Awazon Market security: the boring habits that keep your account
Boring beats clever
Most lost accounts come from small repeated mistakes, not from a broken cipher. Ten years in the darknet and the pattern holds: the person who checks every character and keeps one clean profile survives the one who trusts a familiar-looking address. The technical features below help, but only if the daily routine backs them up. Start with the habits and treat the rest as support.
Tor Browser settings
Set the security slider to Safer and leave it there. Because the market runs without JavaScript, nothing on the site breaks at that level, so you gain isolation without losing function. Use a single dedicated profile for the market and do not bolt on extensions. Extensions add attack surface and change fingerprinting, and you do not need any of them to browse Awazon. One profile, Safer setting, no add-ons. That combination is the baseline everything else builds on.
PGP 2FA
Enable PGP 2FA in your account settings before you need it. Generate a key pair with Kleopatra, GPG Suite, or the gpg command line, paste the public half into the market, and keep the private half offline. Without it, a compromised password can be enough for someone to take over your login, and since there is no email recovery, the account is cleaned up rather than handed back to you. Turn it on now, test the round trip once, and store the signing key somewhere the browser cannot reach.
Phishing and vanity prefixes
Fake mirrors copy the opening 8 to 12 characters of a real address, then fill the rest with random ones. Vanity-key generation on Tor v3 is computationally cheap up to about ten characters of prefix, past which the cost explodes. So scammers stop at the affordable point and bet you glance at the start and move on. Check all 56 characters of every onion address against a source you trust, including the tail. A matching prefix proves nothing.
Account hygiene
Never reuse your username anywhere outside the market, on forums or socials, so a search cannot tie the handle back to you. Use a password of at least 20 characters, ideally generated and stored in a manager. Write the mnemonic seed onto paper and keep it somewhere the power can reach less easily than your drives. Do not open the market and ordinary clearnet sites inside the same profile, since each added site widens the bridge between them.
What this page does not cover
These controls protect the account and the entry point, not the transaction itself. Vendor reliability and delivery risk depend on the specific seller, and that is answered in the Dread threads built around individual vendors. Check a vendor's reputation before committing funds; this page cannot guarantee what ships once escrow releases it.