Download Source
Always download from torproject.org. Third-party mirrors may bundle modified builds. Verify the GPG signature of the installer using the signing key published on the official site.
The complete guide to accessing Mars Market safely in 2026. Six verified steps: Tor Browser setup, onion URL verification via PGP, copy-paste address entry and account security configuration.
Step-by-step guide
Follow each step in order. Skipping PGP verification or the Safest security level significantly increases your risk of landing on a phishing clone.
| Step | Action | Details |
|---|---|---|
| 1 | Download Tor Browser | From torproject.org only. Verify the GPG signature on the installer package before running it. |
| 2 | Set security to Safest | Click the Shield icon → Change Security Settings → Safest. Disables JavaScript, restricts media and blocks fingerprinting vectors. |
| 3 | Get the verified onion URL | Use the address provided on this page. Sourced from a PGP-signed mirror list and cross-checked against the official canary. |
| 4 | Verify PGP signature | Import the Mars Market public key into GnuPG. Run gpg --verify on the signed mirror list. Match the fingerprint to multiple independent publications. |
| 5 | Copy-paste the onion address | Copy the full 56-character address, paste into Tor Browser. Never type manually — one wrong character loads a phishing clone. |
| 6 | Enable 2FA and PGP on registration | Register a new account. Immediately activate TOTP 2FA via any standard authenticator app. Upload your public PGP key before any order activity. |
Step 1 in depth
The Tor Browser is the only recommended client for accessing .onion hidden services. Other browsers, proxies or VPN-based solutions do not provide equivalent anonymity.
Always download from torproject.org. Third-party mirrors may bundle modified builds. Verify the GPG signature of the installer using the signing key published on the official site.
The Safest level disables JavaScript entirely, blocks media auto-play and restricts several browser APIs used for fingerprinting. It also disables certain web fonts that can leak timing data.
Steps 3 & 4 in depth
PGP verification confirms that the onion address you are about to use was published by the legitimate Mars Market operators and has not been tampered with in transit.
| Command | Purpose |
|---|---|
gpg --import mars-market-pub.asc | Import the official Mars Market public key |
gpg --fingerprint <key-id> | Display the full key fingerprint for comparison |
gpg --verify mirrors.txt.asc mirrors.txt | Verify the signed mirror list |
Cross-reference the key fingerprint against at least two independent publications before trusting the result. A valid signature from an untrusted key provides no security guarantee.
Step 6 in depth
Enable two-factor authentication immediately after registration. Use any TOTP app — Aegis (Android) or Raivo (iOS) are recommended for their open-source codebases and no cloud sync.
Generate a fresh 4096-bit RSA or Ed25519 PGP key dedicated to this platform. Upload the public key in account settings. All vendor communications will use it automatically.
Fund your account with Monero from a wallet you control. Never deposit from an exchange directly — it creates a linkable transaction trail. Use an intermediate personal wallet step.
Common questions
No. Tor Browser provides its own layered routing. Adding a VPN can sometimes reduce anonymity if the provider logs traffic. Tor Browser alone with Safest security level is the recommended configuration.
Use Tor Browser's New Circuit for this Site option, then retry. If still unreachable, check this page for an updated mirror address. Mars Market publishes at least two active v3 onion addresses simultaneously.
On Android, use the official Tor Browser from torproject.org. On iOS, Onion Browser is the recommended alternative. Avoid third-party apps claiming to provide Tor access — most are not audited.
Verify you are on the exact onion address obtained from this page and confirmed via PGP. Legitimate onion sites do not redirect to clearnet addresses. If you see a .com domain or an HTTPS padlock, you are on a phishing clone.