
Crawls .onion sites over Tor to collect page titles, hostnames, and link relationships, exporting JSON trees and visualizations for dark web OSINT investigations.
████████╗ ██████╗ ██████╗ ██████╗ ██████╗ ████████╗
╚══██╔══╝██╔═══██╗██╔══██╗ ██╔══██╗██╔═████╗╚══██╔══╝
██║ ██║ ██║██████╔╝ ██████╔╝██║██╔██║ ██║
██║ ██║ ██║██╔══██╗ ██╔══██╗████╔╝██║ ██║
██║ ╚██████╔╝██║ ██║ ██████╔╝╚██████╔╝ ██║
╚═╝ ╚═════╝ ╚═╝ ╚═╝ ╚═════╝ ╚═════╝ ╚═╝
Open Source Intelligence Tool for the Dark Web
--version and --update to run without requiring a URL.torbot app when installed as a sibling checkout....(will be updated)
python3 -m venv .venv
source .venv/bin/activate
python -m pip install --upgrade pip
python -m pip install -r requirements.txt
python -m pip install -e .
python main.py --help
python main.py --version
python main.py -u https://example.com --depth 2 --visualize table
# Gather basic site information
python main.py -u https://example.com --info
# Save the crawl tree as JSON
python main.py -u https://example.com --depth 2 --save json
# Disable SOCKS5 if you are not using Tor locally
python main.py -u https://example.com --disable-socks5 --visualize tree
# Launch the optional desktop app when TorBotApp is installed
torbot app
Save a versioned crawl result and turn it into a cited investigation bundle:
torbot --url https://example.com --disable-socks5 \
--save result --result-file crawl-result.json
torbot analyze crawl-result.json --provider ollama --model qwen3 \
--output investigation/
Analyst defaults to a local Ollama endpoint. Remote OpenAI-compatible
providers require the explicit --allow-remote flag. Every supported finding
must cite captured evidence, and a provider outage never prevents the
deterministic evidence bundle from being written. See
TorBot Analyst for the offline quick start, output formats,
privacy boundary, and schemas.
usage: Gather and analyze data from Tor sites.
optional arguments:
-u URL, --url URL Specify a website link to crawl
--depth DEPTH Specify max depth of crawler (default 1)
-h, --help Show this help message and exit
--host Set IP address for SOCKS5 proxy (defaults to 127.0.0.1)
--port Set port for SOCKS5 proxy (defaults to 9050)
-v Displays DEBUG level logging, default is INFO
--version Show the current version of TorBot.
--update Update TorBot to the latest stable version
--app Run optional TorBot desktop app
--app-dir APP_DIR Path to a TorBotApp checkout
-q, --quiet Prevents display of header and IP address
--save FORMAT Save results in a file. (tree, JSON)
--visualize FORMAT Visualizes tree of data gathered. (tree, JSON, table)
-i, --info Info displays basic info of the scanned site
--disable-socks5 Executes HTTP requests without using SOCKS5 proxy
-u/--urlis required for crawl-related commands such as--info,--save, and--visualize.
If you are using Tor locally, keep the SOCKS5 proxy enabled. If you are not using Tor, add --disable-socks5 to avoid proxy connection errors.
Read more about torrc here: Torrc
TorBot remains a CLI-first Python tool. The desktop UI lives in the separate TorBotApp Electron project so Node and Electron are not required for CLI users.
To launch it from this CLI, install TorBotApp as a sibling checkout:
code/
+-- TorBot/
+-- TorBotApp/
Then run:
torbot app
If TorBotApp is somewhere else, use either:
TORBOT_APP_DIR=/path/to/TorBotApp torbot app
torbot --app --app-dir /path/to/TorBotApp
See Desktop App Architecture for how the CLI, optional UI, and backend services fit together.
If you face any issues in the project, please let us know by creating a new issue here.
We welcome contributions to this project! Here are a few guidelines to follow:
pytest before submitting a pull request to dev branch.