Staying safe while shopping
The market handles escrow and two-factor. The rest is habit. A short list, in the order it matters.
awazonip66usn4oq6vn5b3fqjyjjvavzu3ototnjbmi2wg6bocfc7aqd.onionawazonwilo4vky6obkwrkv62vx24tnf5323pts6d7gohdoj4pjt646qd.onionawazonvewzuve3emyxtz2z7ko6bjv6m6qieioi2tuvbgwiomn6vyryyd.onionPaste, don't retype. One wrong character out of 56 opens someone else's site.
Browser rules
Tor Browser only. The market in a regular browser is the market plus the internet service provider, plus the employer, plus whatever search engine logged the visit. The .onion address does the hiding; the browser has to not undo it. Before logging in, use "new identity" or reload the circuit for the site, so the login happens on a fresh path and not on the one that carried the queue and the captcha. The queue and the captcha exist to slow down scrapers. A fresh circuit keeps the login separate from everything that came before it.
Money rules
The market takes Bitcoin, Litecoin, and Monero. Every order goes through escrow. The coins sit with the market until the buyer confirms the order, and only then do they move to the vendor. The deposit address is tied to a specific order, not to the account. It is generated for that order and it is not a general wallet. The first order with a new vendor should be small. Not because the escrow is untrustworthy, but because the vendor is a stranger and the first transaction is how the stranger becomes a pattern. The market takes a fee on top of the order value. The fee is listed in the checkout, before payment, and it is the same for every buyer.
Account rules
Two-factor on. A separate email address that nothing else uses. The seed phrase written on paper, not in a note on the desktop, not in a screenshot, out of the password manager that lives on the same machine. A password that is not used anywhere else, because a password that is used elsewhere has already been in a breach, and the clones are good at collecting breached passwords. The market account should be a closed room: its own email, its own password, its own two-factor, nothing that ties it to the rest of the online life.
What the market does for you
Escrow holds the coins until the buyer confirms. Two-factor sits on the account, so a stolen password alone is not enough to get in. The mirror list is published as a PGP-signed message, so the addresses can be checked against a stable key instead of trusted on faith. The access queue and the captcha slow down scrapers and bots, and they are also a signal: a mirror that has the queue is probably the real one, and a mirror that does not is probably not. The storefront itself is clean: categories, product cards, reviews with a verified purchase badge, a checkout that does not hide the total.
What it cannot do for you
The awazon market scam that actually happens is one of three things. A vendor who disappears before the escrow is released. The market holds the coins, but it cannot make a vendor who stopped answering messages ship the package. The buyer has to open a dispute, and a dispute is not the same as the money coming back the same day. A password that was used somewhere else. If the same password sits on a forum that got breached, the market account is one guess away from someone else. A mirror where one letter was typed wrong. A v3 address is 56 characters, and one swapped letter still resolves to a valid site. Someone else's site. The vendor, the password, the address. These are the ones the reader closes. The market covers the rest. The questions people actually ask are at faq, the address check is at verify, the login flow is at login.