Surface Web = the ~4% indexed by search engines; Deep Web = the ~90%+ that isn't indexed (databases, intranets, paywalled pages); Darknet = special encrypted networks reachable only with dedicated software.

* Surface / Deep / Dark — layers defined by reachability, not by how shady the content is. *

People love the "iceberg" picture, but the three layers are defined by reachability, not by how shady the content is.

The big misconception: the Deep Web is not the Darknet. Your webmail and your bank account are Deep Web — totally legal, just not crawlable. The Darknet is a tiny, deliberately encrypted slice that needs special tools to enter.

Tip: Indexed → Surface; behind a login → Deep; needs special software → Dark.

Go deeper:

• Deep web (Wikipedia) — the Deep Web (unindexed, mostly legal) is not the Darknet.
• Dark web (Wikipedia) — the darknet overlay networks reachable only with special software.

HTTPS encrypts the content of a connection, but your IP address and metadata (who you talk to, when, and how much) stay visible.

Every device on the Internet has an IP address that works like a postal address — it lets others trace your activity and estimate your location. Encryption doesn't change that:

• HTTPS hides what you send, but the destination IP, connection times, and data volumes are all still observable.
• A VPN masks your IP by tunnelling through a VPN server — but now the VPN provider can see everything, and metadata patterns remain.

This is the crucial lesson: metadata is data. Knowing that you connected to a crisis hotline at 3 a.m. for 20 minutes can be more revealing than the encrypted words exchanged. True anonymity requires hiding who is talking to whom, not just the message content.

Tip: Encryption protects the letter; it doesn't hide the envelope, the postmark, or that you mailed it at all.

Go deeper:

• Traffic analysis (Wikipedia) — how metadata patterns reveal information even when content is encrypted.