How to Verify a Torzon Link
Verifying a Torzon link is the single most valuable skill on the darknet, and it takes about two minutes once your key is set up. The principle is simple: a clone can copy everything you see, but it cannot forge a cryptographic signature it does not have the private key for. So you check the signature, not the look.
The process, four steps
- Copy the PGP-signed mirror announcement published by the Torzon team.
- Import the marketplace public key into GnuPG or Kleopatra, then confirm its fingerprint matches the one pinned on Dread.
- Verify the signature over the announcement — a good signature means the message genuinely came from the key holder.
- Compare each onion URL in the verified announcement against the Torzon mirror in our table, character by character.
What are the warning signs of a fake? An address you received in a forum direct message or an email rather than copied from a signed list. A page that asks for a real email, personal details, or payment outside the platform's own escrow. A signature that fails verification, or a public key whose fingerprint does not match Dread. Any one of these is a stop signal. A real Torzon link never needs your PII and always carries a signature that checks out.
Cross-reference the warrant canary too. The marketplace publishes a signed canary every 72 hours. If the canary is current and the mirror signature is valid, both independent checks point the same way — toward a genuine link. Two signals agreeing is far stronger than one. For the full walkthrough of key generation and signature checking, see the Torzon PGP verification guide.
Let me walk through how a phishing clone actually works, because understanding the attack makes the defense obvious. A scammer registers an onion address that looks close to a real Torzon mirror. They copy the marketplace's login page exactly — same colors, same layout, same logo. They seed that address into search results, forum posts, and paste sites. You arrive, you type your username and password, and the clone records both. Then it quietly forwards you to the genuine site, so the login "works" and you suspect nothing. Now the scammer has your credentials. The clone never had the marketplace's private PGP key, though, so it could never produce a valid signature over its own address. That gap is the whole defense. Check the signature and the attack collapses, no matter how perfect the page looks.
This is why "it looks right" is worthless as a test and "the signature verifies" is everything. Two onion addresses can be visually identical down to the pixel; only one carries a signature that matches the key pinned on Dread. The verified Torzon link on this page is the one that passes that test. Make signature verification a reflex, the way you check a lock before leaving home, and clones stop being a threat. Skip it once and a perfect-looking page is all it takes.