Every mirror displays a PGP signature in the footer. You can copy that signature and verify it using any PGP tool (e.g., GnuPG) against the public key published on our About page. If the signature is valid, the page you see is exactly the one we signed — no modifications.

When you place an order, funds are locked into a 2‑of‑3 multisig address: one key for the buyer, one for the vendor, and one for the market. Two signatures are needed to release funds — normally buyer + vendor. In a dispute, the market’s key combines with the winning party’s key to finalise the transaction.

This site does not ask for credentials. Its only purpose is to provide the official onion links and PGP fingerprint. Even if this domain were hijacked, an attacker could not capture your market login because you would verify the fingerprint on the actual onion site before entering any data.

JavaScript can be used to exploit browser vulnerabilities and de-anonymise users. The marketplace itself runs entirely without JavaScript to reduce the attack surface. This directory site also works without JS for the same reason.