How do I verify a Tor market onion address is genuine?

Three checks, all of which should pass before you submit a password or fund an account.

1. Compare against a PGP-signed announcement

Every operator on this knowledge base pins a PGP-signed announcement on their Dread account that lists the current onion endpoints. Import the operator’s public key once, then verify the signature on the announcement. The endpoints in a successfully-verified post are the real ones; any address surfaced anywhere else (Telegram, Reddit, email) is not authoritative.

2. Compare against the page banner

Marketplaces in this segment reprint their canonical onion in the page header on every render. Compare what the page itself says it is against your browser address bar, letter by letter. The full string is 56 characters; partial-prefix matches are a known phishing pattern.

3. Check the captcha fingerprint

Several markets embed the canonical onion fingerprint into the login captcha image itself. A phishing clone cannot easily reproduce this. If the captcha fingerprint disagrees with your address bar, the clone is the address bar.

See also

Why the design proves nothing

A copied storefront reproduces the layout perfectly, because the layout is served to anybody who loads the page. Fonts, wording, images, the working login form. None of it is evidence. Copies generally look better than the original, because whoever built one wants you comfortable enough to type a password.

Read the address backwards

The last characters are the expensive ones to match. Anybody generating a lookalike spends their effort on a convincing prefix, since that is the part people glance at, and randomises the rest. Comparing from the end is where a fake gives itself away, and comparing only the first few characters is the same as not comparing at all.

What a signed announcement adds

Where the operator publishes address changes signed with a key you already hold, checking the signature beats every other method, because it does not require trusting the directory you read the address on. Import the public key once and every announcement afterwards can be verified in seconds.

The moment this actually matters

Almost every phishing story starts the same way. A familiar address goes quiet, somebody goes looking for a replacement, and the first plausible result wins. Copies rank precisely because that is the only moment anybody searches for a market address, and everybody searching is anxious and in a hurry. Keeping the addresses saved removes the moment rather than the risk.