Verify the onion address before you trust it

The 56-character check

A v3 onion address has exactly 56 characters before the .onion part. They come from a 32-symbol alphabet: the letters a through z and the digits 2 through 7. Two digits never appear in a v3 address: 0 and 1. If you see a zero or a one anywhere in the address, it is not a v3 onion, and it is not the market.

Count the characters. The fastest honest way is to paste the address into a plain text file and count what is before the dot. 56 is the number. 55 is not a v3 address. 57 is not a v3 address. One extra or one short and the string is a different thing, usually a typo someone else is happy for you to make. The count is a filter, not a proof. It rules out the obviously wrong, and it is the check that takes five seconds.

The last six characters

Compare the final six characters against a second source that is not the page you are standing on. A market's real address ends in a specific six-character tail. Pull that tail from a second place, a different page, a saved note, a release you read earlier, and line it up against the address in your bar.

Say one source ends in ...qz2lvo and the other ends in ...qz2lva. They differ in the last letter. One of the two is wrong, or one of the two is old. You do not get to keep both. An address that matches one source and not the other is not confirmed. It is a candidate that failed half a test. The last six are short enough to memorize and hard enough to forge by accident, which is exactly why they carry so much weight.

The PGP fingerprint

Every market posts a public key, and the key has a fingerprint, a long string of characters that identifies it. The fingerprint appears in two places that should agree: on the market itself, usually in the about section or the footer, and in the market's admin releases. Pull both. Read them character by character, not glance at them. A fingerprint that matches in both places means the key on the page is the key the market has signed its releases with.

A fingerprint that does not match means a different key, which means a different "market." Someone holds a key that looks close and signs with it. The page can look right and still be a copy. The fingerprint is the one check that ties the address in front of you to the person running the market, and it is the check a lookalike site has to get exactly right to pass.

The release, not the ad

When a market rotates its address, the new one arrives in a PGP-signed release, posted on the market itself or on a forum the market controls. It does not arrive in a comment under a news post. It does not arrive in a private message. It does not arrive in an ad. A signed release can be checked against the fingerprint from the previous section, so the address and the key confirm each other. An unsigned line of text confirms nothing. If the "new address" came from anywhere but a signed release, treat it as a claim, not a fact.

The two-source rule

One source for an address is not a source. It is a claim. A single page, a single forum post, a single saved note can be wrong without anyone being dishonest: the address was copied a month ago, the market rotated, and the note never changed. Or the page is not wrong, it is a copy built to look like the right page. Either way, one source cannot tell you which one you are holding.

The rule is to hold two sources that did not copy each other, and only then compare. Two sources are independent when one could not have taken the address from the other. A forum thread where the market posted the address and a different reference that listed it earlier are independent, because each got the string from its own path. A page on the market itself and a forum post that quotes the market are not fully independent, because the forum post is a copy of the market. The market's own page is still useful as a second source, but only when you reached it through an address you already trusted, an address you confirmed before this rotation.

When two independent sources disagree, do not guess. Do not pick the one that looks newer. Do not split the difference. Stop. Do not log in on either address, do not deposit on either, do not move coins toward either. The disagreement is the signal. Go find a third source, a different thread, a different reference, the signed release itself, and let three sources settle what two could not. A market that can be confirmed by three independent places and not by two is the market worth opening.

Worked example, without names

Walk through one full check, the way it actually happens on a real rotation, with the market's name left out because the steps are the same for every market in the list.

An address arrives: a string before the .onion part. First move, the count. Paste it into a plain text file, select what is before the dot, count. 56. Not 55, not 57. Then the alphabet. Scan the string for a 0 or a 1. None. Only letters a through z and digits 2 through 7. The string is at least shaped like a v3 address. That is a pass on the first check, and it is the check that throws out most of the fakes without any effort.

Second move, the tail. Take the last six characters of that string and pull the last six from a second source, a forum thread that is not the page the address came from, or a reference that listed the address independently. Line them up. They match, all six, in order. The string survives the second check. If the fifth character differed by one letter, the string would be out, and the rest of the walk would not start.

Third move, the circuit. Open Tor Browser, paste the full address, press Enter, wait for the circuit to build. The home page loads. Now the fingerprint. Open the market's about section, read the posted key fingerprint. Then open the admin release that announced this address, read the fingerprint it was signed with. Read both strings character by character, not as a glance. They agree. The key on the page is the key that signed the release, and the release is the one that named this address. The page in front of the cursor is the market, not a copy of it.

Only after all of that, the login. Type the username and the password into the form that belongs to the market's own interface. The coins move after the login, not before. The order is the protection. A single skipped check does not always fail, and that is the problem with skipping: the one time it matters is the one time you will not notice it.

Signs of a fake

• A one-letter difference from a known address. A typosquat, a lookalike that differs by a single character and waits for the person who retyped the address. The count and the last-six check exist to catch it.
• A clearnet domain with the same name. A .com or .shop that spells the market's name. The real market is an onion. A web domain wearing its name is an imposter selling the same promise.
• A "new address" from a comment or an ad. Not signed, not from a release, posted where a stranger can post. The address is real to the person who posted it, and that is all it is.
• A logo with one extra element. The same mark with a letter added, a color shifted, a shape where none should be. Close enough to pass a glance, wrong enough to be someone else.
• A login form before the interface. A password field that appears before the market's storefront loads. The market shows its page first and asks for a login second. Reverse that and the page is not the market.
• A request to send coins to a "personal" address. Any nudge to move funds off the market's wallet to a private address is the tell. The market holds coins in escrow. A person does not.
• A recovery service after the market closes. Once a market shuts down, a site appears offering to "recover" what you lost for a fee. The fee is the product. The recovery is the story.
• A "recovery fee" on a live market. A page inside a running market asks for a small payment to "restore" an order, a wallet, or an account that supposedly closed. The market does not charge a fee to undo its own state. A fee that appears the moment something went wrong is a fee that was waiting for something to go wrong.
• Urgency with a deadline. "The address changes in 24 hours, deposit now." "This window closes tonight." A real rotation does not run on a countdown that starts the moment you open the page. The pressure to act before you check is the mechanism. Check first, then act, and the deadline usually disappears or was never there.

Run all four before you trust a page. The order is the point: a string that fails the count never gets to the fingerprint.

• Length. 56 characters before the dot, no 0, no 1.
• Last six. Matched against a second source, not the page you are on.
• Fingerprint. The key on the page and the key in the release agree, character by character.
• Release. The address came from a PGP-signed release, not a comment or an ad.