Verify the link, then trust it
Trust in this niche rests on one thing: a PGP key that has been checked. The key below belongs to the market. Matching its fingerprint takes a minute. Once it matches, an address from the set above stops being "some nexus somewhere" and becomes the one you came for.
The key
The key is an RSA 4096 key, created 2023 11 21, under the user id "Nexus Market". Its fingerprint, in groups:
A7D6 2EA2 8378 8437 FDD4 AFC5 5344 9F72 06C1 1BEFOne detail worth keeping. The key was created in late November 2023, but the first public address of the market dates to February 2024. The operator set up verification before the market went live, not after the first complaint. A market that publishes a key it has been using for months is not one that invented the key to match today's address.
The signed mirror list
Alongside the key, the market publishes a signed message that lists its mirror addresses. The signature is made with the key above, so a message that verifies is a message the operator stood behind at the moment of signing. The signed list is shorter than the live set of three, and that is by design, not a bug. The live addresses have rotated since the message was signed. When the market publishes a new address, it first appears in the signed list, and only later spreads to forums and posts. So the signed list is a floor of what was real, and the live set is what is real now. Both can be true at once.
The ten second check
For the reader who does not run GPG on a daily basis, the fast path is the ends of the string. Copy the address, paste it into Tor Browser, then compare the first six and the last six characters against the table below. The addresses sit in the strip at the top of the page, each with a copy button.
| Address | First 6 | Last 6 |
|---|---|---|
| nexusb2l7njnf2i5dm3ushgrwayuicpofzcs4bkknpzfdwwbwbgqwtyd.onion | nexusb | gqwtyd |
| nexusma2iyspdg2vv5zjk5wgrs4pkmxn3bvuokjtt3wcfudzqfhb3wyd.onion | nexusm | hb3wyd |
| nexusabcdokpdgsnsxmyfebtdz2p3clqp663qwg4frvkdnmj5plg75id.onion | nexusa | lg75id |
Two matching ends is a strong filter, not proof. The one sign that overrides everything else is the check screen itself: the page that reads, word for word, "Checking your browser before accessing Nexus Market". A clone that matches the first and last six but skips that exact screen is still not the market. The wording is the part that is hard to copy by hand.
The full GPG pass
- Import the keyRun
gpg --importon the public key, or load it into Kleopatra on desktop, or OpenKeychain or Keystore on Android. You want the key in your keyring before you check anything against it. - Compare the fingerprint in groupsRead the imported fingerprint group by group, A7D6, then 2EA2, then 8378, and so on, against the line above. Comparing it as one long blob is how a single swapped character slips through. Group by group, ten groups, is the check that catches the difference.
- Get the signed messageCopy or download the signed mirror list from the Signature button above. You need both the message and its signature to verify anything.
- VerifyRun
gpg --verifyon the message with its signature. The line to look for is "Good signature from Nexus Market". That one line is the whole point: it means the message was signed by the holder of the key you just matched. - If the signature is badA "BAD signature" means the message does not come from this key. Do not log in on that page. Close it, and move to the next address. A bad signature is not an error to debug, it is a reason to leave.
If the fingerprint does not match
Close the tab. Do not type a PIN, do not answer a pop up, do not confirm a recovery phrase. A key that carries the name "Nexus Market" but does not end in the groups above is someone else's key wearing the right label. The market's key is the one that matches all ten groups, full stop.
For the terms used here, PGP, fingerprint, signature, the definitions are on the glossary. For the forum thread where the market posts updates, signed with this same key, the path is on the Dread page.