Everything you need before opening the market: install Tor, tighten security settings, grab the onion address from our homepage, and connect without rookie mistakes.
Work through each step in order. Skipping the security settings is how most people get burned.
Tor is the only browser that opens .onion addresses. Chrome, Firefox, and Safari will not work — period.
Download only from the official source. Fake installers bundled with malware show up constantly in search results.
Official Tor Project Website →Windows: Run the .exe installer, choose installation folder, and launch Tor Browser from the created shortcut.
macOS: Open the .dmg file, drag Tor Browser to Applications folder. Right-click → Open for first launch.
Linux: Extract the .tar.xz archive, navigate to the folder, and run ./start-tor-browser.desktop.
Set Tor Browser to Safest before opening any .onion site — required for Drughub. Full walkthrough: security levels guide.
Click "Connect" to join the Tor network. Initial connection takes 10-30 seconds as your browser establishes encrypted circuits through relay nodes.
If connection fails, your ISP may be blocking Tor. See the Tor bridges guide for obfs4 and Snowflake setup.
Paste the onion address into Tor Browser's address bar and press Enter. First load often takes 15–45 seconds — that is normal.
Bookmark the page inside Tor Browser (not in Chrome or Firefox). Next visit will be faster.
Once the market loads in Tor Browser, registration takes a few minutes. Get these steps right the first time — there is no email reset if you lose your recovery phrase.
Do not click Register until the homepage has finished loading. A half-loaded page can throw errors or drop your session. First visit often takes 15–45 seconds over Tor — that is normal.
Click Register and choose a username that cannot be linked back to you. No real name, no handle you use on Reddit or Twitter, no variation of an email address. Treat it like a throwaway identity.
Use a password you have never used anywhere else — not Gmail, not Reddit, not your bank. A password manager works fine as long as it is not synced to a cloud account tied to your real identity. Aim for 20+ random characters.
Drughub will show a mnemonic recovery phrase during registration. Copy it to paper before you close the tab or navigate away. There is no "forgot password" email. Lose the phrase and the account is gone permanently.
Store the paper somewhere that is not next to your computer. A locked drawer beats a sticky note on your monitor.
Two-factor authentication on Drughub typically uses PGP — you upload your public key, and every login requires decrypting a challenge message. Phishing sites cannot complete this step. See the FAQ for details on setting up PGP-based 2FA.
Before you deposit any funds, log out and log back in once. Confirm your password works and your 2FA challenge decrypts correctly. Better to catch a typo now than after you have sent Bitcoin to the account.
Run through this list before you connect. Takes two minutes, saves a lot of trouble.
Never use a work laptop, school network, or any device tied to your real identity. A separate user account is the minimum; a dedicated machine is better.
Connection troubleshooting — link won't load, pages are slow, Tor connects but the site is dead, or you get a server error. Most problems are Tor-related, not the market itself. Try these fixes before assuming the link is dead.
Page shows "Unable to connect" or spins forever.
Stuck at "Establishing a connection".
The site loads but shows a server error.
Pages take over two minutes.
CAPTCHA keeps reappearing after you solve it.
Broken layout, login form before anything else, or design that does not match what you saw before.
The site used to load fine but now your saved bookmark times out or shows "Unable to connect".
These trip up new users constantly. None of them require technical skill to avoid — just attention.
Tor → VPN breaks anonymity. If you use both: VPN first, then Tor. Full explanation →
Optional hardening once the basics above are solid.
VPN before Tor only — never the reverse. When it helps, kill switch rules, and provider risks: VPN and Tor guide.
Safest mode, window size, extensions, and CAPTCHA exceptions: security levels guide.
How to verify an onion address with PGP: PGP verification guide.
Untrusted PC? Boot Tails from USB — amnesic Tor-only OS. Cover webcam, disable mic, never mix personal browsing with market sessions.
Perfect Tor settings will not save you from reusing a password or pasting a link you found on a random forum. Most compromises are operational mistakes, not software bugs.