Staying safe while you shop

Tor hides your route. The rest is hidden by your habits, and habits are the part that actually fails.

One identity, one network

Keep the market, your market e-mail, and any wallet you associate with it in one context: a single Tor Browser profile. Do not read the same mailbox in Chrome on your work laptop. Correlation is what breaks anonymity, not the network itself. If one profile is "the market" and another profile is "everything else", the two stay separate as long as you do not cross them.

Email

Use a separate address for the market. Not your main one. A disposable domain is fine and costs nothing. The point is simple: if that mailbox gets tied to your name, your name should not be anywhere near your market activity.

Downloads

Digital goods are the main category on the market, so you will be opening files regularly. Move them out of your Downloads folder into a folder you review. Check the file type before you open it. A PDF that is actually an EXE. Macros in a document you did not expect. The file runs on your machine and sees your disk; the market never sees it. That gap is where things go wrong.

Passwords and the PIN

Use a long unique password for the market, and keep the withdrawal PIN separate from it. The PIN is what stands between a stolen session and your balance: it is not stored in the session cookie, so a session that gets lifted from your browser does not come with the PIN attached. That is the specific thing that stops session theft from becoming a withdrawal.

Payments

The market takes Bitcoin and Monero. The deposit address is new on every request, so never reuse one from an older page or an old chat. Re-check the deposit address against the current one before you send. If your balance does not match what you sent, check before you spend anything else, because the mismatch may be yours to resolve, not the market's.

What this site does with your data

Nothing. No cookies, no analytics, no record of which address you copied. It is static pages plus a couple of scripts that do not log visits. The full list of what this site does not do is at what we do not do. For the first steps once an address loads, see getting started, and for how to be sure the address is the right one before you trust it with a password, see verify.