How to access Nexus market in 2026

Go to torproject.org directly. Download the Tor Browser bundle for your operating system. The Tor Project publishes a GPG signature for every release — verify it using GnuPG before extracting.

Do not get Tor Browser from GitHub mirror links, third-party sites, app stores, or torrent files. Those distributions have been modified more often than you would assume. App store versions are unofficial. The thirty seconds it takes to verify the GPG signature is the cheapest risk reduction in this entire guide.

On Windows: extract the .exe and run it. On Linux: extract the tarball, run ./start-tor-browser.desktop. On macOS: mount the .dmg and drag to Applications. All three platforms install without administrator privileges.

Launch Tor Browser and wait for it to connect. First connection takes longer — thirty seconds to two minutes depending on your Tor circuit. Once connected, click the shield icon in the toolbar. Move the security level to Safest. This disables JavaScript globally, blocks most media formats, and kills several font-loading vectors that have historically been used in browser fingerprinting and deanonymization attacks.

Nexus renders correctly under Safest. It was built to work without JavaScript — all critical functions are server-rendered. Any page that breaks under Safest is a page you should not be logging into anyway. The Safest setting is not optional for serious use.

Go to the verified URLs page on this directory. Use the Copy button next to one of the four verified Nexus addresses. Paste it (Ctrl+V or Cmd+V) directly into the Tor Browser URL bar. Hit Enter.

Never type an .onion address by hand. A Tor v3 address is 56 characters of base32 — every character is cryptographically significant. One wrong character resolves to a completely different .onion service. That service may be a phishing clone that looks exactly like Nexus, collects your login credentials, and intercepts your deposits. The phishing risk on Nexus is real and active. Copy buttons exist for this reason.

Before you register, generate a PGP keypair dedicated to Nexus. Not the same key you use for email, not the same key you use for any other service. Fresh keypair, fresh pseudonym, fresh context.

The best place to generate keys is on a machine with no network access. Boot Tails OS from a USB stick and disconnect Wi-Fi and Ethernet before generating. Tails includes GnuPG out of the box. Alternatively, use Qubes OS with an offline vault VM — the vault never touches a network, which is exactly what key generation calls for.

Export only the public key (--armor --export). The private key never leaves the air-gapped machine or the encrypted persistent volume on Tails. Store the public key file on the same USB stick you use for Tails. Store the private key passphrase in KeePassXC, never in a text file.

A private key generated online is a key that may already be compromised. The ceremony matters. Do it offline.

Navigate to the Nexus registration page via the verified link you copied in step 3. Choose a username with no connection to your identity — not your name, not your handle from any clearnet platform, not a variation of anything you've used before. Nexus does not require an email address. Username + password is sufficient for registration.

Use a password of at least 24 characters, randomly generated. Store it in KeePassXC immediately. After registration, go directly to account settings and do both of the following before you do anything else:

• Upload your PGP public key (nexus-public.asc from step 4). Paste the full armored key block into the PGP key field. This unlocks PGP login — the platform encrypts a challenge with your public key; you decrypt it to authenticate. No password needed for subsequent logins.
• Enable TOTP 2FA. Scan the QR code with KeePassXC (or a dedicated authenticator). Store the backup codes in an encrypted KeePassXC entry alongside the TOTP secret. Losing both your TOTP device and backup codes means permanent account lockout.
• Set your PGP key as the default for message encryption. Every vendor message will then be encrypted to your key before leaving the server — even a full platform breach would not expose your order discussions in plaintext.

Buy XMR on any exchange. Withdraw immediately to a local Monero wallet — not back to the exchange's internal wallet, to a self-custody wallet you control. The official Monero GUI wallet works well on desktop. Feather Wallet is a lighter alternative with good privacy defaults. Both generate keys locally.

Wait for the withdrawal to confirm (Monero confirms in roughly two minutes). Once you have XMR in your local wallet, generate a fresh deposit address inside Nexus and send from your local wallet. That's the sequence: exchange → local wallet → Nexus. Two hops. Each hop breaks the direct link between your exchange KYC identity and your Nexus activity.

Monero's ring signatures obscure the sender in every transaction. But the first hop — exchange to local wallet — is still visible on the exchange's records. The second hop — local wallet to Nexus — is where Monero's privacy properties actually kick in. Both hops together make chain analysis close to impractical. One hop without the other is not the same protection.

Spend time in the Nexus marketplace before ordering anything. Look at vendor profiles. Nexus shows order count, completion rate, dispute rate, average response time, and account age. These signals matter far more than any number of positive reviews, which are easily gamed.

The minimum bar for a vendor worth considering: 50+ completed orders, account age over three months, dispute rate under 3%, and active presence in the Nexus forum. A vendor with 200+ orders and a 4.8 average over 14 months has earned a level of trust that no amount of "excellent" review text from a new account can fake.

Check the Nexus internal forum for any vendor you're considering. Vendor AMAs, dispute reports, and community feedback all live inside Nexus — you don't need to cross-reference Dread for basic reputation checks, though Dread remains useful for cross-market vendor tracking.

Your first order should be small. Not because the vendor is untrustworthy — you've done the due diligence in step 7 — but because learning the escrow workflow on a low-value transaction is far cheaper than learning it on a high-value one. Done.

When you initiate a 2-of-3 multisig order, Nexus generates an escrow address client-side. Three keys are involved: yours, the vendor's, and Nexus's. You fund the escrow address from your Monero wallet. Do not release funds until you've confirmed receipt. That's the single non-negotiable rule of multisig escrow.

If something goes wrong — wrong item, non-delivery, quality dispute — open a dispute inside Nexus. Both parties submit PGP-signed statements. Nexus staff arbitrates based on the signed messages. The 2-of-3 structure means the outcome cannot be forced by either the buyer or vendor unilaterally — Nexus holds one key and cannot act alone. This is what distinguishes multisig from the older centralized escrow model where a market going dark meant all in-escrow funds were lost.

Once you've completed one successful round-trip, the workflow is the same for every subsequent order. Scale at whatever pace makes sense. The discipline of testing small first is not a one-time thing — apply it whenever you try a new vendor or a new category.