PGP verification tells you whether an onion address actually came from Drughub admins — not from a forum post, a Telegram channel, or a Google result. Run through these steps any time someone sends you a "new mirror" or you are not sure the link is real.
Fake .onion sites look identical to the real thing. Same layout, same login form, same CAPTCHA. The only difference is who runs the server on the other end — and a phishing operator will capture your username and password the moment you type them.
Drughub admins sign their official mirror lists with a PGP key. If the signature checks out, the onion addresses inside that file are authentic. If it does not, throw the link away regardless of who sent it or how urgent they made it sound.
You need two things: a GPG program (GnuPG on the command line, or Kleopatra on Windows) and the official public key from Drughub. The key is usually posted on the market itself once you are already inside through a verified session, or distributed through channels the admins control.
Work through all four steps. Skipping the fingerprint check is how people import the wrong key and think a bad signature is good.
Download the admin public key as a .asc or .gpg file. On the
command line:
On Windows, open Kleopatra → File → Import, select the key file. After import, check the fingerprint against the value published by Drughub admins. If the fingerprints do not match exactly, you imported a forgery — delete it and find the real key.
Windows: Kleopatra (bundled with Gpg4win). macOS:
GPG Suite or Homebrew gnupg. Linux: gnupg is
usually pre-installed.
Admins publish a plain-text file listing current .onion addresses. It comes as two files: the
list itself (often mirrors.txt) and a detached signature
(mirrors.txt.sig or mirrors.txt.asc).
Download both from the same source. Never trust a mirror list that arrives without a signature file, or where the signature was sent separately by a different person.
Command line — run this in the folder where both files are saved:
A successful verification shows Good signature and the key ID of the admin
key you imported in step 1. Anything else — BAD signature, Can't check
signature, No public key — means the list is not trustworthy.
Kleopatra (Windows): Decrypt/Verify → select the .sig file →
Kleopatra checks it against your keyring automatically. Green check = good. Red = stop.
Open the verified mirror list and find the primary .onion address. Compare it character by
character with the address on our homepage. A v3 onion is exactly 56
lowercase letters and numbers, then .onion. No uppercase, no trailing spaces,
no missing characters.
If they match, you are good. Copy the address from the homepage, paste it into Tor Browser, and bookmark it inside Tor — not in Chrome or Firefox.
If they do not match, the homepage may have been updated since the signed list was published. Check the date on the signature and grab the current address from the homepage once you confirm it against a fresher signed list.
The file was modified after signing, or it was signed with a different key. Do not use any onion address from that file. Find a fresh signed list from a source you already trust.
You have not imported the correct admin key, or you imported a similarly named key from the wrong person. Delete unknown keys, re-import from the official source, and check the fingerprint again.
Admins rotate keys after compromises. Look for a newer key announcement on a session you already trust. An expired key signing a new mirror list is a red flag — wait for clarification from official channels.
The link is real but the connection is failing. That is a Tor problem, not a PGP problem. Work through the fixes in our connection troubleshooting section.
These are two different uses of the same technology. Verifying a mirror list confirms which .onion address is real. PGP-based two-factor authentication on your account confirms it is actually you logging in — the market encrypts a challenge with your public key, and you decrypt it with your private key.
Link verification uses the admin public key. Login 2FA uses your own key pair. Do not mix them up. For account 2FA setup, see the FAQ section on two-factor authentication. For Tor setup, see the access guide.