Your first login

The first login has a few steps that can surprise a newcomer. Here is the whole flow so nothing looks alarming.

1. The anti-DDoS challenge

Before the login form, the market often shows a challenge page to filter automated floods. Solve it once. If it loops, the problem is your circuit or cookies, not your answer; get a fresh Tor identity and try again. See the captcha guide.

2. The address echo

The login page prints the onion address it is served from. Before you type your password, compare it to your browser bar. This is your phishing check, and it takes a second.

3. Credentials and PGP 2FA

Enter your username and password. If you enabled PGP two-factor, the market shows an encrypted challenge; decrypt it locally and paste the code back. Only then are you in.

If any step asks for your recovery mnemonic, stop. That is never part of a normal login.

Last reviewed 2026-07-14.