Vortex Market access guide

Install Tor Browser

Go to torproject.org directly — not through a search engine result, which may surface mirror sites or promoted links. Download the stable build for your OS. Before running the installer, verify the cryptographic signature published alongside the download. The Tor Project provides both a signature file and their signing key at the same download page.

On Windows: right-click the installer, run as administrator, allow through Defender if prompted. On macOS: drag to Applications. On Linux: extract the tarball to any directory and run ./start-tor-browser.desktop. On all platforms, the updater runs on first launch — let it complete before navigating anywhere.

Immediately after launch, click the shield icon in the Tor toolbar and set Security Level to Safest. This disables JavaScript globally, restricts WebGL, and limits fingerprinting surfaces. Vortex loads correctly under Safest. Any darknet site requiring JavaScript to display basic content should be treated with suspicion — it is not a technical requirement for Vortex specifically.

If Tor Browser shows a connection error on first launch, your network may block direct Tor connections. Use a bridge: click Configure Connection in the startup screen, select Use a Bridge, and choose the obfs4 transport. The Tor Project bridge database provides current bridge addresses.

Set up a Monero wallet

Vortex accepts Monero (XMR), Bitcoin (BTC), and USDT on TRON (TRC20). Monero is the recommended starting point. Unlike Bitcoin or USDT, Monero transactions are private by default — amounts, sender addresses, and recipient addresses are all confidential at the protocol level. For a detailed overview, see getmonero.org.

Download the official Monero GUI wallet from getmonero.org. Verify the signature before installing. During setup, the wallet will generate a 25-word seed phrase — this is the master key to all funds in the wallet, now and forever. Write it on paper. Store that paper somewhere physically secure. Do not photograph it or type it into any device. Do not store it in a cloud service. If the seed is lost, the funds are permanently inaccessible.

For mobile: Cake Wallet is the widely recommended option in the Monero community. It supports Monero natively on iOS and Android, with full transaction history and privacy controls. Do not use any wallet that requires connecting to a third-party server for key generation — the wallet that generates your private key should be the wallet you control locally.

To fund the wallet: purchase XMR from a non-KYC peer-to-peer exchange (LocalMonero, Haveno when available) or convert from another currency using an atomic swap. Vortex also has a built-in exchange — you can deposit BTC and swap to XMR inside the platform, which is a reasonable path if you already have Bitcoin. The built-in swap keeps the conversion inside Tor, which is a genuine advantage over using an external service.

Generate a PGP key pair

PGP is required for Vortex. You cannot register without uploading a public key, and every login issues a PGP-encrypted challenge that you must decrypt offline. Without a private key in hand, you cannot log in — not even with the correct password. That is a security feature, not a limitation. It means stolen credentials alone cannot access the account.

On Linux: GnuPG is typically pre-installed. Run gpg --gen-key and follow the prompts. Choose RSA 4096-bit. Set a strong passphrase — this protects the private key if your machine is compromised. On Windows: download Kleopatra from gnupg.org (part of the Gpg4win suite). The graphical interface walks through key generation in about two minutes.

After generating the key, export the public key (gpg --armor --export YOUR_KEY_ID) — you will paste this into the Vortex registration form. Export the private key to an encrypted backup location: a VeraCrypt volume on a dedicated USB is the standard recommendation. Also generate a revocation certificate (gpg --gen-revoke YOUR_KEY_ID) and store it separately. If the private key is lost without a revocation certificate, you cannot formally invalidate the public key on any keyserver.

Never keep the private key on the same machine where you use Tor Browser. The separation between the key-storage machine and the browsing machine is the security boundary. Many operators use a dedicated offline machine or an air-gapped device solely for PGP operations.

Get the verified Vortex link

Navigate to the access page and copy the primary gateway address using the Copy button. Do not type the address manually. Phishing addresses are designed to look identical at a glance — they match the first and last few characters of a real address while substituting characters in the middle that are visually ambiguous under most fonts.

After copying, paste into the Tor Browser URL bar. The initial page load takes 4 to 12 seconds while Tor builds a circuit through three relays. This is normal. A circuit build time outside this range (under 2 seconds or over 20 seconds) sometimes indicates a network anomaly — retry with New Identity if the load time is unusually short, which can indicate a local DNS leak is resolving the address instead of Tor.

When the page loads, verify the visual identity: deep purple background, cyan accent bar, PGP challenge field on the login screen. If the destination looks generic, shows a login prompt without the PGP challenge, or has a different color scheme than described, close the tab immediately and verify the address you pasted against the one on the access page.

Register an account

Click Register on the Vortex login screen. Choose a username that does not contain any identifying information — no real names, no usernames reused from other services. Generate a unique password using KeePassXC or a similar offline password manager. A password stored only in an offline encrypted database is harder to extract than one stored in a browser or cloud service.

The registration form will ask for your PGP public key. Paste the exported public key block — beginning with -----BEGIN PGP PUBLIC KEY BLOCK----- and ending with -----END PGP PUBLIC KEY BLOCK-----. Include the full block including headers. An incomplete paste will cause registration to fail with a PGP validation error. That error message is accurate — do not proceed without a valid key upload.

After registration, log in once to confirm the PGP challenge flow works correctly before depositing any funds. You will see a text area containing a PGP-encrypted message. Copy that message to a machine where your private key is available. Decrypt it: gpg --decrypt and paste the encrypted block. The output is a short string. Enter that string into the challenge response field on Vortex. Successful decryption confirms the key pair is working correctly end-to-end.

Understand and use PGP 2FA on every login

Every login to Vortex issues a PGP challenge — a random string encrypted to your public key, which you must decrypt and submit. The process takes about 30 seconds once you have a working workflow. Decrypt offline — ideally on a machine that has never been connected to the internet while the private key was present, or at minimum on a machine with full-disk encryption.

The practical workflow most operators use: maintain a KeePassXC database with the account password, and a GnuPG installation or Kleopatra on a separate encrypted machine. Log in to Vortex from the Tor machine, copy the PGP challenge, physically transfer it (or use an isolated local network) to the GnuPG machine, decrypt, transfer the result back, enter into Vortex. This sounds slow. It takes about 90 seconds in practice and is considerably harder to attack than any password-only authentication scheme.

Do not use browser-based PGP implementations (like Mailvelope) for the challenge-response. They introduce the private key into the browser context, which breaks the security model. The private key should never be present in a machine running the Tor Browser session. That is the boundary the threat model depends on.

Browse listings and evaluate vendors

After logging in, the dashboard sidebar shows category navigation. Vortex had 20,543 active listings across all categories as of April 2026. Use the search and filter functions to narrow by category, price range, and shipping region. Vortex shows vendor feedback scores on each listing — the aggregate rating and the number of completed orders are the two most informative signals.

For your first order, filter to vendors with at least 200 completed orders and an average rating above 4.6. Ignore listings without visible feedback — newly approved vendors have not established a track record. Read the recent individual reviews, specifically any that mention shipping time and packaging quality. Those are the operational details that matter. Generic five-star reviews without content are less informative than a four-star review that describes the exact packaging method.

Check whether the vendor uses Finalize Early. FE-only vendors release escrow before delivery is confirmed. For a first purchase from a vendor you have not used before, this transfers all the risk to you. Standard escrow vendors retain the 14-day window for disputes. Use standard escrow for all initial orders with a new vendor, regardless of their overall rating. The escrow window is the protection mechanism — use it.

Message the vendor before ordering if you have any questions about shipping specifics. The Vortex messaging system supports PGP-encrypted messages — use it. Any vendor who asks you to communicate outside the platform (Telegram, email, external signal) should be treated with extreme caution. Vortex's messaging keeps the conversation within the platform's dispute record.

Place the order and manage escrow

Deposit funds to your Vortex wallet using the deposit address generated in your account. Send the amount in a single transaction — most vendors specify a minimum order amount, and the deposit address is fresh per transaction. Once the deposit confirms (XMR confirmations take 10 to 20 minutes; BTC is slower), the balance appears in your account and you can proceed to checkout.

At checkout, confirm the shipping address is correctly formatted and encrypted if the vendor requires PGP-encrypted shipping details — most do. Submit the order. The escrow clock starts when the vendor marks the order as shipped. The standard 14-day window begins at that point. Note the auto-release date in your calendar. If there is a problem with the order, you must open a dispute before the window expires.

Document everything from the moment you place the order: screenshots of the listing, the order confirmation, any vendor messages. The side with better documentation wins the majority of Vortex disputes. The mediator assigns decisions based on evidence. A dispute with no supporting materials against a vendor with tracking information is likely to resolve in the vendor's favor, regardless of what actually happened. Evidence collection is not optional — it is the mechanism.

If the order arrives correctly, finalize within the 14-day window or let it auto-release. Leave a detailed review. Vendor reputation is the information infrastructure the next buyer uses to make decisions. A review that describes shipping time, packaging quality, and product accuracy takes two minutes to write and is worth considerably more than a star rating alone.