Mars Market PGP Verification
How to Authenticate an Onion Address.

01 / The concept

What a verified Mars Market link actually means

When people say a link is "verified," they usually mean one of two things. Either someone checked it recently and it was working, or the key that signed the mirror announcement was confirmed to belong to Mars Market administration through a source independent of the site being evaluated. Those are completely different claims.

Mars Market publishes PGP-signed mirror announcements. The administration signs a message listing current mirrors, and that signature is verifiable by anyone with the public key and GnuPG installed. But the signature proves only one thing: the message was created by whoever controls that private key. It says nothing about who controls the key.

Dread community guides have made this point across dozens of threads: the fingerprint on the page you are evaluating is not evidence. Only a fingerprint retrieved independently, from a post predating any potential clone, works as a reference point.

02 / The fingerprint

Step 1 — Retrieve the PGP fingerprint from Dread

Dread is the primary independent forum for darknet market communities. The d/MarsMarket subdread is where Mars Market administration publishes PGP-signed announcements, mirror updates, and key changes, with a post history that predates any clone. A post from six months ago showing a consistent fingerprint is evidence no clone created yesterday can fabricate.

1. Open Tor Browser with security level set to Safest (JavaScript disabled). If you haven't configured Tor Browser correctly yet, the security guide Tor Browser section covers the exact settings.
2. Navigate to Dread and open the d/MarsMarket subdread.
3. Find the pinned post containing the Mars Market administration's PGP public key.
4. Copy the full 40-character hex fingerprint — not the short key ID. GPG documentation referenced across Dread's community guides is explicit on this: short key IDs of 8 or 16 characters have been forged at scale. The full 40-character fingerprint is the only safe reference.
5. Store it offline. Paper. Anything that syncs — cloud notes, screenshots, messaging apps — breaks the independence of the source.

Why the fingerprint must come from an independent source

If the fingerprint comes from the same page as the mirror being evaluated, the loop is not closed. The clone provides the address, the key, and the fingerprint to verify against, all three controlled by the same party. The chain looks intact. It proves nothing.

03 / The signature check

Step 2 — Import the key and verify the signed mirror announcement

Mars Market posts PGP-signed mirror announcements on Dread when mirrors rotate. That signed text block is what gets verified locally. Two methods work.

Using Kleopatra (GUI method)

1. Download Gpg4win ↗ from the official gpg4win.org site only — not a third-party mirror.
2. Open Kleopatra: File → Import, paste the key block from the Dread post.
3. Copy the signed announcement from Dread, then use Tools → Clipboard → Decrypt / Verify.
4. Confirm: status reads Good Signature and the fingerprint matches the one from Step 1 exactly.

Using GnuPG command line

Save the public key to marsmarket_pubkey.asc and the signed announcement to announcement.txt, then:

gpg --import marsmarket_pubkey.asc
gpg --verify announcement.txt

Expected output: Good signature from "Mars Market Administration" followed by the fingerprint. That fingerprint must match the Dread reference exactly.

What to do if the fingerprint does not match

Close the tab. Enter nothing. Return to Dread, retrieve the current signed announcement, re-verify, and start a fresh session.

04 / The address comparison

Step 3 — Compare the onion address character by character

PGP verification and address comparison cover different failure modes; both are required. PGP confirms the signed announcement came from a specific key. Address comparison confirms the mirror in front of you is the one named in that announcement. Onion v3 addresses are 56 characters of base32. A clone changes one to three of them, almost always in the middle section where attention drops after a recognisable prefix. Anti-phishing guidance across Dread threads is consistent on this point: the swap is designed to pass a quick visual check and fail a careful one.

Break the address into groups of eight to ten characters and compare each group against the verified source, not the full string at once.

One character different. That is the margin. The Dread community guides are unambiguous: a single character difference means a different site. Close the tab, retrieve the address again from the verified source, and start fresh.

05 / After verification

Fingerprint confirmed. Now connect.

Verification is complete: fingerprint retrieved from Dread, signature confirmed locally, address compared character by character. What comes next is three screens, an anti-phishing checkpoint, a login screen with a Verify Mirror button, and a registration form. Each is a checkpoint, not a formality, and each requires the verified address characters to be used correctly.

Screen 01 · DDoS Gate Anti-Phishing Prompt

Enter the 6 missing onion characters from your verified Dread announcement.

Screen 02 · Login Verify Mirror Button

Press Verify Mirror to confirm start/end characters before entering credentials.

Screen 03 · Register No-Email Registration

Re-verify the mirror and write down your recovery seed phrase on paper.

The full walkthrough of all three screens — what each one shows, what to press, what to check before entering anything — is in the Mars Market access guide. It picks up exactly where this guide ends.

06 / Before every session

Anti-phishing checklist

Run this sequence every session. Phishing addresses slip through after mirror rotations because users assume a verified session carries forward.

1. Fingerprint confirmed independently. Retrieved from Dread, not from the current page. Matches the stored reference from a previous session.
2. PGP signature verified locally. Output reads Good Signature. Fingerprint in the output matches the Dread reference exactly.
3. Address compared character by character. Against the mirror extracted from the verified announcement. Group by group — not a quick visual scan.
4. Tor Browser set to Safest. JavaScript disabled. Security level confirmed before loading any address.
5. DDoS screen characters entered correctly. Known from the verified announcement, not copied from the current page.
6. Verify Mirror pressed on the login screen. Start and end of address read and cross-checked against the verified list before credentials are entered.

Continue from here

Fingerprint confirmed. Address verified. Now connect.

Fingerprint from Dread, PGP signature verified locally, address compared character by character. That sequence closes every gap a phishing clone relies on. It reduces risk; nothing eliminates it.

The next step is the connection itself: three screens, each with a verification checkpoint. The Mars Market access guide ↗ covers all three in order, anti-phishing screen, login screen, registration. For the full operational security stack, Tor Browser, OS isolation, key storage, the security guide ↗ covers each layer. The verified mirrors ↗ are on the home page.