torlinkOpening a market for the first time
You need Tor Browser, a market address, and about thirty minutes. Here is the whole trip, in the order it happens.
1. Get Tor Browser
Desktop: torproject.org, the project that runs the network the address belongs to. iOS: Onion Browser from the App Store. Android: Tor Browser from F-Droid or the Play Store. Tails, the live USB stick, is the option for when the machine itself is not trustworthy.
The install is the only part that touches the clearnet. Everything after it happens on the network.
2. Open the address
Paste the full .onion into the address bar. Not a search bar, the address bar: a search bar is a clearnet trip with a detour. The first load can take a minute, because Tor is building a fresh path through three relays before the page even asks for data.
Try it with nexusma2iekjhhyenua3u4zlyfsj2ubwxr2nt6gdte5rvwukzze63fyd.onion, the first Nexus mirror. When the shop loads, the address bar shows the full onion. That bar is where the character check happens, and it happens before the password, not after.
3. Log in for the first time
Create the account with a password you do not use anywhere else, on any site. The market's login form is the only page that should ever see that password. If the market asks for PGP, do the setup in the first session, while the screens are fresh: a key pair generated at 1 a.m. after the third reload is a key pair that ends up in a notes app.
On markets like Nexus, the login captcha carries the onion's fingerprint in the image. Read it, compare it to the address bar. Two sources, one address, or the page is lying about where it is.
4. Put coins in
Deposit to the address the market shows after login, one fresh address per deposit. Monero settles fastest and carries the least metadata; Bitcoin is fine where confirmations are the point. The first Crown mirror is crowncahzxbrm4rgqqkx7yhmwkie7ompgqocrjayoqos2fsofddeigad.onion if you want a second one open in a tab. Start with an amount you can afford to be patient with, because the first withdrawal is the real test of the round trip.
5. Place a first order
Small, from a vendor with a long history. Read the escrow terms once, fully. Confirm on delivery, let escrow release, withdraw. The round trip is the lesson; the order size is a decision you make after it.
On a phone
The same rules apply with more things going wrong. Keyboard typos in the address bar are the top source of fake-shop visits on mobile: paste, never type, and run the character check like you did on desktop. A market that loads on a phone is the same market that loads on a laptop, and the check is the same check.
If you want a second example, the first TorZon mirror is torzon4v7bcakvo7qikdfknewj4dlr44hkyv4jyfrkl7ci3zqn76kiid.onion. Note the queue page before the shop: that is normal for TorZon, and the absence of it is what you check for.