Verifying a Zion Market address

You never have to trust this page on faith. Two checks, run together, make a forged address practically impossible to pass off as real.

1. The signed mirror list

Zion signs its list of current addresses with the market PGP key, the same key printed on its Dread vendor-council profile. To check it, import that public key into your local GnuPG once, then verify the signed message any time an address behaves oddly:

gpg --import zion-market.asc
gpg --verify mirrors.txt.asc mirrors.txt

A line reading Good signature means the list was produced by the holder of the market key and has not been altered since. If the address you are about to visit is not inside that verified list, do not enter your password. A clone cannot forge this signature without the market's private key.

Verify the key fingerprint the first time you import it, against a second source such as the Dread post. After that first pin, every future check is automatic.

2. The login header echo

Every genuine Zion login page prints the onion address it is served from, in the page header and inside the anti-phishing image. Before you type your password, compare that printed address to the one in your Tor Browser bar. They must match character for character. A phishing clone can copy the layout but cannot serve the correct address in both the bar and the header while secretly pointing you somewhere else.

Putting the two together

The signed list proves the address is one Zion published. The header echo proves the page you are looking at is actually served from that address rather than a look-alike. An attacker would need both the market's private key and control of the real onion to defeat both at once, which is the same as not being an attacker at all.

No genuine login ever asks for your recovery mnemonic to sign in. A page that requests your mnemonic during login is a phishing clone. Close it.

Last reviewed 2026-07-12.