Tor Browser bridges in censored regions
How to configure obfs4 bridges when Tor is blocked by your ISP or government.
Read guide →Mars Market Forum security guides
Mars Market Forum: practical, step-by-step security tutorials in English. No fluff, no affiliate links, no marketplace promotion.
Tor bridges in censored regions Intermediate
How to configure obfs4, Snowflake, and meek bridges when Tor is blocked by your ISP or government. Step-by-step guide for EU and US users.
- What are Tor bridges and why you need them.
- Configuring built-in bridges in Tor Browser.
- Requesting bridges from the Tor Project website.
- Email bridge request method.
- Troubleshooting blocked bridges.
Tor Browser: setup & hardening Beginner
Tor Browser is the standard tool for accessing onion services. This guide covers installation, security levels, circuit configuration, and bridge setup for restricted networks.
- Download Tor Browser only from torproject.org — never from mirrors or third-party sites.
- Install and launch. Set the security level to "Safer" or "Safest" before visiting onion sites.
- Disable JavaScript on the "Safest" level to reduce fingerprinting and attack surface.
- Use "New Circuit for this Site" if a connection is slow or blocked.
- In countries where Tor is blocked, configure bridges (obfs4) in the connection settings.
- Never install browser extensions — they break anonymity and leak your identity.
- Never maximize the Tor Browser window; window size is a fingerprinting vector.
Understanding onion addresses Beginner
How .onion addresses work, why they are not regular URLs, and how to tell a legitimate onion service from a look-alike scam.
- v3 onion addresses are 56 characters long and end in .onion.
- They are cryptographic hashes of the service's public key — not human-readable names.
- Bookmark verified addresses manually. Do not search for them on clearnet search engines.
- Phishers register similar-looking addresses. Always compare character-by-character.
- If an onion service asks for credentials you never created, treat it as compromised.
PGP encryption: keys, signing, verification Intermediate
Pretty Good Privacy (PGP) lets you encrypt messages and verify digital signatures. Essential for confirming that an announcement or vendor key is authentic.
- Install GnuPG (gpg) on Linux/macOS or Gpg4win on Windows.
- Generate a key pair: gpg --full-generate-key (ED25519 recommended).
- Back up your secret key and revocation certificate to offline storage.
- Publish your public key on keyservers or your personal site so others can verify you.
- To verify a signed file: gpg --verify file.sig file.txt
- To encrypt for a recipient: gpg --encrypt --recipient [key-id] message.txt
- Always check the fingerprint — not just the name — when importing a key.
Verifying PGP-signed announcements Intermediate
Darknet markets and forums publish PGP-signed announcements to prove authenticity. Verification protects you from phishing clones.
- Obtain the official public key from a trusted, independent source — never from the site you are verifying.
- Download both the announcement and its .asc or .sig signature file.
- Run gpg --verify announcement.asc announcement.txt
- A "Good signature" means the file was signed by the holder of that key. A "BAD signature" means do not trust the content.
- Compare the key fingerprint against a second source before acting on any link or instruction.
Two-factor authentication (2FA) Beginner
2FA adds a second verification step beyond your password. Use it on every account that supports it — email, market, and forum accounts.
- Prefer authenticator apps (TOTP) over SMS. SMS can be intercepted via SIM-swapping.
- Open-source options: Aegis (Android), Raivo OTP (iOS), or KeePassXC with TOTP.
- Scan the QR code with your app, then save the backup codes offline — print them or write them on paper.
- Store backup codes separately from your device. Losing your phone without backup codes means lockout.
- Enable 2FA on your email account first — it is the reset target for every other account.
- Never share your 2FA codes with anyone, including "support" staff asking for them.
Cryptocurrency wallets: BTC & XMR Intermediate
Bitcoin (BTC) and Monero (XMR) are the most common currencies on darknet markets. Wallet security determines whether your funds are safe.
- Use a non-custodial wallet where you control the private keys.
- Monero (XMR) offers stronger default privacy than Bitcoin. Consider XMR for transactions where linkability matters.
- Write your 12- or 24-word seed phrase on paper. Never store it in a photo, cloud note, or password manager.
- Keep the seed phrase offline, out of sight, and ideally in a fire-resistant container.
- Use a hardware wallet for significant amounts. Verify the device seal and purchase directly from the vendor.
- Generate a new receiving address for each transaction to reduce address reuse and linkage.
Escrow vs Finalize Early (FE) Beginner
Escrow holds funds with a third party until the buyer confirms delivery. FE releases funds to the vendor immediately.
- Escrow protects buyers from vendors who never ship. Use it for new or unestablished vendors.
- FE is common for trusted, long-term vendors but offers no buyer protection if the vendor disappears.
- Read the market's escrow terms before ordering. Dispute windows and auto-finalize timelines vary.
- Never pay outside the market's official system — direct payments have no recourse.
Operational security (OpSec) basics Intermediate
OpSec is the practice of protecting your identity through habits, not just tools. Software cannot save you from careless behavior.
- Use a dedicated, isolated environment (Tails or a VM) for darknet research. Do not mix it with your daily browsing.
- Never reuse usernames, emails, or passwords from your clearnet identity.
- Do not share personal details, location, or photos in forum posts or market messages.
- Cover your webcam and microphone when not in use.
- Assume every service can be compromised. Limit the damage by minimizing what you reveal.
Related guides
Continue reading on connected topics.
Verifying PGP signatures on market announcements
Step-by-step verification of signed announcements to avoid phishing clones.
Read guide →Monero vs Bitcoin for darknet transactions
Privacy comparison, transaction tracing, and wallet hygiene best practices.
Read guide →Phishing domain checklist
How to spot clone markets and verify official onion addresses before entering credentials.
Read guide →Questions about the guides?
Ask in the forum. Community members and moderators respond in English.
Go to forum