before you trust it

Check the address before you trust it

The scammers know what you know: a real onion address is long, ugly, and impossible to remember, so of course they will hand you one that looks real. Their addresses are usually real onions too, serving real pages, run by real people who just are not the market. The difference between a lookalike and a genuine Awazon Market onion address is a handful of characters, and the checks below find exactly that handful. Run them in this order, and they take two minutes at most.

Step one: the length

Every current version 3 onion address is exactly 56 characters before the .onion, and 63 characters with it. All three Awazon Market addresses are 63 long, counting the dot.

To check: select the part of the string before .onion and count. In most editors the status line does it for you, and in a terminal it is one command. Shorter or longer is a dead end, no matter how confident the page around the address looks. A 55-character address is not a truncated real address, it is a different one.

Step two: the alphabet

Version 3 onions are base 32, which means the 56 characters come from exactly one set: the letters a through z and the digits 2 through 7. Nothing else.

• No 0, no 1, no 8, no 9. Those four digits do not exist in the alphabet, and an address containing one of them is not a v3 onion.
• No capitals. Onion addresses are lowercase; a capitalized string is someone else’s formatting, not a different case of the same address.
• No hyphens, underscores, dots in the middle, or spaces. The only dot in the whole string is the one before onion.

This check kills a surprising number of lookalikes, because the people who invent fake addresses do it by feel, and their fingers land on digits the real alphabet does not use.

Step three: the prefix

The market’s three addresses all start with the plain string awazon. Six letters, then the rest of the random-looking tail. That prefix is not decoration and not a coincidence; it is the first thing the market could do to make its own addresses recognizable, and the first thing a lookalike gets subtly wrong.

The common fakes:

• amazon... with the letters swapped, betting you will not read past the third character.
• awazonofficial..., awazonmarket..., or awazon2026..., where a second word is glued onto the prefix.
• A random 56 characters with no pattern at all, served by a page that looks 95 percent right.
• The genuine prefix followed by a tail that does not match, which is why step four exists.

If the string does not begin with exactly awazon and nothing else, stop. You do not need to finish the other checks.

Step four: the last six, after the page loads

The first three checks happen before you open anything. The last one happens after, and it is the one that catches the careful fakes. Once the market is loaded in front of you, read the last six characters in Tor Browser’s address bar and compare them, in order, against the last six characters of what you copied.

Why the last six specifically: the tail of an onion address is where the address is least guessable and where a lookalike is most likely to share the most characters with the real one while still being a different service. A match in the tail is not proof, but a mismatch in the tail is proof, and it is the mismatch you are hunting. Six characters is enough to read slowly and compare without losing your place in a 63-character string.

Do it every time, even when you just copied from a page you trust. Copying is reliable. Pasting is reliable. The step in between, where a browser autocomplete or a previous search result gets mixed in, is not.

Where fakes come from

Knowing the supply side makes the checks easier to take seriously:

• Forum and chat ads. A pinned post or a private message with a fresh address, usually announced as a move or an update. The market announces rotations from inside the market itself, not through strangers.
• Old pages. A directory from two rotations ago, still cached in a search result, still serving addresses that stopped loading the day the rotation happened.
• Edited bookmarks. A browser profile that picked up an extra character in the address during some long-ago paste, now reusing it faithfully forever.
• The queue-page trick. A fake that copies the real access queue so well that the wait itself becomes the confirmation. The queue proves you are at an onion that has a queue. Only the address checks prove which one.

A checksum for the paranoid

Beyond the four checks, the market publishes the fingerprint of its hidden service key, a short hash that the onion address is derived from. If you already trade on the market and want a cryptographic answer instead of a visual one, compare the fingerprint you can read on the market’s own pages against the one the address produces in your Tor Browser. The four checks above catch everything the fingerprint catches, faster, for everyone. This one is for the days you want the extra layer anyway.