Darknet glossary

A darknet market throws a wall of terms at you before you buy anything: the address, the circuit, the wallet, the escrow, the release. None of it is hard. Each word names a specific piece of what is happening on the page, and each one becomes clear the first time you meet it. The terms below are in the order a first purchase runs into them, from the address in the bar to the coins in the wallet, so the list reads like the trip rather than an alphabet.

The words, in the order you meet them

.onion address

A web address that only Tor can open. It ends in .onion instead of .com, and a normal browser will not resolve it. It points at a hidden service rather than a fixed server, which is why it works even when the market moves.

v3 onion

The current generation of onion address. A v3 address has exactly 56 characters before the dot, drawn from the letters a to z and the digits 2 to 7. The digits 0 and 1 never appear, so their presence means the address is not v3 and not the market.

hidden service

A website that lives inside the Tor network instead of on a public server. Visitors find it by its .onion address, and the service does not need to advertise a real domain or a fixed IP. A darknet market is a hidden service.

Tor circuit

The route your traffic takes: three relays in a row, each knowing only its neighbor. Tor builds a fresh circuit for a destination, and the circuit is what makes the page load at all. The first build is the slow part; see how to access a darknet market for what the wait looks like.

guard node

The first relay in your circuit, the one that meets your traffic coming in. Tor sticks with a small set of guard nodes over time so that an observer watching your entry point sees the same face and cannot tell when you have switched routes.

exit node

The last relay in a circuit, the one that hands traffic to the wider internet. For a .onion page the circuit runs end to end inside Tor, so there is no exit node touching your data the way one does for a normal site.

relay

Any node in the Tor network that passes traffic along. Circuits are built from relays, and the network is only as fast and as wide as the relays running it. A relay is a piece of the path, not a destination.

bridge

A relay that is not in the public list, used to get in when a provider blocks or throttles known Tor entry points. Tor Browser has a bridge mode in its settings for exactly this. Turn it on when circuits stop forming and nothing else has changed.

Tor Browser

The browser that speaks the Tor protocol and opens .onion addresses. It is the transport for everything in a darknet market, and the only browser that needs to be running for a market to load. Get it from torproject.org/download.

clearnet

The regular internet, the part that is not hidden. The pages you reach with a normal browser and a normal address are clearnet. A darknet market sits outside it, reachable only through Tor.

clearnet proxy

A gateway, in the style of .onion.watch or tor2web, that translates an onion address so it opens in a normal browser. The gateway fetches the page and reads your requests, then shows you the result. Fine for a glance; it is a gateway that sees your traffic, not a way to log in.

deep web

Every part of the web a search engine does not index: logins, databases, member pages. The dark web is a small corner of the deep web, the part hidden by Tor. The two are often mixed up, and they are not the same size.

dark web

The slice of the web reachable through anonymity networks, Tor chief among them. A darknet market is a dark web site, but the dark web is far more than markets. It is also forums, wikis, and quiet services that never touch a coin.

directory

A list of markets and their addresses in one place, the kind of page you land on from a search. A directory is a starting point, not a guarantee. Every address on it still gets checked before you trust it.

mirror

A second address that opens the same market. A market posts several mirrors so that a load on one does not take the whole place down, and so a blocked address has a sibling. All mirrors for a market are equal, and all of them need the same checking. See markets compared for how many each one carries.

address rotation

When a market changes its .onion address. Markets rotate keys now and then, and a rotation is the main reason an address that worked last month no longer does. The new address arrives in a signed release, and the old one stops.

sunset period

The window after a rotation when both the old and the new address still open. It gives regulars time to switch before the old string is cut. After the period ends, the old address is gone and only the new one resolves.

typosquat

A lookalike address that differs from the real one by a single character, built to catch the person who retypes the string by hand. It is the same length and the same alphabet, so only a careful comparison of the tail catches it. Part of the method is in how to verify an onion address.

phishing

A page that copies a market closely enough to take a login or a coin address. It borrows the name, the layout, sometimes the address with one letter shifted. The checks that stop a typosquat stop most of it, because a phisher has to get the same details right.

PGP

A system for signing and encrypting with a public and a private key. Markets use it to sign their releases, so a reader can tell a real announcement from a typed line. The public key is posted; the private key stays with the market.

fingerprint

A fixed string of characters that identifies a PGP key. A market posts its fingerprint on its own pages and in its releases, and the two should match character for character. A mismatch means a different key, which means a different "market." The fingerprint step is in how to verify an onion address.

admin key

The private key a market holds to sign its releases. It is not the thing posted on the page. The posted key is public and can be checked; the admin key is what produces the signature, and it is what a fake market cannot borrow.

PGP-signed release

An announcement, usually a new address, signed with the market's key so it can be checked against the fingerprint. A signed release is the only "new address" that counts. An unsigned one, from a comment or a private message, is a claim.

escrow

The market holding your coins between the moment you pay and the moment the vendor is paid. The coins sit with the market, not with the seller, until the order is confirmed or a timer runs out. Escrow is the reason a bad vendor does not simply keep your money. See darknet market safety for how it fits a purchase.

release period

The time a buyer has to confirm a delivery before escrow hands the coins to the vendor on its own. Confirm inside it and the order closes clean. Let it run out and the market releases the funds without a word from you.

dispute

What a buyer opens when a delivery is wrong, short, or never came. The market steps in as the judge, because the coins are still in its escrow. A dispute is the lever escrow gives a buyer, and it only works while the coins have not been released.

vendor

The seller inside a market. A vendor lists products, holds the escrowed order, and builds a record of feedback over time. A vendor is an account on the market, not a person with a face, which is why the feedback and the history are all the signal there is.

rating and feedback

The record of past orders left by other buyers. It is the closest thing a market has to a reputation, and it is the first thing to read before a first purchase from a vendor. A long, steady record is worth more than a low price.

opsec

Operating security: the habits that keep a market identity separate from a real one. A dedicated email, a password used nowhere else, a wallet that is not the main one. Opsec is not one rule. It is the set of choices that keeps a leak from becoming a trace. The working list is in darknet market safety.

dusting

When a tiny amount of a coin is sent to an address, often to mark it or to tie it to something. A dusting transaction is small enough to ignore as value and useful enough as a tag. It is one of the reasons a wallet used for a market should stay out of the main one.

hot wallet

A wallet that is connected and ready to send, which makes it fast and makes it exposed. A hot wallet is fine for the coins a purchase needs. It is the wrong place for a balance meant to be kept, because it is the one that is reachable.

cold wallet

A wallet kept offline, holding coins that are not meant to move soon. A cold wallet is slower to spend from and safer to keep in. The split between the two is the basic move: little in the hot one, the rest in the cold one. See darknet market safety for how to split them.

Monero (XMR)

A private coin, the kind where a transaction does not show a sender and a receiver in the open. XMR is the coin most markets lean on for that reason, and a few take it alone. A separate wallet for it keeps the history of a market out of the history of everything else.

Tails

An operating system that runs from a USB stick and leaves nothing on the machine when it shuts down. Tails routes all traffic through Tor and forgets the session at the power-off. It is the step up in isolation for someone who wants the machine itself to be disposable.

Whonix

A setup built on two virtual machines, one that works and one that routes, so that the working side never holds a direct connection. Whonix wraps a normal system in Tor in a way that is harder to break out of than a browser alone. It is for the buyer who wants the whole machine inside the circuit, not just the tab.

dedicated email address

An address made for the market, separate from the one tied to a name, a job, or a bank. If that address leaks, it leaks into one place instead of a whole life. It is the first and cheapest piece of opsec, and the one most people skip.

subaddress

An extra receiving address a wallet can generate, each one different and all of them credited to the same balance. A subaddress keeps a market payment off the main address, so a coin that is dusted or tagged stays tagged to a side string, not to the wallet itself.