PGP Guide: Verifying an Address and Messaging a Vendor

This PGP guide covers the two things PGP is actually used for on a darknet market — checking that an address really came from the market’s operator, and encrypting a message so only the vendor can read it — and the handful of habits that decide whether either is worth doing. Last updated 29 Aug 2026.

Two different jobs, and people mix them up constantly

PGP does two separate things, and almost every mistake in this niche comes from treating them as one.

Signing answers who wrote this. The author runs a message through their private key, and anyone holding the matching public key can confirm the message came from that key and has not been edited by a single character since. The message itself stays readable to everyone — a signature hides nothing.

Encrypting answers who can read this. You run a message through the recipient’s public key, and from that point only their private key can open it. It says nothing about who sent it.

You want signing when a market publishes a new address, and encrypting when you send a vendor your delivery details. They are not interchangeable, and a market that publishes an address with no signature has given you nothing to check.

Why it matters more here than almost anywhere else

Cloning a market is easy. An attacker mirrors the CSS, the logo, the login form, the vendor pages, registers an onion address one character off the real one, and waits for search results and out-of-date directories to send people over. Everything a visitor normally uses to judge a site — how it looks, how it behaves, whether the login page accepts a password — the clone reproduces perfectly.

What the clone cannot reproduce is the operator’s private key. That is the whole reason PGP survives in this niche: a signed mirror announcement is the one claim about an address that cannot be faked by someone who merely copied the website. Skipping the check makes every other precaution decorative.

Install a client

You need real software, not a website. The standard choices, all free and all built on the same GnuPG engine underneath:

• Windows — Gpg4win, which includes Kleopatra as its interface.
• macOS — GPG Suite.
• Linux — gnupg from your distribution’s repository, optionally with Kleopatra or Seahorse on top.
• Tails — already installed, which is a large part of why people use Tails for this.

The per-platform walkthroughs, with the actual dialogs and commands, live in the PGP encryption guides in this site’s tutorial library. Come back here once the client is installed.

Make your keypair

A keypair is one private key you never share and one public key you hand out freely. When you generate it, four decisions matter and the rest do not:

1. Algorithm and length. RSA 4096, or Ed25519 if your client offers it. Both are fine; do not go below RSA 2048.
2. Passphrase. Long, and used nowhere else. It is the only thing standing between someone who copies the key file and your identity.
3. Identity fields. Do not put a real name or a real email in a key you will use on a market. A handle is enough, and the field is cosmetic to the maths.
4. Revocation certificate. Generate it at creation time and store it separately. It is how you publicly retire the key if it ever leaks, and it cannot be created later if the key is gone.

Back up the private key offline before you use it for anything real. There is no recovery process, no reset link, and nobody to appeal to — lose it and everything encrypted to it is gone.

Verify a signed address

This is the check that earns its keep. A market publishes something like -----BEGIN PGP SIGNED MESSAGE----- followed by its current addresses and a signature block. To confirm it:

1. Get the market’s public key from two places that do not quote each other. Its own site plus an established forum, for example. Two copies of the same lie is what a single source can give you.
2. Compare the key fingerprint, not the name attached to it. Anyone can generate a key labelled with any market’s name; the fingerprint is the part that identifies it. If the two sources disagree on the fingerprint, stop — you have found the attack, not a glitch.
3. Import the key into your client.
4. Verify the signed message — in Kleopatra, decrypt/verify the file or clipboard; on the command line, gpg --verify. You are looking for a good signature from the fingerprint you just confirmed.
5. Read the address out of the verified text, character by character, and only from there — not from the page you happened to land on.

A warning that the key is not certified is normal and not a failure: it only means you have not personally vouched for the key. A bad signature, or a good signature from a fingerprint you cannot corroborate, is a failure.

Encrypt a message to a vendor

Your delivery details should never exist as plaintext on a market’s server. The order is always the same: encrypt locally, paste the result.

1. Copy the vendor’s public key from their profile and import it.
2. Write the message in your PGP client or a local text editor — not in the market’s message box, where a draft can be saved before you encrypt anything.
3. Encrypt to the vendor’s key. Sign it too if the vendor expects a signature; otherwise there is no need to attach your identity to it.
4. Paste the resulting -----BEGIN PGP MESSAGE----- block into the market and send it.
5. Check what you sent. If you can still read it after posting, you sent plaintext.

Their reply comes back encrypted to your public key, and your private key plus passphrase opens it — decrypt in your client, again never in a browser form.

The mistakes that actually cost people

• Pasting a private key into a website. Covered above, and worth repeating because it is the one that ends identities rather than orders.
• Trusting the label on a key instead of the fingerprint. A key’s name field is free text. Its fingerprint is not.
• Reusing one key across separate identities. A shared key is what links two accounts together permanently, no matter how carefully you separated everything else.
• Verifying once and assuming forever. Addresses rotate. Each new announcement gets its own check.
• Treating a good signature as a safety verdict. It proves authorship. An honest signature on a market that later exit-scams is still an honest signature.
• Keeping the passphrase in a file next to the key. That converts two secrets into one.

Questions people actually ask

If any of the steps above assumed a dialog you cannot find, the per-platform PGP guides go through them screen by screen, and the rest of the tutorial library covers the wallet and node side of the same problem.