Login is inside the onion

The order of the real login

Paste the address into Tor Browser. The Access Queue comes first: a spinner, "Do not refresh the page. Please wait... you are being forwarded to the market." Then the DDOS Protection captcha, the broken circle, the 24 second bar. Only after that does the storefront load: clean categories, product cards with pictures, a checkout that makes sense. The login form sits in the header: username, password, and a two-factor field if it is enabled on the account. That is the only form. There is no second one hiding on a "profile" page or a "recovery" page. If a form appears somewhere else, it is not the market asking.

Before the queue, check the address. The last six characters must match the signed list, or the whole login is a performance for an audience of one. See how to check a mirror before typing anything.

The clearnet forms are the scam

On ordinary domains, pages show up with the heading "Welcome To Awazon Market. Use This Page To Login Or register." A login box, maybe a register box, a button that says something encouraging. The market has no clearnet site, no email address, no phone number. Anything that claims to be the market outside of Tor is a clone, and a clone that asks for a market password is working for whoever put it up. What is typed into that form goes to that person, not to an escrow agent. The password, the username, sometimes a two-factor code that was just generated on the phone. All of it, handed over with a click.

The market itself only ever appears behind the queue. If the "market" can be opened in a regular browser on a .com or a .shop domain, it is not the market. It is a costume. The full list of the lookalikes is at clones.

Account habits

Use a separate email address for the market, one that nothing else uses. Give the account a password that is not used anywhere else, and write it down on paper. Paper does not sync, does not get pulled into a backup, does not sit in a password manager that might be phished. Turn on two-factor and write the seed phrase on paper too. Keep it off the computer, off the phone, out of the notes app. If the phone is lost, the seed on paper is what gets the account back. If the seed is in a screenshot, the phone is the only backup, and screenshots have a habit of ending up in cloud storage.

Do not reuse a clearnet password for the market. A clearnet password has already been in a breach somewhere, and the clone sites are good at collecting exactly the passwords that were in breaches. The market account should be a closed room: its own email, its own password, its own two-factor, nothing that connects it to the rest of the online life. How to get the browser set up for that is at opening the market, and the wider rules for not losing the account are at safety.

Nothing on this page will ever ask for your password. The form that does is inside the onion, after the queue.