Mars Market: onion address and mirrors

Opening Mars Market

Browser first, in a fixed order. Download Tor Browser from torproject.org/download and install it like any other application. Leave the security level at Standard. A .onion host does not resolve in Chrome or Firefox, and a clearnet gateway that translates the address reads what it translates, so the direct browser is the only path that reaches the market without an extra reader.

Step two is the clipboard. Click the copy button beside one of the three strings on the board above. Do not hand-type the string: a 56 character entry made by hand loses a character somewhere, and the loss lands where you will not see it. Paste into the address bar, press enter, and start the timer in your head.

The load has a normal shape. The circuit builds for ten to sixty seconds, longer on a slow line, and the window stays blank while it does. A connection reset mid-resolution is routine on v3. If the first attempt ends blank, reload exactly once, then judge the result. Storefront on screen: step two is done.

What to check when you arrive

Run the four checks in order before any credential or coin address goes anywhere. A page that has not passed all four is a page you do not use.

• One, the string. Count what sits before the .onion. The count is 56, the alphabet is a to z plus 2 to 7, and the digits 0 and 1 do not appear in it. A different count, or a stray 0 or 1, fails the check and the page with it.
• Two, the surface. Logo, name, layout. A copycat keeps the design and moves one detail: a letter in the name, a shifted color, a mark with no business being there. The typosquat block above holds the one-character variants. Match the page against the addresses, not against your memory of the look.
• Three, the key. The fingerprint is posted on the market, usually in the about section or the footer. Set it against the one in the panel above, block by block. Same blocks: the page signs with the market's key. A different block: a different key in the same shape.
• Four, the release. Address changes arrive in PGP-signed releases, not in comments or messages. A signed release verifies against the fingerprint, which closes the loop: string, key, and statement all point at the same market. An address from anywhere else stays a claim.

Logging in

The account setup is mechanical. One email created for the market and used nowhere else. One password generated for this account and stored, not remembered as a pattern. If the password later leaks, the leak has one destination and no second one.

The login has one valid position: the market's own page, reached after the storefront. The order is store first, form second. A password field that appears before you have seen the store is not part of this sequence. Close the tab, go back to the board, open the address again.

Three coins, three habits

Mars takes three coins, and each one earns its place. Bitcoin is the working coin, the one every vendor lists and the one that clears on any market, so it carries the bulk of the buying. Litecoin is the small-change coin, a cheaper transfer that makes sense for a small order where a Bitcoin fee would be a bigger share of the total. Monero is the coin for when you do not want the amount of the purchase sitting on a public ledger, because it hides the amount, the sender, and the receiver.

Pick the coin per order, by rule. The amount is what you want off the public ledger: Monero. The order is small and the fee is the issue: Litecoin. Nothing else applies: Bitcoin. The same rule on every order keeps the decision out of the checkout.

The wallet follows two rules. Rule one: the market wallet is funded for a buy, not kept stocked. Coins move in when an order is ready and move out after. Rule two: less sitting on the market means less that can be slow to leave. Escrow is the mechanism, and escrow is held by the market, which is exactly why the stocked-up wallet is the exposed one.

One thing you will see in the wallet history is a dusting transaction, a tiny send of almost nothing to your address. It is not an attack and it does not spend your coins. It is a probe, a small amount sent so that if you ever sweep your whole wallet into one address, the sender can follow that one address and link your addresses together. Do not panic about it. Just notice it, and when you sweep, sweep only the addresses you need instead of everything at once. The full list of habits that keep a wallet quiet is in the safety guide, and the terms used here are defined in the glossary.

If the address does not open

Failure has an order of response. First: give the circuit its full minute, then reload once. Second: take a different address from the board. The three strings are the same market, so the second string is the same destination by another route. Third: if all three fail in turn, the fault is on your side of the circuit, not the market's. Some providers throttle Tor, and bridge mode under the Tor Browser settings routes around it. The full procedure, step by step, is in the access guide.

Three equal strings, one fingerprint, three coins with three jobs. The procedure does the protecting; the address just has to be the right one for it to start.