💬 Secure Communication

Any market's internal messaging is convenient, but it isn't automatically private — treat anything sensitive as needing PGP encryption before it leaves your side of the conversation, so that even a full database compromise leaves your messages as unreadable ciphertext rather than a searchable record. The workflow is the same every time: pull the vendor's public key from their profile, import it into your client (Kleopatra on Windows, GPG directly on Linux or Tails), write the actual message in a plain text editor first, encrypt that text to the vendor's key, and only then paste the resulting ciphertext block into the market's messenger. Composing directly inside the market's message box skips that separation and risks sending something unencrypted by accident — write it somewhere else first, every time, as a habit rather than a one-off precaution.

Encryption protects a message from being read by anyone other than the intended recipient; it does nothing to stop the content of the message itself from identifying you if you write it carelessly. Never include personally identifying details in any message, encrypted or not — a pseudonym only, never a real name, and no specific dates, cities, or personal circumstances that narrow down who you are. Writing style leaks too: distinctive phrases, unusual spelling habits, or a recognizable tone can, in principle, be matched against how you write elsewhere online, so keep transaction messages plain and functional rather than personality-forward. Shorter messages focused strictly on the transaction leave less material to analyze in the first place, and there's rarely a reason to spell out anything explicitly beyond what the listing itself already establishes as context.

Build reusable templates for the messages you send repeatedly — initial contact with a new vendor, a shipping address block, order confirmations, dispute correspondence — rather than composing each one from scratch under time pressure, which is exactly when mistakes like an accidental plaintext send happen. The address template should follow the standardized format from the address encryption guide, containing only what's essential for delivery. Pre-encrypting a template ahead of time, when you have your keys and clients set up calmly, removes the pressure-induced error rate entirely. Store the plaintext versions of these templates in KeePassXC's notes field, alongside your passwords, so they're both encrypted at rest and available whenever you actually need them.