wazon mirrors

Official mirror listno login form, no balances, no uptime counter

Checked 18 September 2026

Awazon onion links, read from left to right

Every Awazon Market onion link is the same 56 characters of shape. Two sections of that string carry information and the rest is the key.

Where the characters come from

A version 3 hidden service address is a public key wearing a hat. The service holds an ed25519 key pair, the 32 byte public half of it is encoded in base32, and base32 needs eight characters for every five bytes, so 32 bytes become 52 characters. Four more characters carry a checksum and a version byte. Fifty six in total, and then the .onion suffix.

Nothing about that involves a registry, a renewal fee or a name server. The address is a fingerprint, and the browser checks the checksum built into the string before it goes looking for introduction points. Cut one character out of the middle of a v3 address and it usually stops being valid rather than becoming somebody else’s site, which is a small mercy and the only built in one you get.

What the awazon prefix proves, and what it does not

AN AWAZON V3 ADDRESS, CUT INTO FOUR PARTShttp://awazonvjpi6bdysnad23ydgscomsku53wnfewrbbpxobvzow5xe6nyyd.onionschemevanity prefix, 6 chars, key huntedtail, 6 chars, from the same keysuffix
Figure 1. The same address every directory prints, with the two parts worth checking marked.

Six characters of a 56 character hash do not prove much on their own, and a phishing page that prints a correct prefix under a wrong middle is the oldest trick in this corner of the web. The prefix is a label the community agreed to recognise. It is not a signature and it is not a certificate.

The useful part is the tail. Those last characters are derived from exactly the same key material as the 44 characters before them, so an attacker who copies the prefix and invents a middle has to guess the ending correctly as well, and there are about a thousand possibilities per character. Compare the first six and the last six against something the operator signed. A middle you cannot match character by character is a middle that has been edited.

How to verify an address with your own hands

  1. Find the announcement the market signed with its own PGP key, and read the address inside it rather than a screenshot of it.
  2. Compare the full string, not the prefix. Paste both addresses into a text field and diff them with your eyes at the ends.
  3. If the market publishes a fingerprint, check that too. A fingerprint is the shorter form of the same key material and is harder to misread.
  4. Type the address yourself if the browser lets you. Paste is faster and paste is how one character disappears.

When the string is not the problem

A v3 onion address cannot be resolved by DNS and cannot be redirected by a router, so a failure to load is a routing failure, a retired address or a service that is offline. It is very rarely a name resolution problem, and a page of instructions telling you to flush your DNS cache is a page written for a domain name.

Questions

Why do all Awazon mirrors start with the same word?

The operator generated key pairs repeatedly until the derived address began with awazon. It costs time and compute at generation and nothing afterwards.

How long is an Awazon Market onion URL?

Fifty six characters before .onion, which is what a version 3 hidden service always is. If a number you read somewhere says 16, whoever wrote it was describing the older v2 format.

Can two markets share a prefix?

Yes, and in practice several do. A prefix is a string, not a namespace, and no authority is watching over who gets to use which six letters.

Do I need PGP to use the market?

To buy, no. To verify an address with your own hands, a PGP tool makes the signed announcement checkable, and the security page says what it does and does not cover.