The Tor Browser Manual defines three security levels — Standard, Safer, and Safest. For Drughub and any Tor-only marketplace, Safest is not optional: it disables JavaScript site-wide, which is the single biggest defense against fingerprinting and script-based attacks on .onion services.
The shield icon in the top-right corner controls all three. Pick based on what gets disabled — not the label that sounds nicest.
JavaScript on a .onion page can read your screen resolution, enumerate installed fonts, track mouse movement, and fingerprint your browser — even through Tor. A phishing clone does not need a different URL to steal credentials; it needs a script that logs what you type into the login form.
Drughub runs as a Tor-only marketplace. The site expects users at Safest because that is the baseline for browsing hidden services where you handle account credentials and cryptocurrency balances. Running at Standard is like leaving your front door open because the lock is inconvenient.
Safest also limits what a compromised exit node or malicious relay can pull from the page rendering layer. Tor hides your IP; Safest reduces what the page itself can learn about your browser.
Do this once per Tor session, before pasting the onion address. The full access walkthrough lives in the access guide — this section covers only the security level.
Launch Tor Browser and wait until it connects. Click the shield icon to the right of the address bar. On some builds the menu label reads "Advanced Security Settings" instead of "Settings" — same panel either way.
Choose Safest from the three radio options. Tor will warn you that some sites may break. That is the point. Confirm the change.
Check that the shield reflects Safest. Only then copy the .onion address from our homepage and paste it into the address bar. If you already had a tab open at a lower level, close it and start fresh at Safest.
Some challenges need JavaScript. Switch to Safer, solve the CAPTCHA, then immediately switch back to Safest before clicking anything else on the page. Do not browse the market at Safer — not even for "just a minute."
Do not resize the Tor Browser window and do not install extensions. Both create a unique browser fingerprint that Tor's network layer cannot hide. If the window looks too small, live with it — privacy beats screen real estate.
Safer feels fine until a script you never noticed runs in the background. Treat Safer as a 30-second CAPTCHA tool, not a browsing mode. Back to Safest the moment the challenge clears.
Opening Drughub at Safest, dropping to Standard to load an image, then logging in defeats the purpose. Pick Safest at the start and keep it there until you close Tor.
Android Tor Browser has the same three levels. Most people leave it at Standard. See our Tor on mobile guide for setup and why desktop is still better for market sessions.
Tor hides where you connect from. Safest limits what the page learns once you arrive. You need both. A VPN does not replace either — see the VPN and Tor guide for how those layers fit together.
Before every Drughub visit: Safest enabled, window at default size, no extensions, onion address copied from the homepage or a PGP-verified mirror list. The access guide security checklist covers the rest.
Official documentation behind the recommendations on this page.