Getting onto the real market

This is the chapter where care matters most. Almost everyone who loses something loses it here, to a fake login page, so slow down for these four steps.

Reaching Nexus is not hard. Reaching the real Nexus and not a lookalike is the part worth doing properly. Work through these in order.

Install Tor Browser from the source

Download Tor Browser only from the Tor Project's own website. Verify the signature the first time you install it, then raise the security level to Safest. A normal browser cannot open a .onion address at all, and a browser you picked up from a random link is not one to trust with any of this.

Copy a verified link, never type it

An onion address is fifty-six characters of deliberate nonsense. Copy one from the verified list at the foot of this page. Typing it by hand is exactly how people end up one character off on an address someone registered to catch that mistake.

Confirm the address on the login screen

When the login page loads, compare the onion in your address bar against the one printed on the page. Nexus shows its address inside the anti-phishing image and again in the header. A clone can copy the look of the login perfectly, but it cannot serve the correct address in both of those spots while pointing you at itself. If the two do not match, close the tab. Do not sign in and hope.

Set the account up carefully

Use a username you have never used anywhere else. Generate a long unique password in a local manager. Write the recovery phrase on paper and store it away from the machine. Turn on the PGP two-factor step. And remember, no real login ever asks you to type the recovery phrase, so a page that does is a fake.