How do I verify a Tor market onion address is genuine?

Three checks, all of which should pass before you submit a password or fund an account.

1. Compare against a PGP-signed announcement

Every operator on this knowledge base pins a PGP-signed announcement on their Dread account that lists the current onion endpoints. Import the operator’s public key once, then verify the signature on the announcement. The endpoints in a successfully-verified post are the real ones; any address surfaced anywhere else (Telegram, Reddit, email) is not authoritative.

2. Compare against the page banner

Marketplaces in this segment reprint their canonical onion in the page header on every render. Compare what the page itself says it is against your browser address bar, letter by letter. The full string is 56 characters; partial-prefix matches are a known phishing pattern.

3. Check the captcha fingerprint

Several markets embed the canonical onion fingerprint into the login captcha image itself. A phishing clone cannot easily reproduce this. If the captcha fingerprint disagrees with your address bar, the clone is the address bar.

See also