PGP, set up once

PGP does three jobs on a market: it verifies signed announcements, it encrypts your shipping details to a vendor, and it can prove your identity at login. Set it up once and it pays off every session.

Generate a key

gpg --full-generate-key   # choose RSA 4096 or ed25519
gpg --armor --export "you@handle" > mypub.asc

Keep the private key on the machine you use for the market, protected with a strong passphrase. Never paste a private key into any web page.

Verify signed lists

Import the market key once and verify any signed mirror announcement, as described on the verification page. A Good signature is proof the message came from the market.

Encrypt to a vendor

When you place an order, encrypt your address to the vendor's published public key so that only they can read it:

gpg --recipient VENDOR --armor --encrypt address.txt

Paste the resulting block into the order. If a market feature offers to "encrypt for you" server-side, prefer doing it locally; the point of PGP is that the plaintext never leaves your machine.

PGP login (2FA)

Enable PGP two-factor authentication in your account settings. At login the market shows an encrypted challenge; you decrypt it locally and paste back the code. An attacker with your password still cannot log in without your private key.

Test your setup by encrypting a note to yourself and decrypting it back before you rely on it for anything real.

Last reviewed 2026-07-11.