your account

The login page is on the market, not here

You can log in from any of the three addresses, and you will arrive at the same account from all of them. The login form is served by the market behind the onion, and the only difference between the three entries is which door the request came in through. Everything else, the username, the password, the 2FA check, the session you get, is identical whichever address you use.

The path, in four moves

1. Open one of the three addressesIn Tor Browser, pasted not typed. If the first one is slow, use the second. The account is the same behind all of them, so there is no reason to wait out a bad entry.
2. Wait through the queueThe access queue page with the do not refresh note is the market’s front desk. It can take a few minutes at busy times. A lookalike does not have a queue worth waiting for.
3. Find the account menuOnce the storefront loads, the top corner of the page holds the account area. The Log in entry is there, next to the register option if you are new.
4. Credentials, in orderUsername, password, and the 2FA code if the account has one. Then the account dashboard: wallet, orders, feedback, settings. If that is not what opens, you were not on the market.

First login, what to do in the first ten minutes

Log in, then go straight to the settings area and do the two things that protect the account from you:

• Turn on 2FA and write the backup phrase somewhere physical. The setup shows a recovery phrase one time. A photo on the same phone as the 2FA app is one lost phone from a locked account. Paper, a different device, a password manager, any of those. The same phone as the app, not.
• Check the recovery email is the one you still have. The reset flow lands there, and a dead inbox is a second lock on the same door.

After that, look at the wallet, the open orders, and the feedback. Ten minutes like this turns a nervous first login into a known environment, which is exactly what the next login should feel like.

Forgot the password

The reset goes through the recovery email you registered. Request it from the login form itself, not from a link someone sends you. The email contains a reset link with a short lifetime; open it in Tor Browser on the market, set the new password, done. Two habits worth keeping while you are there:

• Do not reuse the old password with a digit changed. A lookalike that caught the old one is waiting for the obvious mutation.
• Make the new password unique to the market. If your email password and your market password are the same, one breach hands the other to the same person.

Lost the 2FA phone

This is the scenario the backup phrase exists for. The login form has a path for accounts that can not produce a code, and it asks for the recovery phrase written at setup. If you saved it, the account is a form fill away. If you saved it as a screenshot on the phone you lost, the phrase goes through the market’s support flow, which is slower and asks more questions, and the questions are there because the support team has no way to verify a screenshot from inside the dead phone. The phrase on paper was the whole point.

The habits that keep an account

• A unique password, long enough to be boring. The market can lock an account after repeated failed logins, which is good for you and also means a brute-force habit of yours is the easiest attack that will ever be tried.
• Log in from Tor, only. The session is tied to your circuit, and a circuit is rebuilt all the time, so the market never needs to remember your IP. Logging in through a clearnet proxy hands the proxy a copy of the login in exchange for nothing.
• Close the tab like you mean it. On a machine you do not control, the session outlives the tab you think you closed. The account area has a sign out, and it takes one click. Take it, on borrowed machines especially.
• Recognize the real dashboard. After login, the account area, the wallet, the order list. A page that asks for your password and then shows a balance you do not recognize is telling you something. Close it, switch address, and start from the verify checks.

Two devices, one account

Logging in on a laptop and a phone at the same time is normal and safe. Sessions are independent, signing out on one does not sign out the other, and the market does not treat a second device as a theft. The one thing that looks like a problem and is not: a new login notice. It is the market telling you a new device joined, which is useful information when it surprises you and nothing when it does not.