How to Verify a Nexus or Torzon PGP Key Before Signing Up

A user on Dread last month typed a market’s PGP fingerprint into the wrong field during registration, sent his home address to the wrong key, and spent three days trying to convince support he wasn’t a scammer. The mistake wasn’t trusting the market – it was trusting the key without verifying it. PGP verification is the single most overlooked step in darknet registration, and it’s the one that separates a clean account from a compromised one.

What We’re Verifying and Why It Matters

Nexus and Torzon, like every serious market in 2026, use PGP for two-factor authentication, encrypted communication with vendors, and address verification. When you sign up, the market gives you a public key. That key is what encrypts your messages so only the market can read them – and it’s also what signs messages claiming to be from the market. If you accept a fake key at registration, everything you send through that channel is readable by whoever planted the fake.

Phishing clones of Nexus and Torzon routinely swap their own PGP keys into mirror sites so they can decrypt login credentials and 2FA codes the moment a buyer registers. The login page looks identical, the .onion address is one character off, and the key fingerprint is completely different. Verifying the key before you type a single character into the registration form is what closes that hole.

Prerequisites Before You Start

You need Tor Browser 13.5 or newer from torproject.org – never a third-party download. You’ll also need a working PGP setup: GPG4Win 4.3 on Windows, GPG Suite 2024.1 on macOS, or GnuPG 2.4.x on Linux. Your keypair should be 4096-bit RSA with a 1-2 year expiration, generated before you ever visit a market.

Have a Monero wallet ready (Cake Wallet 0.10.x or Feather 2.1.x) and a ProtonMail or Tutanota address created over Tor. Keep your password manager open – you’ll be generating and storing long passphrases. If you don’t have an encrypted USB drive for key backups, stop here and set that up first; losing your private key means losing account recovery options.

Step-by-Step: Verifying the Nexus or Torzon PGP Key

Open Tor Browser and navigate only to the verified .onion address listed on a trusted directory – never click links from forums, search engines, or DMs. Once the market loads, find the official PGP key. On Nexus it’s typically under “Support” or in a sidebar widget; on Torzon it appears in the footer and on the registration page itself. Copy the entire key block, including the “—–BEGIN PGP PUBLIC KEY BLOCK—–” and “—–END PGP PUBLIC KEY BLOCK—–” lines.

Open a terminal (or Kleopatra/GPG Suite) and import the key into a temporary keyring so you don’t pollute your main one: gpg --import /tmp/market-key.asc. Then read the fingerprint with gpg --fingerprint --keyid-format long. Write down the 40-character fingerprint exactly as shown. Now compare it against the fingerprint posted on the market’s official Dread thread, their XMPP/Jabber channel, and any signed announcements from known staff.

Three independent sources matching is the minimum. Two sources isn’t enough – phishing operators often compromise one announcement channel at a time. If the fingerprint on the registration page doesn’t match the fingerprint on Dread, the mirror you’re on is malicious. Close it, verify your bookmark, and try again.

Verification Steps That Confirm It’s Working

Once the fingerprint matches across sources, sign the key locally to mark it as trusted in your keyring: gpg --lsign-key FINGERPRINT. This doesn’t send anything to the market – it only updates your local trust database. Now use that key to encrypt your registration username and password before submitting them, and decrypt the market’s reply to confirm the message was actually signed by the key you verified.

Send a test PGP message to the market’s support address through the platform’s built-in messaging system. If the reply decrypts cleanly with the key you imported, the chain is intact. If GPG throws a “no secret key” error or the signature doesn’t verify, the key on the page was swapped mid-session – clear your Tor circuits, restart the browser, and reload the official .onion address.

Common Issues and Troubleshooting

If the fingerprint doesn’t match, you’re on a phishing mirror. Don’t register, don’t log in, don’t enter credentials. Check the URL character-by-character against the Dread-verified list – “nexus” and “nexüs” are different onions. If GPG says the key is expired, check the market’s status page; legitimate markets rotate keys and announce the new fingerprint publicly before switching.

If you already registered against a key you didn’t verify, log in immediately, change your password, enable 2FA with a freshly verified key, and withdraw any funds to a new Monero wallet. Assume the old credentials are burned. Going forward, never accept a PGP key from a page you reached through a link – always navigate to the .onion address manually from your bookmark.

Additional Security Recommendations

Run Tor Browser at its default security level (“Standard”) or higher, and never maximize the window – default window size prevents fingerprinting. Use a no-logs VPN as a secondary layer only if your jurisdiction doesn’t penalize Tor use; Mullvad or ProtonVPN work, but the VPN is never a substitute for verifying keys and onions.

Store your PGP private key on an encrypted USB drive that stays offline, and never type its passphrase on a machine you don’t control. Rotate your market password every 30 days, and use a unique 20+ character passphrase generated by your password manager. These habits compound – skipping one undermines the rest.

Scam Comparison