How to Verify a Darknet Market with PGP

What PGP verification actually proves

A valid PGP signature proves three things, all of them useful and all of them narrow. It proves authenticity — the message came from the holder of a specific private key; integrity — it has not been altered by even one character since it was signed; and non-repudiation — the signer cannot later deny having produced it. For a market, the message in question is a list of genuine onion addresses, often published as a signed "mirrors" block or alongside a warrant canary. When you validate it, you are not trusting the website, its reputation, or a directory that listed it; you are trusting mathematics that a clone cannot reproduce.

The catch lives in the word "specific." A signature only means something if you have the right public key, because the math confirms the message matches whatever key you check it against — genuine or fake. That is why this guide spends as much time on sourcing and fingerprinting the key as on running the check itself: the verification is only as trustworthy as the key behind it.

The tools you need

PGP verification needs one piece of software and two inputs. The software is an OpenPGP implementation, and which one you pick is purely interface preference — both do the identical check underneath:

• Windows: Gpg4win, which includes the graphical Kleopatra.
• macOS: GPG Suite (GPGTools).
• Linux / Tails: GnuPG is preinstalled on most systems; run it from the command line.
• Android: OpenKeychain, for the rare times you verify on a phone.

The two inputs are the operator's public key and the signed message you want to check. Install one of the tools before you go looking for any address, so the check is ready the moment you need it. The community's collaborative reference, the Darknet Bible, documents the same Kleopatra and GnuPG steps from the user side if you want a second walkthrough alongside this one.

How to verify, step by step

The process is short once the tooling is in place, and it is the same logic whichever tool you use. The graphical and command-line paths run side by side below.

1. Get the public key from independent sources. Obtain the operator's key from two or more places that do not depend on each other — the market's Dread profile, its login page reached through an already-verified link, an established directory — so a single compromised source cannot hand you a false key.
2. Import the key. In Kleopatra, copy the whole key block (including the BEGIN and END lines) and use Tools then Import, or Notepad then paste. On the command line, save it to a file and run gpg --import market-key.asc.
3. Confirm the fingerprint. Note the 40-character fingerprint your tool shows (gpg --fingerprint on the CLI) and compare it against the fingerprint the operator published on an independent source. This is the step covered in detail below, and the one most people skip.
4. Fetch the signed address list, copying the entire block from -----BEGIN PGP SIGNED MESSAGE----- through -----END PGP SIGNATURE-----. A single missing or extra character will make verification fail.
5. Verify it against the imported key. In Kleopatra, paste into the Notepad and click Decrypt/Verify. On the command line, save the block to a file and run gpg --verify signed-mirrors.txt. Then read the result, as described below.

Only the addresses inside a validly signed message, checked against a key whose fingerprint you confirmed, should be treated as real. Everything else is appearance.

The step that defeats fake keys

This is the step that turns PGP from theatre into protection, and it is the one most guides bury. The attack it defeats is simple: anyone can generate a PGP key bearing a market's name, sign a message full of phishing addresses with it, and publish the fake key and the fake message together. Run your check against that key and it reports a cheerful "Good signature" — because the message genuinely matches the key, which is genuinely a forgery. The signature math is working perfectly; it just vouches for the wrong author.

The defense is the fingerprint, the 40-character hexadecimal string that uniquely identifies a public key. After importing a key, compare the fingerprint your software displays against the one the operator has published on an independent, trusted source — its Dread profile, a different verified directory — character for character. If every character matches, you have the real key and its signatures mean what they claim. If they do not match, someone handed you a fake key; do not proceed until you find the genuine one. Cross-referencing the addresses alone is not enough, because a phishing address can propagate across several sites at once; the fingerprint is what anchors the whole chain of trust to the real operator.

Reading the result

The output of a verification is a short verdict, and knowing how to read each one keeps you from talking yourself past a warning. Kleopatra shows these in green or red; the command line states them in plain text.

The "this key is not certified with a trusted signature" notice that often accompanies a good result is normal: it refers to the web of trust, not to the validity of the signature you just checked, and can be ignored once the fingerprint is confirmed.

Why a signature beats a padlock

On the ordinary web, trust comes from a certificate authority: a third party vouches that a site is who it claims, and the browser shows a padlock. Onion services work differently, and arguably better. A current "v3" onion address is itself derived from the site's public key, so the address and the identity are mathematically bound, and there is no separate authority to compromise or trick into issuing a false certificate. PGP verification extends that same idea to the operator's announcements, letting them sign statements only their private key could have produced.

The practical upshot is that you are not asked to trust an intermediary at all. You check the math directly, against a key you sourced and fingerprinted yourself, which removes the entire class of attacks that target certificate authorities. A padlock says someone vouched for this site; a valid signature says the keyholder wrote this exact message. The second claim is stronger, and on the dark web it is the only one on offer.

When verification will not save you

Here is the limit worth stating plainly: PGP confirms that an address is authentic, not that the market behind it is safe. A genuine, correctly signed market can still exit-scam tomorrow or be quietly operated by police, exactly as Hansa was in 2017 while Dutch authorities ran it. Verification defeats phishing; it does nothing against a market's own collapse, an exit scam, or a covert seizure.

There is also a freshness trap. Operators publish a signed canary that is valid as of a date, and during a real address rotation a canary can be days stale — still cryptographically "valid," but no longer current. Read the date on the signature rather than treating "valid" as "current," and be wary of a canary that has stopped updating on its usual schedule, which the community treats as a silent alarm that a site may be compromised. Use verification for exactly what it does, and keep the closed-market record in mind for what it cannot.

The common mistakes

Most failed verifications are not cryptographic; they are procedural. A short list accounts for nearly all of them:

• Skipping the fingerprint check. Importing a key and verifying against it proves nothing if the key itself is fake. This is the mistake that quietly defeats everyone who makes it.
• Sourcing the key from the same page as the address. A poisoned source that supplies both the key and the message can validate its own forgery. Always source the key independently.
• Copying the signed block imperfectly. A missing BEGIN line, a dropped character, or an added space breaks the signature; copy the whole block exactly.
• Treating "valid" as "current." A stale-but-valid canary can point at a rotated address; check the date.
• Verifying once and trusting forever. Addresses change; the check is per-visit, not one-time.

Common questions about PGP verification