014, and its anonymous operators have never published a verifiable founding date. The 1996 launch year repeated on some sites is impossible: onion routing research only began at the US Naval Research Lab in 1995, the Tor network was first deployed in October 2002, and hidden services were introduced in the 2004 Tor design. That longevity is still the single most useful thing about Torch. Onion services churn constantly, and an engine that has been crawling for over a decade accumulates routes to content that newer crawlers never saw, including mirrors and defunct sites that still carry investigative value.
The reason a separate engine has to exist at all comes down to how onion services are addressed and routed. Understanding this is what separates a useful mental model from the usual dark web hand-waving, and it explains the limits of Torch's index better than any feature list.
Google finds pages by following links from pages it already knows. Onion services largely break that chain. An .onion address is a cryptographic identifier derived from the service's public key, not a human-chosen name registered in DNS, so there is no registrar list to enumerate and no zone file to walk. Most onion services are never linked from any clearnet page. If nobody publishes the address somewhere a crawler can see it, the service is effectively invisible, no matter how long it has been online. This is the same structural distinction that separates the deep web from the dark web, and it is why a dedicated crawler is necessary rather than merely convenient.
Traffic to an onion service never leaves the Tor network. There is no exit node in the path. Instead, the client and the server meet at a rendezvous point inside the network, which is precisely how onion services work and why the server's physical location stays hidden. For a crawler this means there is no network vantage point from which you can observe onion traffic and harvest addresses in bulk. Torch has to be told where to look, the same as everyone else, by finding addresses published on pages it has already indexed.
In practice Torch grows its index the way any crawler does: it starts from a seed list, fetches those pages, extracts every .onion link it finds, and queues them. Directories, forums, and link lists are therefore the backbone of its coverage, starting with well-known directories like the Hidden Wiki. The consequence is a systematic bias. Well-linked services with an interest in being found get indexed thoroughly. Services that deliberately avoid publicity, which includes most of what an investigator would actually want to see, stay outside the index entirely.
Almost every page that ranks for this term repeats the same statistic: Torch indexes over a billion pages. A few sources say one million instead, and nobody appears to notice the thousand-fold discrepancy or ask where either number came from. The figures that can actually be traced are far smaller and all self-reported: Avira's June 2026 review cites Torch's own count of over 100,000 onion sites and over 4 million pages, and notes that a second engine using the Torch name claims about 860,000 pages. The only billion-scale figure we could trace to an operator is Haystak's self-reported 1.5 billion pages. None of these numbers has been independently verified.
Run it against the size of the network. The Tor Project publishes onion service statistics derived from relays acting as hidden service directories. Over the 12 months to October 2026, the estimated number of unique v3 onion addresses seen per day ranged from roughly 520,000 to 1.3 million, with a median of about 640,000 in October 2026. The older v2 addresses were retired in 2021, so v3 is the whole picture. Not billions. The Tor Project's first published measurement of onion services in 2015 put the figure at about 30,000 services announcing themselves each day. That is the entire addressable universe of onion services, indexed and unindexed, active and abandoned, and it includes every duplicate mirror and every short-lived test service.
A billion indexed pages against well under 1.5 million addresses would mean more than a thousand distinct pages per service on average, across a network where a large share of addresses are single-page landers, dead, or mostly inactive. The number is not impossible if you count aggressively at the page level and never expire dead results, but it is not the measure of coverage that readers assume it is. Treat it as a claim about crawl volume, not about how much of the dark web you can actually see.
This matters practically rather than pedantically. If you brief an executive that a free search engine covers a billion dark web pages, you have implied a completeness that does not exist, and the next question, "so are we in there or not," gets an answer that sounds far more authoritative than the evidence supports. It belongs alongside the other dark web myths that survive because they are repeated rather than checked.
The gap between what people assume Torch provides and what it actually provides causes more bad conclusions than any technical limitation. Four things are worth stating plainly.
Torch is one of several engines, and the differences between them are about editorial policy far more than technology. The practical split is between engines that filter and engines that do not.
Ahmia is the main alternative and takes the opposite position: it actively excludes child sexual abuse material, publishes its blocklist, and has been associated with the Tor Project since its 2014 Google Summer of Code project, which gives it a legitimacy the unfiltered engines cannot claim. That makes Ahmia the sensible default for anyone who needs to demonstrate to a compliance function that their research was conducted responsibly. Torch's appeal is the mirror image, since an unfiltered index surfaces emerging infrastructure, scam clusters, and mirror networks that a moderated engine deliberately removes.
The others fill narrower roles. DuckDuckGo's onion service searches the clearnet privately rather than indexing .onion sites, which is a distinction people routinely get wrong. Haystak claims a larger index (a self-reported 1.5 billion pages and over 260,000 onion sites, including historical ones), excludes child abuse and human trafficking content, and sells advanced search and alerting behind a paid tier, though Avira reported in June 2026 that its free search did not appear to be working. OnionLand and the various not Evil clones sit closer to Torch in policy and well behind it in reliability. We cover the full field in our breakdown of dark web search engines compared.
| Engine | Indexes | Moderation | Best used for |
|---|---|---|---|
| Torch | .onion services | None | Unfiltered discovery, mapping mirror and scam infrastructure |
| Ahmia | .onion services | Excludes child sexual abuse material | Documented professional research with a defensible audit trail |
| Haystak | .onion services | Limited (excludes child abuse and trafficking content) | Broader historical coverage, with the useful depth behind a paid tier; free search unreliable in 2026 tests |
| DuckDuckGo onion | Clearnet only | Standard | Private clearnet search, not dark web discovery |
| OnionLand / not Evil | .onion services | None | Cross-checking a Torch result against a second unfiltered index |
Two habits are worth building. Run any significant query through both a filtered and an unfiltered engine, because the difference between the two result sets is itself informative and often tells you more than either list alone. And record which engine produced which result, since six months later the provenance of a finding matters considerably more than the finding did at the time.
The honest summary is that no onion search engine is comprehensive, and running two with opposite filtering policies tells you more than running either alone.
These get asked together and deserve separate answers, because one is simple and one is not.
Torch is a search engine. Using it is not a crime in the United States, the United Kingdom, or the EU, in the same way that using Dark Web Browser is not a crime. What you do with the results determines legality. Accessing, downloading, or transacting with illegal content and services is illegal whether you arrived there through Torch, a link list, or a direct address, and the anonymity of the network does not change the law or, increasingly, the practical odds. Investigators have well-developed methods for attributing dark web activity, which we cover in how law enforcement tracks dark web criminals.
If you are doing this as part of a job, the constraint that binds first is usually organizational rather than legal. Most enterprises require dark web research to run from an isolated environment under a documented authorization, and doing it from a corporate laptop on a whim is a policy violation long before it is anything else.
Unfiltered results mean you can land on genuinely harmful content with no warning from a single ambiguous query. That is the obvious risk. The less obvious and more common one is impersonation. Torch's address has changed at least once, when Tor retired v2 addresses in 2021, and more than one engine now runs under the Torch name; Avira notes it is difficult to say which is the original and which is a successor or a mimic. Cloned onion sites are a long-documented problem: in 2015 Ahmia's founder published a list of hundreds of fake mirrors set up to impersonate real services, as Business Insider reported. Clones like these exist to harvest credentials, serve malware, and redirect users to services that pay for traffic, and SOCRadar also flags the advertising on Torch's results pages as a phishing and malware risk. A researcher who arrives at a convincing fake and trusts its results is being fed a curated view by whoever runs it.
Torch also says it keeps no logs and runs no analytics. Even taken at face value, and no one has independently audited it, that is a privacy property and not a security one. No logging protects you from Torch. It does nothing about a malicious mirror, a compromised endpoint, or a service that fingerprints your browser configuration. If you want the fuller picture of what the network does and does not protect, see how anonymous the dark web really is.
A significant share of people searching for Torch want the address, so it is worth explaining the omission rather than leaving it conspicuous.
The address has changed before, several engines use the Torch name, and convincing phishing clones are common. An address published in an evergreen guide keeps getting served to readers long after it rotates, and at that point the page is no longer providing a reference. It is providing a link to whoever now occupies that string. Every guide that hardcodes an onion address is one rotation away from routing its readers somewhere hostile, and most of them will never notice.
There is a second reason worth being direct about. We test systems for a living, and publishing a live entry point to an unmoderated index does nothing for that work while creating real brand and search-quality exposure. Researchers with a legitimate need should confirm any address against more than one maintained source, such as Ahmia's index, rather than trusting a static guide. The Tor Project does not maintain or endorse an address for Torch.
This is the part almost nobody writes about, because most content on Torch is aimed at curious readers rather than practitioners. Used deliberately, Torch has a narrow but real role.
That role stays narrow because what is discoverable about your organization keeps changing: services get exposed, credentials leak, and new paths open between one search and the next. A continuous penetration testing program re-checks the external attack surface and the leaked-credential routes an attacker would try, which a one-off Torch query cannot do.
Torch's lack of moderation is an advantage when you are trying to see structure rather than find a specific document. Scam clusters, mirror networks, and rapidly replicated phishing infrastructure often surface in an unfiltered index before curated sources catch up, because curation lags by design. If you are mapping how a particular brand is being impersonated across onion services, a raw index shows you the shape of the thing. Treat every result as a lead requiring independent confirmation, never as a finding.
After a breach or a credential dump, teams frequently want to know whether their data has surfaced. Torch can occasionally confirm that something is publicly discoverable, and a positive result is meaningful. A negative result is close to worthless, because the absence of a hit tells you only that the term is not in this particular index today. Data that has been sold privately, posted to a vetted forum, or listed on a site that Torch never crawled produces exactly the same empty page as data that was never stolen. For context on what surfaces and what it goes for, our analysis of what stolen data actually sells for is a better starting point than a search box.
There is a straightforward educational case. Analysts who have looked at how leak sites are structured, how listings are worded, and how quickly infrastructure moves make better decisions than analysts working from headlines. Set against the scale of activity documented in our review of daily dark web activity, an afternoon of supervised exploration in an isolated environment is reasonable professional development. It is not a monitoring program.
The structural problem with using Torch as a monitoring approach is that it is a pull model against a target that changes constantly. You have to remember to look, know what to look for, and be looking on the day the data appears. Listings get taken down, forums rotate addresses, and the window between something appearing and disappearing is frequently shorter than the interval between manual checks.
The index bias compounds it. Torch covers what is well linked, and the material that matters most to a defender, meaning credential dumps traded privately and pre-publication ransomware listings, is systematically the least linked. You are searching hardest in the region where coverage is weakest, and the search returns nothing, and nothing feels like reassurance.
This is the case for tooling rather than habit. Continuous collection across multiple sources, including sources no public engine indexes, is what dark web monitoring tools exist to do. Torch is a useful instrument for a specific investigative question. It is not a control, and it should never appear in a risk register as one.
Torch is a search engine that crawls and indexes Tor onion services, making .onion sites findable by keyword. It runs as an onion service itself and requires Tor Browser to reach. It applies no content filtering and says it keeps no query logs.
Yes. Torch is a search engine, and using one is legal in the United States, the United Kingdom, and the EU. Legality depends entirely on what you do with the results. Accessing or transacting with illegal content and services remains illegal regardless of how you found it.
Not for casual use. Results are unfiltered, so harmful content can appear without warning, and phishing clones of Torch are widespread. Security researchers who use it work from isolated environments under documented authorization rather than from everyday machines.
As of November 2026 there is no report of Torch being seized or shut down, and security vendors such as Avira (June 2026) still list it as operating. Its address has changed before, and more than one engine uses the Torch name, so obtain any address from a maintained source such as Ahmia rather than from a static guide, and expect impersonators.
Ahmia filters child sexual abuse material and has been associated with the Tor Project since its 2014 Google Summer of Code project. Torch applies no moderation. Ahmia is the safer default for documented professional research; Torch surfaces unfiltered infrastructure that moderated engines deliberately exclude.
Torch states that it keeps no query logs and runs no analytics. That protects you from Torch specifically. It offers no protection against a phishing clone, a compromised endpoint, or a service that fingerprints your browser.
Sometimes, and a positive result is meaningful. A negative result is not. Torch only covers publicly linked services, while most stolen data is traded privately or posted to forums it never crawls, so an empty search says very little about your actual exposure.
Onion addresses rotate for operational and security reasons, and services move when infrastructure is seized or compromised. This churn is why hardcoded addresses in guides go stale and why clones are so effective at capturing traffic from outdated links.
Torch is worth understanding and worth using occasionally, with a clear head about what it is: an unmoderated, unverified, structurally incomplete index of the publicly linked portion of the Tor network. It answers "is this discoverable" and it does not answer "are we exposed." The billion-page figure is marketing, not measurement, and the coverage gap it obscures falls exactly where a defender's interest lies.
Most organizations discover their real exposure well before anything reaches an onion index, in an unpatched service, a reused credential, or an access path nobody mapped. That is the work our team does. If you want to know what an attacker would find in your environment before it turns into a listing someone else searches for, our US penetration testing services start with a manual assessment by testers who operate the way real threat actors do.
To see what your external exposure looks like right now, contact DeepStrike's testers.
Stay secure with DeepStrike penetration testing services. Reach out for a quote or customized technical proposal today
Contact Us
