Getting into DrugHub: 8 steps, zero shortcuts

The only way to reach .onion addresses is through the Tor network. Chrome, Firefox, Safari, and Edge cannot resolve them. There is one legitimate source for Tor Browser: torproject.org. Download from there and nowhere else.

Windows, macOS, Linux, and Android are all supported. iOS users get Onion Browser, which the Tor Project recommends. Skip the App Store look-alikes and unofficial mirrors — bundled-malware Tor installers are a documented attack vector specifically targeting privacy network market users.

Once installed, Tor Browser looks almost identical to Firefox — because it is a hardened Firefox ESR build. Differences that matter: no WebRTC (which leaks real IPs behind Tor), no browser fingerprinting APIs, Tor integrated at the network level. Everything you need. Nothing extra.

Open Tor Browser. Find the shield icon in the toolbar (top-right of the browser window). Click it. Select Safest. This disables JavaScript on every site, blocks certain fonts and icon fonts, and closes a range of browser-level exploit vectors that have been used against privacy network market users in documented cases.

DrugHub's market interface loads without JavaScript by design. The team built it this way specifically for Safest mode. You will not lose any functionality on DrugHub. Some clearnet sites will break — that's correct behavior. You're not browsing clearnet.

Also check your connection: Tor Browser shows your Tor circuit in the address bar. Unless Tor is blocked in your country, the standard configuration works. If it is blocked — and this happens in Russia, China, Iran, and a handful of others — request bridges directly from bridges.torproject.org. Not from any other source.

Get the verified DrugHub .onion address from the Copy button in the sidebar of this page, or from the homepage. Copy it. Paste it directly into Tor Browser's address bar. Press Enter.

The first connection takes 10-30 seconds while Tor builds a three-hop circuit. That's normal — Tor is routing your traffic through relays in three different countries. If you hit a CAPTCHA on arrival, solve it. DrugHub uses this as a basic bot filter, and it works without JavaScript. If you get a connection error, click the broom icon to get a new Tor circuit and try again.

Tor network speed varies by time of day. European evenings tend to be congested. If the connection is unusably slow, try again in a few hours. The market itself loads quickly once the circuit is established — the bottleneck is always Tor, not DrugHub.

You're at the DrugHub login screen. Before you enter anything — stop. Spend thirty seconds confirming the .onion address in your browser's address bar matches the PGP-signed announcement. This is the most important step in this entire guide. Everything else is setup. This is protection.

Phishing sites copy the DrugHub interface down to the pixel. The login button, the logo, the font. The only thing they cannot copy is the .onion address. — Anti-phishing principle

The DrugHub team posts new and rotated addresses on Dread (the Tor-based discussion forum) with a PGP-signed message. You can verify that message against their published public key — or at minimum, you can compare the address character by character with the signed announcement. That comparison takes less than a minute.

If the address in your browser matches the signed announcement: you're on the real DrugHub market. If they differ by even one character: close the tab immediately. Do not log in to verify. Just close it.

DrugHub uses PGP for two things: account login (instead of a password) and message encryption with vendors. You need a key pair before you register. The public key goes into your profile. Your private key stays on your machine and never leaves it.

Generate one with GnuPG:

gpg --full-generate-key

When prompted: select RSA and RSA (option 1). Choose 4096 bits. Set expiry to 2 years. Enter any name and a temporary email address — you won't use the email. Set a strong passphrase. Write that passphrase in KeePassXC or another offline password manager. Nowhere else.

On Windows, Gpg4win includes Kleopatra — a point-and-click GUI that produces identical results. Both use the same underlying cryptography. Never use browser-based or online PGP key generators. They exist specifically to harvest private keys.

Export your public key for DrugHub:

gpg --armor --export youraddress@email > drughub_public.asc

Open that file in a text editor. The contents — everything from -----BEGIN PGP PUBLIC KEY BLOCK----- to -----END PGP PUBLIC KEY BLOCK----- — are what you'll paste into your DrugHub profile during registration. Keep the private key file backed up offline. Lose it and you lose account access permanently. There's no recovery process, by design.

Click Register on the DrugHub market homepage. The form asks for a username, your PGP public key, and 2FA setup. Work through each one:

Username. Don't reuse anything linked to your real identity — not your email prefix, not your forum handle, not any name you've used publicly. Pick something new. Write it in KeePassXC alongside the passphrase. Pick it as carefully as you'd pick a password for a bank account.

PGP public key. Paste the full contents of your drughub_public.asc file — including the header and footer lines. The market validates the key format immediately. If it rejects the input, make sure you copied the entire block, starting and ending with the dashes.

Read the rules. DrugHub market enforces them. New buyer accounts have transaction limits until they build feedback history. Rule violations result in permanent bans, not warnings. The rules section is not boilerplate — skim it at minimum.

DrugHub is Monero-only. No Bitcoin, no stablecoins, no alternatives. This is a deliberate and permanent architectural decision. Monero's ring signatures hide senders. Stealth addresses hide receivers. RingCT hides transaction amounts. Every transaction is private by default — not optional, not an add-on. The official Monero site explains the cryptography if you want to understand it. For access to DrugHub, you just need a wallet.

Get a self-custody wallet first. Three solid options:

• Cake Wallet (iOS and Android) — most user-friendly, open source, built specifically for Monero and privacy coins
• Feather Wallet (desktop, Linux / Windows / macOS) — lightweight, open source, recommended for desktop users and power users
• Official Monero GUI Wallet — full node or remote node, maximum control, more complex initial setup

Write your seed phrase on paper. Store it somewhere dry. Not on your phone, not in iCloud, not in Gmail drafts. The seed phrase is the wallet. If you lose it, you lose any XMR in it. If someone gets it, they get your XMR.

Buy XMR on an exchange: Kraken and Binance support Monero in most regions. LocalMonero offers peer-to-peer options without KYC for smaller amounts. Withdraw to your self-custody wallet immediately after purchase — never let funds sit on an exchange longer than necessary, and never transact on DrugHub using an exchange address. Exchange withdrawals carry identifiable transaction patterns that undermine the entire privacy model.

Account registered. Wallet funded. PGP key in your profile. You're ready. Before you start browsing, understand how the payment flow actually works — it's different from most platforms.

Walletless invoices. DrugHub doesn't have an internal balance. You don't deposit anything. When you confirm an order, the market generates an encrypted invoice with a specific XMR amount and a one-time address. You send directly from your wallet to that address, which goes into 2-of-3 multisig escrow. The market itself never holds your funds. This is why there's no withdrawal to steal.

Lab verification badges. Look for Gold, Silver, and Bronze badges when browsing listings. 90% of DrugHub's 19,913 active listings have independent third-party laboratory results for purity, contaminants, and weight. Gold means all three have been verified externally. For your first order, start with a Gold-badged vendor who has at least 50 completed transactions in their feedback history.

Escrow and disputes. Funds sit in escrow until you confirm receipt. If something goes wrong, DrugHub mediates disputes — and because it's 2-of-3 multisig, neither party can release funds unilaterally. That includes the market administrators. No internal wallet means no exit possibility. Done.

Messaging vendors. Use PGP for everything. Get the vendor's public key from their profile. Encrypt your message with their key using GnuPG before sending. Your delivery address, any identifying information — all of it goes encrypted. Even if the market's servers were accessed, encrypted messages are unreadable without the vendor's private key, which they hold.