Verify an onion address before you deposit anything

This Deep Web Wire guide starts from a simple fact: depositing is the point of no return. Once coins leave your wallet toward an onion address, the only thing standing between you and a loss is whether that address was the one you meant. This guide is the short, jargon-free sequence for making sure it is — and for being honest about what that check can and cannot promise.

The sequence

Deep Web Wire's four steps, run in order, turn a claimed onion address into one you can act on. Each step catches a different failure mode; skipping any one of them re-opens the exact gap a phishing page is built to exploit.

Step 1: get the address from a source you trusted first

Open a signed list or a record you bookmarked before today. The address you are about to check should come from there, not from the site asking for your deposit — using the deposit page itself as your source is circular and proves nothing.

Step 2: copy the full string with a copy button

Never retype an onion address by hand. One mistyped character produces exactly the same failure a phishing page engineers on purpose, except this time you did it to yourself. A copy button removes that risk entirely.

Step 3: cross-check against a second independent source

Find the same project on a different trusted list and compare the two strings character by character. Agreement across independent sources is what verification actually is — a single source, however confident, is still just one source.

Step 4: connect, then deposit only after the site behaves

A matched address gets you to the right door. Confirm the site loads and behaves as expected — correct branding, working login, no unexpected redirects — before you move any coins, and keep the working address bookmarked for next time so you are not repeating the full search from scratch.

What verification does not tell you

Matching an address across two trusted sources, the way Deep Web Wire teaches it, proves you are talking to the project you think you are. It does not prove the project is solvent, that its escrow works, or that it will not vanish next week. Those are separate risks that no address check can touch. Keep them separate in your head: verification is about identity, not integrity. Clearing the first bar is required; it just is not the same as clearing the second.

Identity versus integrity, kept separate on purpose

An address check answers exactly one question: is this the string the project actually publishes. It cannot tell you whether that project pays out disputes fairly, whether its operators plan to exit-scam next month, or whether its escrow model is sound. Bundling those questions together is how a reader ends up over-trusting a market simply because its address happened to check out.

Why signatures come into it

The strongest form of a trusted source is a signed list — a set of addresses that a project or a tracker has cryptographically signed, so that tampering is detectable. You do not need to master the theory to benefit: if the list you check against is signed and the signature verifies, the addresses on it are far harder to poison than a plain web page. See the PGP and signatures note for the plain-language version.

Signed list versus an ordinary web page as a source

An ordinary web page can be edited by anyone with access to the server, silently, with no trace a reader would notice. A properly signed list carries a cryptographic guarantee that any tampering breaks the signature check, which is verifiable independently of whoever is currently hosting the page. That difference is why a signed source, even one you cannot fully evaluate the cryptography of, is structurally harder to poison than an unsigned one.

Frequently asked questions

Is a verified address a guarantee the market is safe?

No. A verified address only confirms you are connecting to the project you intended. It says nothing about escrow, vendors, or whether the market will still exist tomorrow.

Do I need to understand PGP to verify an address?

Not to benefit from it. Checking a string against two independent trusted sources already defeats most attacks; a verified signature on a signed list simply makes one of those sources much harder to tamper with.

Should I re-verify an address I already checked last week?

Yes, especially before a deposit specifically. Addresses rotate and phishing pages get seeded between sessions; a check from last week does not cover today.

What if I only have one trusted source available right now?

Wait if you can. A single source, however trusted, is not the same as agreement between two independent ones — that agreement is the actual verification, not a formality.

Why "before you deposit" and not just "before you connect"

Verification matters at every stage, but the moment right before funds move is where a mistake becomes expensive and hard to reverse. Connecting to a wrong address wastes a few minutes; depositing to a wrong address, through a wrong login form on a convincing clone, can mean funds gone with no recourse. This guide is titled around the deposit moment specifically because that is where the stakes justify slowing down and re-running the full sequence, even if you already checked the address once earlier in the session.

A worked run-through of the sequence

Say you have a market's address bookmarked from a previous Deep Web Wire-verified session, and you are about to place an order. Re-run the sequence anyway: re-open the record on this deepweb reference, re-copy the address, re-compare it against your bookmark character by character, and only then proceed. This feels redundant when nothing has actually changed, and that redundancy is exactly the point — the cost of re-checking a correct address is a minute of your time, while the cost of skipping the check on the one occasion something did change is the scenario this whole guide exists to prevent.

What the run-through looks like when something has changed

Now suppose the re-comparison in that same run-through turns up a mismatch: the address on your bookmark differs from this wire's current record by a handful of characters. That single moment is the entire reason for re-running the sequence instead of trusting a bookmark indefinitely — it is the difference between catching a rotation or a phishing swap before any funds move, and finding out after.

What to do if the two sources disagree

If your bookmarked address and this site's current record do not match character for character, stop before connecting to either one. A mismatch means at least one of your two sources is wrong, and proceeding on a coin flip defeats the purpose of checking two sources in the first place. Go to a third independent source — the project's own signed channel if you have one, or a second reference you trust — before you act on either address.

Shortcuts readers take, and why each one fails

Every step in Deep Web Wire's sequence exists because a shortcut around it has a specific, predictable failure mode. Naming the shortcuts directly makes the discipline easier to stick to than an abstract instruction to "be careful" ever does.

Tools and outside resources that support this sequence

Verification is a discipline, not a piece of software, but a few real tools make each step of the sequence above meaningfully easier and safer to run.

• Connect only through Tor Browser, downloaded from the official Tor Project source, never a mirror or a bundled copy from a third-party site.
• When a source is signed, verify it with GnuPG rather than trusting a signature block by eye; see our PGP reference for the plain-language walkthrough.
• The Electronic Frontier Foundation publishes broader digital-security guidance that applies well beyond any single darknet market onion address check.
• Store more than one saved address safely with an offline manager such as KeePassXC rather than a plaintext note or browser autofill.

Related Deep Web Wire pages that support this guide

This sequence works best combined with the rest of Deep Web Wire's reference set, not read in isolation.

• The darknet market index and each project's own record are where step one's trusted source actually lives.
• The mirror sourcing page explains the two-source cross-check standard every address on this wire has to clear before step one is even possible.
• The spot-a-fake-mirror guide covers the visual tells that complement this sequence's character-by-character check.
• The status board and warrant canary add two more honesty signals worth reading alongside this guide.
• The verified onion links shortlist gives you a single bookmarkable primary per project to use as step one's trusted source.

Deep Web Wire built this sequence around one deposit-moment guide rather than scattering the same four steps across every page, so it stays the single place to point a friend before their first darknet market deposit. If a friend asks where to start, this Deep Web Wire page and the market record for the specific project they want to use are the only two links they actually need.