A5 // Paste to typing it by hand

Fifty six characters of base32, no words, no rhythm, and a keyboard. This substitution introduces a human at the exact point where a single character decides who receives your password.

Awazon Market // onion addresses

The three strings below open the same market. The same account, the same balance, the same open orders sit behind each one. Copy a string, paste it into Tor Browser, and read the last six characters in the address bar before you type a password.

awazonozc4jwyrveu4473igv5ldt2hnccl2s7lerm2z27cvrc22e4uyd.onion
awazonth6ocz5cyos63czmhtsglqr7ydkdcc4lopux7nxbauoo2qmvyd.onion
awazonvaqbgkhirejon6qnlxcjibrhkqhzh2xb2lclc6t67vxhlvjkyd.onion

NOTHING HERE IS RANKED. THE ORDER IS THE ORDER THEY WERE WRITTEN IN.

Baseline

The address copied with the button and pasted into the address bar.

Substitution

The same address typed by hand, usually because it arrived as an image or was read off another screen.

What moves

A per character chance of error, concentrated in the middle of the string where nothing is memorable and where nobody proofreads.

Does not move

What a wrong address leads to. A typo does not produce an error page, it produces either nothing at all or somebody else's service.

Cost

Time, plus a real probability of arriving somewhere you did not intend on a string you believe you verified because you typed it carefully.

Verdict

Costs more than it moves. There is no reason to type an onion address that survives contact with the alternative.

IWhy this string in particular

A v3 onion address is fifty six characters of base32: lowercase letters and the digits two to seven. There are no words, so nothing corrects you. There is no visual rhythm, so your eye does not catch a break in a pattern. And the alphabet contains several pairs that look alike in most fonts, which is why the digits zero, one, eight and nine were left out of base32 in the first place, and why the ones that remain still cause trouble.

The middle of the string is where errors land and where nobody rereads. The beginning is checked because it spells something. The end is checked if you know to check it. The forty characters between are typed on autopilot.

IIThe two outcomes of a typo

Nothing resolves. Harmless, and by far the most likely result. You try again.
Something resolves. Much less likely by chance, and not a matter of chance at all when somebody has generated a near miss of a well known address on purpose and is waiting for exactly this.

IIIWhere the pressure to type comes from

Almost always a screenshot. Addresses circulate as images in chat groups and on forums, sometimes because the poster thought an image was safer, sometimes because an image cannot be scanned by a filter. An image cannot be pasted, so the reader types, and typing is the point at which the substitution happens. An address delivered as an image should be treated as an address you do not have.

IVWhat to do instead

01Use the copy button on this page. It puts the exact string on the clipboard with nothing added.
02Paste into the address bar. Do not edit it afterwards, not even to remove a space you think you see.
03Compare the last six characters after the page loads, as in record A2. Pasting removes typos, not clones.
04If a string only exists as an image, go and find it as text on a page you can copy from, or do not use it.

IN ONE LINE

Every character you type is a chance to arrive somewhere else. Pasting removes the chance entirely and takes less time.