Essential: OPSEC is procedural, not magical. Update, isolate, verify, wipe — every session, no exceptions.
Before you connect
Update Tor Browser, set security to Safest, disable extra extensions, close clearnet tabs tied to real identity. Use a dedicated OS profile or live system, separate usernames and passwords per service, and a password manager with a memorized master passphrase.
PGP and communications
Generate keys offline, publish only the public key, encrypt every sensitive string by default. Verify vendor keys against two independent sources and sign continuity statements.
Financial hygiene
Fund a private Monero wallet, churn once, fund escrow per order. Never pay outside escrow, never finalize early for strangers, record TX keys privately for disputes — never in clearnet notes. See crypto analysis.
Session checklist
- Tor updated · Safest mode · New Identity.
- Address matched 56/56 chars via verification methodology.
- PGP verified · XMR churned · escrow funded.
- Logout · wipe session · store notes offline.
What never to do
- Never open onion links in a regular browser.
- Never install software a page suggests.
- Never reuse passwords or PGP keys across services.
- Never discuss sensitive matters on clearnet channels.