How to Verify a Torzon Mirror
Verifying a Torzon Market mirror takes under two minutes, and it is the single habit that separates the real marketplace from a clone. The address proves nothing on its own; the operators' signature over the address proves everything. Run this check before you log in to any mirror:
- Copy the PGP-signed mirror list published by the Torzon team.
- Import the marketplace public key into GnuPG or Kleopatra.
- Run a signature verification against the signed message and confirm it reports a good signature.
- Match the mirror you intend to open against the verified address — character for character, all 56.
- Confirm the address is lowercase Base32 ending in
.onion; reject anything shorter or with odd characters.
- Check the warrant canary is current — published within the last 72 hours with an intact signature.
- Compare the key fingerprint against the one pinned on Dread, not a key handed to you by the site you are checking.
- Bookmark the trusted signing source, not the raw address, since Torzon Market mirrors rotate and a signed source does not.
The logic is plain. A phishing clone can register a string close to a real Torzon Market mirror and copy the login screen exactly. What it cannot do is forge the operators' PGP signature over the correct address. That is why each mirror on this page is re-verified every rotation. Trust the signature, not the screenshot.
Why does verification matter so much for a marketplace rather than a regular site? Because the cost of loading the wrong address is your credentials and your funds, handed to whoever built the clone. A two-minute signature check is cheap insurance against that. Skip it once and you are guessing. Do it once and every future check is fast, because the key is already imported.
One more guard worth building into the habit: bookmark only the signed source, never a raw address pasted from search results or a forum reply. Clones thrive on copy-paste. Someone reads a thread, grabs a string that looks right, and never checks the signature — that is precisely the gap a phishing operator counts on. The signed source moves with the rotation; a bookmarked raw address goes stale and, worse, can be poisoned by a lookalike that ranks well in search. Treat the operators' PGP key as the anchor and everything else as something to verify against it. The padlock you trust is the signature, not the page design. For the full key-handling walkthrough, see the Torzon Market security guide.