Get into Drughub.
Eight steps.

Download Tor Browser from the official source

Go to torproject.org/download and download the build for your operating system. The Tor Project publishes builds for Windows, macOS, Linux (32-bit and 64-bit), and Android. There is also a .onion version of the download page if you're already inside Tor.

Do not download Tor Browser from third-party sites, mirror aggregators, or app stores unless they are the official Tor Project channels. A compromised browser binary is the most common phishing vector in the space — the binary looks identical, behaves identically on the clearnet, but routes your connection through an attacker's nodes when you visit .onion addresses.

The download page gives you a signature file alongside the binary. You need both. Don't skip the verification in the next step.

Verify the download signature

The Tor Project signs every release with a GPG key. Verifying it takes two minutes and confirms the binary hasn't been tampered with. Download GnuPG if you don't have it, import the Tor Project's signing key, then run:

gpg --verify tor-browser-*.asc tor-browser-*.tar.xz

A valid result reads Good signature from "Tor Browser Developers". A warning about trust level is normal — it means you haven't personally signed their key, not that anything is wrong. If you see BAD signature, delete the download and retry from a different mirror.

Skipping this step is the single biggest security mistake new users make. It's two commands. Do it once and you'll do it automatically from then on.

Set security level to Safest before anything else

Open Tor Browser. Before you visit any .onion address, click the Shield icon in the toolbar and select Safest. This disables JavaScript on non-HTTPS sites, which matters because many .onion pages don't serve over HTTPS — they can't, by design. The Safest level forces the browser to operate with a minimal attack surface.

What Safest disables: JavaScript on non-HTTPS pages, SVG animations, some fonts, and certain media. Most .onion markets are designed to work without JS — Drughub is deliberately JS-free in its core flows for exactly this reason.

If you're running Tor over a VPN (Mullvad or similar), connect to the VPN first, then open Tor Browser. This hides the fact that you're using Tor from your ISP. Note: Tor Project recommends this only if your ISP is actively hostile to Tor traffic — for most users, Tor alone is sufficient.

Get the verified Drughub link from this directory

Return to the homepage or the mirror list page to copy the current verified .onion address. The link on this portal is PGP-signed by the Drughub team on their Dread subdread and re-verified every six hours.

Use the Copy verified link button — don't type the address by hand. A .onion address is 56 characters of alphanumeric. One character wrong means a different server. Phishing clones look identical inside the browser because they've copied Drughub's interface exactly. The only thing that differs is the address.

You can copy either the primary gateway or one of the mirror nodes. They serve the same content from different infrastructure. If one fails to connect, use the other. Mirrors rotate during DDoS events — check the mirror list for the latest.

Connect, verify the address, and solve the captcha

Paste the copied address into the Tor Browser address bar. First connection takes 20–90 seconds — Tor is routing your traffic through three relays across the globe before it reaches the .onion server. Don't refresh. Don't assume it's broken. Wait.

When the page loads, Drughub will present a captcha. This is expected. It's a bot-prevention layer, not a sign of a problem. Solve it once per session. The captcha design is simple and text-based — again, because Drughub is designed to work on Safest security level without JavaScript-dependent image delivery.

After solving the captcha, you're at the login or registration screen. First-time users register here. Return users authenticate with their PGP key (no password — Drughub uses passwordless PGP login).

Create your account

Click Register. You'll choose a username. Pick something with no connection to any clearnet identity — no existing handles, no birthday numbers, no city references. The username becomes permanent; you can't change it later without creating a new account. Think of it as a separate identity, not a screen name.

Drughub will show you its registration rules after the username step. Read them. The platform has a zero-tolerance policy on vendor scams, and the rules explain the dispute resolution process you'd rely on if an order goes wrong. Screenshot the rules or save them in your KeePassXC notes.

The final registration step asks for your PGP public key. You need to generate this before you can complete signup. Proceed to step seven, then return here.

Generate a 4096-bit PGP key and upload to Drughub

Drughub uses passwordless PGP authentication. Your private key is your login credential. Your public key is what the platform stores. This means: if you lose the private key, you lose account access permanently. There is no "forgot password" flow — by design.

Generate a key with GnuPG:

gpg --full-generate-key

Choose RSA, 4096-bit key size. Set an expiry of one to two years — you can extend it before it expires. Use a strong passphrase stored in KeePassXC. The UID (name/email) can be anything — it won't be shown publicly on Drughub. Many users use a pseudonymous handle.

Export your public key:

gpg --armor --export YOUR_KEY_ID > drughub_public.asc

Open drughub_public.asc, copy the entire block (including the -----BEGIN PGP PUBLIC KEY BLOCK----- header), and paste it into the Drughub registration PGP field.

Back up your private key immediately. Export it, encrypt the export, and store it offline — on a USB drive in a separate location, or on paper using the gpg --gen-revoke revocation certificate. Losing the key means losing the account. No recovery path exists.

Fund with Monero and make your first transaction

Drughub's walletless invoice system means the platform never holds your XMR. When you place an order, Drughub generates a unique payment address specific to that transaction. Funds go directly into a 2-of-3 multisig escrow — one key for the buyer (you), one for the vendor, one for the platform. Any two keys can release the funds. The platform cannot steal from escrow alone.

To get Monero: buy XMR on an exchange (Kraken, a LocalMonero-style P2P service, or any of the Monero-accepting merchants), withdraw to a self-custody wallet. Monero GUI, Feather Wallet, or Cake Wallet all work well. Never pay directly from an exchange — the exchange has a record of the address and can be subpoenaed.

Wait for at least ten confirmations on your wallet deposit before funding an order. XMR confirmations take about two minutes each — ten confirmations is roughly twenty minutes. Don't rush this step. Partially-confirmed balances can cause invoice timeouts.

When you find a listing, check the vendor's feedback score and lab verification badge. Gold-badge listings have third-party purity and contaminant testing attached. If something is wrong with an order, open a dispute through the platform's resolution centre — the 2-of-3 multisig means neither the vendor nor the platform can close the escrow without your key. Done. That's the full procedure.