The login page, without the surprises
Between the onion address and the login form there are three screens. Knowing them in advance means none of them stops you. And the rule that matters more than any of them: the address is checked before you type a single character, not after.
The three screens before the form
- Checking your browser before accessing Nexus MarketThe exact title of the first screen. It says the process is automatic and to allow up to 30 seconds. Let it. Do not refresh in the middle, a refresh restarts the check and adds nothing.
- DDoS Protection - Nexus MarketA short challenge page. A couple of seconds, then it passes through. It is a gate, not a login, and it does not ask for anything yet.
- The storefrontThe dark interface with the NEXUS logo, category navigation, and the login and register forms. This is the first screen where you actually enter anything.
If you reach the storefront and the first two screens felt right, the routing is doing its job. What you type next goes to the market, not to a page that merely looks like it.
The account model
An account on the market is identified by a code you wrote down, not by an email address. There is a PIN for day to day logins and a recovery mnemonic, the long phrase written on paper when the account is created. The mnemonic is the thing that actually identifies the account to the system. The PIN is the fast path. The mnemonic is the back door that only you should hold.
PGP second factor is available on top of that. With it, a login can be confirmed by a code signed with your own PGP key, so possession of the key is part of getting in. It is optional, but it is the second factor that does not depend on a phone or an email provider deciding to send you something.
The honest part: if the mnemonic is lost, recovery goes through the mnemonic. There is no "forgot password, check your email" path. Support can talk through the details, but the recovery itself runs on the phrase on paper, and nobody can hand it back to you from memory.
Before you type anything
- The full .onion is in the address bar. The first six and last six characters match the table on the links page.
- It is a .onion, not a .com or a .net. A lookalike domain is phishing by definition, and the security page walks through how clones are built.
- A popup about "account migration" that wants your seed: close the tab. The market does not migrate accounts through a pop-up.
- The PGP block on the page matches the key on the verification page. If the fingerprint does not line up, do not continue.
- In doubt, close the tab and open a different one of the three addresses. A fresh load through a different string is the cleanest way to be sure you are on the real thing.
Forgot the PIN
Too many wrong attempts freeze the login for a while, not for a day. The freeze is a lockout, not a loss. When it clears, the way back in is the recovery mnemonic, the phrase written down at creation. Support will ask for details to help, but it will never ask for the seed. A support conversation that reaches for the seed has crossed a line the market itself never crosses.
The market never asks for your seed phrase. Not in login, not in support, not in an email that looks like support. If a page wants the seed, it wants your money.