🔑 2FA Setup Guide

TorZon's own 2FA runs on PGP: the market encrypts a challenge to your public key at every login, and you decrypt and enter it to get in, so the setup below assumes you already have a keypair from the PGP verification guide or the key generator. Some buyers layer a second, TOTP-based authenticator on top for account-panel access where the market supports it — if you go that route, use an offline app like Aegis (Android, open-source, encrypted local backups) or KeePassXC (desktop, doubles as your password manager) rather than a cloud-synced option like Google Authenticator or Authy. A cloud-synced authenticator ties your second factor to a Google or cloud account that has nothing to do with Tor, which is a second attack surface you didn't need to create. A TOTP code is only valid for 30 seconds, generated from a shared secret neither end ever transmits again after setup — that's what makes it resistant to a captured login page in a way a password alone isn't.

Under Account Settings → Security → Two-Factor Authentication, TorZon shows a QR code plus the same value as text — useful because most authenticator apps on a Tails or Whonix setup won't have camera access to scan anything, so you'll be typing the secret key in by hand. Add the entry to your app and it starts generating 6-digit codes immediately; enter the current one back into TorZon to confirm the pairing and activate 2FA. From this point, every login needs both your password and a fresh code — if either the market or your device clock drifts by more than roughly 30-60 seconds, codes stop matching, which is the most common "2FA is broken" support request and is fixed by syncing your device's clock, not by resetting the pairing.

Activation hands you a set of one-time backup codes — your only way back in if your 2FA device is lost, wiped, or the app's local backup gets corrupted. Write each one on paper by hand; typing them into a notes app or a password manager's free-text field defeats the point of having an offline fallback for when your devices are the problem. Store that paper somewhere physically separate from where you keep the recovery phrase from registration — one location compromise shouldn't take out both. Each code works exactly once: cross it out after use so you don't accidentally try a spent one during an actual emergency. If you burn through most of the set, generate a fresh batch in account settings rather than running down to the last one or two.