Fawkes Market Wiki

Fawkes Market Security — PGP, 2FA and Everyday OPSEC

Nobody is hacked on a darknet market; they are phished or careless. This page covers the three layers that protect a Fawkes Market account: two-factor authentication, verified links and basic operational security (OPSEC).

Layer 1: PGP two-factor authentication

PGP 2FA turns your account from "password-protected" into "key-protected". At every login, the market encrypts a one-time challenge with your public key; only your private key can decrypt it. A phisher with your password still cannot log in — which is why enabling 2FA is the single highest-value security step you can take.

1Generate a PGP key pair

Use a free tool: Kleopatra on Windows (part of Gpg4win), GPG Suite on macOS, or OpenKeychain on Android. Create a new key pair (4096-bit RSA or the default ECC), with a strong passphrase. Your username goes in the name field — a pseudonym, not your real name.

2Export the public key

Copy the entire public key block — from -----BEGIN PGP PUBLIC KEY BLOCK----- to -----END PGP PUBLIC KEY BLOCK-----.

3Add it to your account

In your Fawkes Market account settings, paste the public key and enable PGP two-factor authentication. The market will send a test challenge to confirm it works.

4Back everything up

Export the private key and store it somewhere safe and encrypted (a password manager attachment, an encrypted USB stick). If you lose the private key or its passphrase, the account — and its balance — are gone. There is no reset-by-email on darknet markets.

Layer 2: verified links only

Phishing clones are copies of the market on look-alike domains, promoted through ads, search results and forum spam. The defence is boring and effective: only ever open the market from a bookmark or the canonical list at fawkes.sc.

Layer 3: everyday OPSEC

Compartmentalise identities

Your market username appears nowhere else: not Reddit, not Instagram, not email. Cross-linking identities is the most common self-inflicted OPSEC failure.

Keep Tor Browser current

Updates ship security fixes. Let Tor Browser update itself and restart when it asks.

Encrypt sensitive messages

For anything that matters, use PGP-encrypted messages to vendors. Market private messages are good; end-to-end PGP is better.

Small balances

Deposit what you need, spend it, withdraw the rest. A market balance is working capital, not a savings account.

Prefer Monero

XMR hides sender, receiver and amount. If privacy is the priority, it is the payment rail of choice — see the payments guide.

Sensible delivery OPSEC

Order to your own address or a trusted drop — not "somewhere clever". UK vendors are expert at discreet domestic packaging; let them do their job.

FAQ

Do I need a VPN as well as Tor?
Usually not. Tor already anonymises your traffic; a VPN mostly changes who can see that you use Tor. A VPN alone (without Tor) can be useful for reaching clearnet mirrors on networks that block them.
Is 2FA really necessary if my password is strong?
Yes — because the realistic threat isn't password guessing, it's password theft via a phishing clone. PGP 2FA defeats the phisher even with your password in hand.
What if I lose my PGP private key?
Contact support immediately with proof of account ownership — but assume the account is lost. This is why step 4 (backups) exists.

Related wiki pages