Dread d/MarsMarket
Kleopatra / GnuPG PGP check
Tor Browser Safest mode
Mars Market v3 Onion
01 / Before you connect
Confirm the address is real
The Mars Market verified mirrors are listed on the home page, cross-referenced against the official d/MarsMarket thread on Dread before publication. That cross-referencing is not a substitute for independent verification: this site could fall behind a mirror rotation, or in a worse case, be compromised.
The correct sequence: retrieve the PGP fingerprint from Dread, verify the signed announcement locally, then extract the address from the verified text. That address is what goes into the browser, not a link from Telegram, not a search result, not a bookmark that predates the last mirror rotation.
Onion v3 addresses are 56 characters. Phishing clones change one to three of them, almost always in the middle section. A quick visual scan misses it. The character-by-character comparison method is the only check that catches it reliably.
Full verification procedure — fingerprint retrieval, GnuPG command-line and Kleopatra methods, and the comparison table — is in the Mars Market link verification guide.
02 / Your browser
Set Tor Browser to Safest before loading anything
Security level: Safest. JavaScript disabled. This is not optional. It is the setting that blocks the class of attacks the DDoS protection screen exists to filter against. Set it before entering any address, not after the page loads.
- Open Tor Browser. Do not resize the window — fixed dimensions reduce browser fingerprinting exposure.
- Click the shield icon (top right) → select Safest.
- Confirm: the shield icon shows the highest security level.
- Paste the address from the verified announcement into the address bar. Do not type it from memory — a single character transposition produces a valid-looking but wrong address.
03 / First screen
The anti-phishing and DDoS protection screen
The screen displays a red warning, "If your address bar doesn't match the link, or doesn't end with '.onion' LEAVE THE WEBSITE IMMEDIATELY," and a field prompting for missing characters from the address.
This is deliberate friction. Mars Market withholds part of the address and requires the user to supply it. Anyone who arrived via a phishing link or a Telegram screenshot cannot pass this check, because they do not have the real characters from an independent source.
Enter the characters from the verified source. Click Continue.
04 / Second screen
The login screen — press Verify Mirror first
The login screen shows Username and Password fields, a CAPTCHA challenge, an Exchange Rates panel, and a Verify Mirror button in the upper left. Press it before entering anything else.
Pressing Verify Mirror reveals the beginning and end of the current mirror's address, for example: "Mirror Starts: marshjhofn … Mirror Ends: nj7yd.onion". Read that output against the address from the verified announcement. If they match, proceed. If they do not, close the tab and start from the fingerprint check.
The Exchange Rates panel (BTC, LTC, XMR) signals a live backend. A sophisticated clone can replicate it. Treat it as supporting context, not as proof of authenticity.
05 / Third screen
Registration — Verify Mirror again, then create the account
The registration screen asks for a Public Name, Username (letters and numbers, 4–16 characters), Password, and Confirm Password. No email is required. That omission is intentional: it removes a correlation vector between the account and any real-world identity.
The Verify Mirror button appears here too. Press it before entering anything. Confirm the address output matches the verified source, then proceed.
The complete sequence
Session checklist
Run this before every session. Mirror rotations happen without notice, and a verified session from last week does not carry forward.
- PGP fingerprint confirmed from Dread. Retrieved independently. Matches the stored reference.
- Signed announcement verified locally. Output reads Good Signature. Fingerprint matches exactly.
- Address compared character by character. Group by group against the mirror extracted from the verified announcement.
- Tor Browser set to Safest. JavaScript disabled. Window not resized.
- DDoS screen characters entered from the verified source. Not from the current page.
- Verify Mirror pressed on the login screen. Output read and cross-checked before credentials are entered.
- Verify Mirror pressed on the registration screen. Same check, before any input.
What comes next
Access confirmed. Now handle your funds safely.
The three screens above confirm you are on the real Mars Market. The next question is how to pay. Mars Market accepts XMR, BTC, and LTC; experienced community members treat Monero as the only real option, and the reasons are technical. The payments and escrow guide ↗ covers cryptocurrency selection, walletless checkout mechanics, and how to use escrow to protect against non-delivery. For the full operational security stack behind this session — Tor Browser configuration, OS isolation, key storage — the security guide ↗ covers each layer in order.