Not Evil: A Deep Web Search Engine for Onion Sites

Not Evil operates as a Tor-native search engine, meaning it runs on the Tor network itself and indexes only .onion sites. You access it by visiting its onion address through Tor Browser, not through a regular search engine like Google. The engine crawls publicly available onion services and builds an index of pages, much like Google does for the surface web, but the scope is vastly smaller and the results are limited to what the crawler can reach.

The key difference is that Not Evil cannot index sites behind authentication walls, paywalls or those that explicitly block crawlers. It also cannot index sites that require JavaScript execution or those hosted on private networks. This means many legitimate deep web resources, including forums and marketplaces that require login, will not appear in Not Evil results. The search results tend to be noisier than surface web searches because the onion ecosystem includes many abandoned sites, mirrors and duplicates.

Not Evil was created as an open-source project to provide a decentralized search option for Tor users. Unlike centralized search engines, it was designed to be run by volunteers and to respect user privacy by not logging searches or tracking behavior. The project has gone through periods of being online and offline, depending on volunteer maintenance and hosting availability.

The last documented active version indexed a subset of onion sites and was accessible through its .onion address. However, the status of Not Evil changes over time. Some mirrors and forks have been maintained by the community, but the original project's current state should be verified through the Tor Project's resources or community forums rather than assumed. If you find a Not Evil address, verify it through PGP-signed announcements or trusted community sources to avoid phishing clones that mimic the interface.

Using Not Evil requires Tor Browser and basic operational security practices. Here is the process:

1. Download and install Tor Browser from the official Tor Project website.
2. Open Tor Browser and wait for it to connect to the Tor network.
3. Visit the Not Evil onion address (verify this address through trusted sources before visiting).
4. Enter your search query into the search box.
5. Review results carefully, checking the .onion domain and page title before clicking.
6. Avoid clicking on results that seem suspicious or that redirect to unexpected pages.

Do not assume that appearing in Not Evil results means a site is safe or legitimate. The search engine indexes content but does not vet it. Many results may lead to phishing clones, malware or scams. Always verify the exact .onion address against known good sources before entering credentials or sensitive information. Use the best browser for deep web access, which is Tor Browser itself, rather than modified versions or third-party tools.

Not Evil has real constraints that affect its usefulness. It cannot index the full onion ecosystem because many sites block automated crawlers, require authentication or use obfuscation techniques. This means you will miss a large portion of active onion services if you rely solely on Not Evil for discovery.

The search results also tend to include dead links, outdated mirrors and duplicate content from the same site hosted on multiple addresses. Relevance ranking is basic compared to surface web search engines, so you may need to sift through many results to find what you are looking for. For these reasons, experienced users combine Not Evil with other methods: community recommendations from verified forums, directory listings maintained by trusted sources, and direct onion addresses shared through secure channels. The best deep web search strategy involves multiple tools and verification steps rather than trusting any single engine.

Tor Project documentation describes onion services as hidden by design, meaning they do not advertise their addresses on the surface web and are not indexed by conventional search engines. This creates a fundamental tension for search engines like Not Evil: they must crawl onion sites to index them, but many site operators deliberately prevent crawling to maintain privacy or control access. Security-vendor incident reports on onion service phishing show that clones of popular search engines are common, with attackers creating fake Not Evil mirrors to harvest search queries or inject malicious results.

Law-enforcement actions against darknet markets have revealed that search engines and directories were often used by investigators to map the ecosystem and identify targets. This matters to ordinary users because it means that using a search engine leaves traces in server logs, even on Tor. Additionally, many onion sites that appear in search results are honeypots, law-enforcement monitoring operations or scams designed to compromise users. The lesson is that search engine results are a starting point for discovery, not a guarantee of legitimacy or safety. Verification through multiple independent sources is essential before trusting any onion address.

Several alternatives exist for searching the onion ecosystem, each with different trade-offs. Torch is another Tor search engine that has been online longer and indexes a larger portion of onion sites, though it too has limitations and has faced downtime. Ahmia is a clearnet search engine that indexes onion sites and can be accessed through Tor, offering a different interface and result ranking. DuckDuckGo, while primarily a surface web search engine, can be accessed through Tor and includes some onion results if you search for them explicitly.

None of these tools are comprehensive or perfect. Torch tends to return more results but with lower relevance. Ahmia is more curated but indexes fewer sites. DuckDuckGo is convenient but not designed for onion search. The best approach depends on what you are looking for: if you need broad discovery, use multiple engines and cross-reference results. If you need specific resources like security tools or privacy guides, community forums and verified directory listings are often more reliable than search engines.

Phishing clones of Not Evil and other onion search engines are common because the interface is simple to replicate. An attacker can create a fake search engine that looks identical but logs your queries or injects malicious results. To avoid this, verify the onion address through multiple trusted sources before using any search engine.

Check the Tor Project's official resources, security-focused community forums and PGP-signed announcements from the project maintainers. If you find an address on Reddit or a forum, cross-reference it with at least one other independent source. Pay attention to the exact .onion address in your browser's address bar, not just the page title. Legitimate projects often publish their addresses with PGP signatures so you can verify authenticity. If a search engine result seems suspicious or redirects unexpectedly, stop and verify the address again. This extra step takes seconds and prevents credential theft or malware infection.

Not Evil and similar search engines are tools for discovery, not solutions for finding everything on the deep web. The most effective approach combines search engines with other methods: joining verified communities where users share recommendations, using directory listings maintained by trusted sources, and following security-focused projects that publish their onion addresses through official channels.

If you are looking for specific resources like privacy tools, security guides or news sites, start with a search but verify results through multiple channels before trusting them. If you are exploring the onion ecosystem out of curiosity, understand that many sites are abandoned, compromised or intentionally deceptive. Set clear boundaries for what you will access and why. Use Tor Browser as your only tool for onion access, keep it updated, and maintain basic operational security practices like using a dedicated device or virtual machine for sensitive activity. The deep web is not inherently dangerous, but careless search and verification practices create real risks.