How NotEvil Onion Works: Dark Web Search Explained

NotEvil is a search engine designed to index .onion addresses, the hidden services that operate on the Tor network. Unlike Google or DuckDuckGo on the surface web, NotEvil crawls onion sites and builds an index that users can query through a web interface accessible only via Tor. The name itself is a deliberate play on the "Don't Be Evil" motto, reflecting the project's stated commitment to neutral indexing without censorship.

The search engine operates by following links from known onion sites and cataloging their content. When you submit a query, NotEvil returns results from its indexed database of onion pages. This makes it a practical tool for researchers, journalists, and ordinary users who need to find information hosted on hidden services. The interface is deliberately minimal, resembling search engines from the early 2000s, which reflects both technical constraints and a philosophy of simplicity over flashy design.

NotEvil uses automated crawlers that follow links across the onion network, similar to how conventional search engines crawl the surface web. The crawler respects robots.txt files and other standard web protocols, meaning site operators can choose whether their content gets indexed. This is a critical difference from some misconceptions about dark web search: NotEvil does not bypass site owner preferences or scrape content against their wishes.

The indexing process is slower and more resource-intensive than surface web crawling because Tor traffic is intentionally latency-heavy. This means NotEvil's index is never completely up to date, and new or frequently updated onion sites may take weeks to appear in results. The search engine also faces constant challenges from link rot, as onion sites disappear, move, or change addresses regularly. These technical realities shape what you'll actually find when you use NotEvil to access onion pages.

NotEvil launched around 2007 as one of the first dedicated onion search engines, predating most other best onion search engines by several years. It was created by a developer known as Ape, who maintained the project through various technical challenges and periods of downtime. The search engine became a reference point for researchers and security professionals studying how information discovery works on hidden services.

The project has experienced multiple periods of being offline and coming back online, often with different operators taking over maintenance. The last publicly documented status indicated the search engine was operational, but like all onion services, its availability can change. The Tor Project documentation and security research papers have referenced NotEvil as a case study in how onion infrastructure evolves. If you want to verify whether NotEvil is currently running, check the Useful Resources page on this site or look for PGP-signed announcements from the Tor community.

NotEvil demonstrates how search and discovery work fundamentally differently on the Tor network compared to the surface web. Because onion sites are not indexed by conventional search engines, users need specialized tools to find them. NotEvil's existence and design choices reveal the technical and social constraints of building infrastructure for hidden services.

The search engine also illustrates why the best onion search engines cannot offer the same breadth or speed as Google. Tor's design prioritizes anonymity and latency, which means crawling is slower and less comprehensive. This creates a natural barrier to comprehensive indexing, which some argue is a feature rather than a bug. Understanding NotEvil's limitations helps explain why finding specific onion sites often requires knowing the address in advance or using community directories rather than relying on search alone.

Onion search engines face three persistent challenges that shape what you'll actually find. First, many onion sites actively block crawlers or use technical measures to prevent indexing, meaning no search engine can offer comprehensive coverage. Tor Project documentation notes that this is by design: site operators have full control over whether their services appear in search results. Second, the onion network's anonymity properties mean search engines cannot verify site authenticity the way surface web engines can, creating opportunities for phishing clones and misleading results. Third, law enforcement takedowns of major onion services mean search indexes quickly become outdated, with results pointing to sites that no longer exist or have been seized.

These realities mean that using NotEvil or any onion search engine requires skepticism and verification. You cannot assume a result is legitimate just because it appears in search. Always verify onion addresses through multiple sources, check for PGP signatures, and be aware that a site matching your search query might be a phishing clone designed to steal credentials or malware. The best onion search engines are tools for discovery, not guarantees of legitimacy.

To access NotEvil, you must first download onion browser software. The standard method is to download the Tor Browser from the official Tor Project website, which provides a preconfigured Firefox browser with Tor integration built in.

Once Tor Browser is running and you have a Tor connection:

1. Open Tor Browser and wait for the connection to establish (the onion icon will show a solid green circle)
2. Navigate to the NotEvil onion address (verify this address through the Useful Resources page or official Tor community sources)
3. Enter your search query in the search box
4. Review results carefully, noting that each result is a link to an onion site
5. Before clicking any result, hover over the link to see the full .onion address
6. Cross-reference the address with other sources before visiting

Never assume the first result is what you're looking for. Phishing clones of popular onion sites are common, and search results can be manipulated. Always verify addresses independently and check for PGP-signed announcements from the service operator.

Several search engines index onion content, each with different approaches and coverage. Torch is another long-running onion search engine known for broad indexing but slower updates. Ahmia is a newer project that emphasizes removing illegal content from its index and providing a surface web interface for researchers. Haystak focuses on indexing and claims to remove certain categories of content. DuckDuckGo, while primarily a surface web search engine, also indexes some onion content and is accessible via its .onion mirror.

The choice between these tools depends on what you're searching for. If you want the broadest index of onion sites, Torch or NotEvil may return more results. If you want a search engine that actively filters illegal content, Ahmia is designed for that purpose. If you want a familiar interface and don't mind limited onion coverage, DuckDuckGo's onion version works well. No single search engine is best for all purposes; the best onion search engines are the ones that match your specific needs and threat model.

Using NotEvil or any onion search engine is just the first step in safely accessing onion sites. The real work happens after you get a search result. Before visiting any onion page, verify the address through multiple independent sources, check for PGP signatures from the site operator, and understand what you're about to access.

The core takeaway is this: onion search engines are discovery tools, not verification tools. They help you find addresses, but they cannot tell you whether an address is legitimate, safe, or what it actually contains. Your responsibility is to verify independently. Start by checking the Useful Resources page on this site for verified onion addresses and links to official projects. If you're searching for a specific service, look for PGP-signed announcements from the operator rather than relying on search results alone. This approach takes more time but dramatically reduces your risk of phishing, malware, or visiting a law-enforcement honeypot.