TorZon Link: Verified Onion URLs and Tor Mirrors

A TorZon URL is a Tor v3 onion address, 56 characters of base32 followed by .onion, generated from the market's public key. Unlike a normal web address, nobody registered it and nobody can seize it at a registrar; it is the key. That is also why you cannot shorten it or "remember roughly how it starts": every character is load-bearing.

The mirror URLs point at the same market behind a different key pair. Switching between them changes the route, not the destination. They exist for one reason: when one onion address is buried under a denial-of-service flood, another keeps answering. Bookmark all three in Tor Browser so a bad day for one link is not a bad day for you.

Every so often, the market operator signs a short statement with their PGP key: the current date, the current addresses, sometimes a line confirming they haven't been compromised or coerced. That's the canary. The signature is what makes it useful, since anyone can copy the text, but nobody without the private key can forge a valid signature over it.

That's why "checked against the canary" means something different from just "checked." A canary that stopped updating weeks ago is a warning on its own, independent of whether the address still loads. We treat the canary's date as part of the verification, not an afterthought.

1. Install Tor Browser from torproject.org, the only source worth trusting. A regular browser cannot open a .onion address at all.
2. Paste one TorZon onion link from the table above into the address bar and give the circuit five to fifteen seconds to build.
3. Before you type a single credential, confirm the operator's PGP signature; once you have signed in, check that your own anti-phishing phrase appears. If either is missing, close the tab.

New to signature checking? The PGP verification guide walks through it, and Tor Browser setup covers the rest.

Clones lean on one lazy habit: people read the first six characters of a TorZon Tor link and stop. So a clone operator grinds out a vanity address that also starts with "torzon", then copies the real site pixel for pixel. The layout is trivial to fake. The private key behind the operator's signature is not.

So the defence is dull and reliable:

• Match the full 56-character link against this page, character by character.
• Run any address you are unsure about through the onion link checker before you enter credentials.
• Never take a TorZon link from a private message, a paste site, or a forum post, even from someone you trust. Compromised accounts hand out clone links for a living.

There is no public rotation schedule, and that is deliberate: a predictable change would give clone operators time to stage a fake in advance. When the TorZon link changes, this page is updated and the news feed notes it, while the status page tracks which addresses are reachable. Trust the verification date printed here, not what you remember from last month.

Bookmark the TorZon link inside Tor Browser itself, not in your regular browser and not in a notes app that syncs to the cloud. A bookmark in Chrome or in a synced note is a record tying you to the address on a device and a service that has nothing to do with Tor, which defeats a chunk of the point of using Tor in the first place.

Re-verify after any gap longer than a few weeks. An address you haven't used in a while is exactly the kind of thing worth matching against this page again before you trust it, since a rotation or a compromise could have happened while you weren't looking.

A circuit failure in Tor Browser looks identical to a dead market from the address bar, so that's the first thing to rule out, not the address itself. From there, check the status page for our latest reachability check and the news feed for a rotation announcement, then wait and retry after a few hours: onion services recover from denial-of-service floods on their own more often than they get permanently taken down.

What not to do: don't go searching "torzon market link" on a regular search engine and click whatever comes up. Clone sites buy ads and grind SEO specifically to catch people in exactly this moment of impatience.