Verifying an address

You copied an address, or someone sent you one, or a page you found posted one. Before you type a password into any login form, spend thirty seconds checking where you actually are. The checks below take less time than the mistake they prevent.

The checklist

1. It ends in .onion. No hyphen before the dot, no extra characters after it.
2. It is 56 characters long before the .onion. Paste it into any text editor and let the editor count. The three addresses at the top of this page are all the same length, which makes a comparison quick.
3. The last six characters match. Copy the tail of the string you have, paste it next to the tail of an address published here, and read both from right to left. A mismatch in the tail is a mismatch, full stop.
4. It came from somewhere you trust. This page, the market's own announcements, a contact you verified outside of the internet. A forum post from a young account is not a source.

The check that matters most

When the market's login screen loads, the page itself prints the onion address it runs at. Read it from the end backwards against your browser's address bar. A copied login page can reproduce the design perfectly. It cannot sit at the real address. If the two strings disagree by a single character, close the tab before you type anything. The password is the part that is not recoverable.

What this check is and is not

These checks verify the address. They confirm you are dialing the strings this directory publishes and the market uses. They do not verify what happens behind them. We do not run the market and we do not operate its servers. For anything beyond the addresses, the market's own announcements are the final word.