PGP 2FA and Decrypt-to-Login
PGP 2FA is a login check that does not live in a phone app. After the password, the site encrypts a fresh code to the public key you gave it. You decrypt that block on your own machine and paste the code back. Only the private key opens it. The step is called decrypt-to-login. A password from last month's dump is not enough for today's login. A clone sitting between you and the real site can still finish that login, which is why checking the address does not go away.
DrugHub runs that decrypt on every login. Black Ops runs it at login and will not move money until the key is on the account. Omega will not register you without a public key, then adds a login check and a PIN. Other markets leave the switch off, or use a six-digit code instead.
What 2FA Is Trying to Solve
2FA exists so a stolen password is not the account. The second factor has to be something the password dump does not contain.
Markets get password lists the same way any other site does: a reused password, a phishing page that only saved what you typed, malware that read the field. Credential stuffing is the boring attack that follows. A script tries those pairs against the login. If the password is the whole login, the script wins. A second factor the script does not have stops that run, whether the factor is a code from an app or a decryption only your key can perform.
The factor has to change every login. A second password written next to the first one in the same dump is just a longer password. A PGP challenge is new each time, encrypted to your key, and useless once that login is over. An authenticator code is also new each time, for about thirty seconds. The difference is what the attacker has to steal to produce the next one.
How Decrypt-to-Login Works
Decrypt-to-login means the market encrypts a one-time code to your public key, and the login finishes only if you return the code your private key just opened.
You give the market the public half when you register, or later in the security settings. That half can be published. It cannot open anything. At the next login the site makes a short random code, encrypts it to that public key, and shows you an armored block. On your machine you decrypt it. In Kleopatra that is Decrypt/Verify in the Notepad. On the command line it is gpg --decrypt. The passphrase on the key is the local gate. The plaintext that drops out is the code, and you paste that code back. The site compares it with the code it encrypted. A match means the private key was present for this attempt.
The market never receives the private key, and a copy of its database does not contain one. What the database holds is the public key and the password hash. Neither of those produces the next code. Making the keypair, and the rule that a block labeled PRIVATE KEY never gets pasted anywhere, is the how to use PGP guide. This page starts from a key you already have.
Why It Beats an Authenticator App Against Phishing
A password and a TOTP code can both be typed into a fake page and used at once. A PGP challenge cannot be invented by a page that is not talking to the real market.
TOTP is a six-digit code from an app, valid for a short window, usually thirty seconds. A phishing page that looks like the login asks for the password and the code. You type both. The clone relays them to the real site before the window closes. The same trick works on a setup QR: a page that says your authenticator needs to be repaired gets the seed that generates every future code. The app is convenient, and the secret lives on a phone that also gets SIM-swap and malware attention.
PGP 2FA moves that secret to the private key. A static clone has nothing to show you that will decrypt into a code the real market is waiting for. It would have to encrypt a code it does not know, to a key that only produces gibberish the real site will reject. Credential stuffing dies for the same reason. The bot has the password and does not have the key.
A live clone is the limit, and it is a real one. The clone loads the genuine login, receives the genuine encrypted block, and shows that block to you. You decrypt it, because the ciphertext is real, and you paste the code into the clone. The clone pastes it into the real site and is now in your session. Nothing in the math notices. Decrypt-to-login does not check which website you were looking at. The check that does is the address: a signed canary, the full onion, a fingerprint you already trust. Black Ops builds its CAPTCHA against this relay for the same reason. The decrypt step and the address check do different jobs, and dropping either one leaves a hole the other does not cover. Mars uses a TOTP code beside a PGP key, and its own login page says the code defends a real Mars session, not a clone you have already decided to trust.
Setting It Up
Paste the public key, then finish one login challenge while the account is still empty. A decrypt that fails before there is a balance is a fixable mistake.
Export only the public key
The block you paste begins with BEGIN PGP PUBLIC KEY BLOCK. Export that from Kleopatra, or with gpg --armor --export. A file or a block that says PRIVATE KEY stays on the machine. The market asking for "your PGP" means the public half. People paste the private half once, and that single paste is the whole second factor, gone.
Paste it where that market asks
DrugHub and Omega ask at registration. No key, no account. Black Ops lets you register and look around, then locks deposits, withdrawals and purchases until the key is added, because it also encrypts the deposit address to that key. TorZon, Bazaar and Awazon have the switch and leave it off. Turn it on the day you register if you are going to use it. A password that sits alone for a month is a password that can be stolen in that month.
Open one challenge on purpose
Log out. Log in. Copy the armored block, decrypt it locally, paste the code. If the passphrase is wrong, nothing comes out, which is what a wrong passphrase should do. If the code is rejected, the usual cause is a truncated paste or a key that is not the one you uploaded. Fix it now. The same rejection after a deposit is a locked account, and support on these markets cannot decrypt the challenge for you.
Where You'll See It
Three markets require the key before the account is useful. Three offer PGP 2FA and do not force it. Two have no second factor at all. One uses an authenticator code instead of a decrypt.
| Market | What the login asks besides the password | When the PGP key is required |
|---|---|---|
| DrugHub | Decrypt a challenge at every login | Registration |
| Black Ops | Decrypt a challenge at login. A PIN sits on deposits, withdrawals and purchases | Before the first deposit. Browsing works without it |
| Omega | A second check at login, plus a PIN on sensitive actions | Registration. No key, no account |
| TorZon | A six-digit PIN by default. PGP 2FA can be switched on in addition | Only if you turn that switch on |
| Bazaar | PGP 2FA exists and is off until you enable it | Optional. Login does not require a key |
| Awazon | PGP two-factor is optional and not enforced | Optional |
| Mars | A TOTP code from an authenticator app | The key is on the account. The login challenge is the code, not a decrypt |
| WeTheNorth | Nothing. The password is the login | Not used as 2FA. Vendor messages still want PGP |
| Catharsis | Nothing. No 2FA and no PGP login | PGP is for messages, not for the login |
A PIN is not a decrypt. TorZon's six digits and Omega's action PIN are secrets you type, and a clone that asks for them can store them. They still stop a password-only script. They do not replace the address check, and they do not replace a PGP challenge if the market gives you the option to add one. On TorZon the personal phrase at login is a third thing again: a string you chose so a clone that does not know it fails a glance. It is not a second factor. It does not prove you hold a key.
The Catch: Your Private Key Is Now the Account
The private key is the second factor. A copy of that key, with the passphrase, is a copy of the login.
DrugHub and Omega have no email reset to fall back on. Lose the key and the account stays where it is, including any balance still on the market. Black Ops will still show you the catalogue and will not let the money move. Back the key up before the first deposit, not after the decrypt fails on a machine you no longer have. The file is stored the same way as a wallet seed: offline, two copies that fail in different ways, and not in a folder that syncs. Those copies are covered in how to store a seed phrase offline.
A key you also publish on a clearnet profile ties the market login to that name. A separate key, used for these logins and for nothing you sign in public, keeps the two apart. The market sees the fingerprint you uploaded. It does not need the key that signs your other life.
Someone who steals the private key file and watches you type the passphrase once has every future code. Disk encryption and a passphrase you have not reused are the remaining lock. PGP 2FA fails in the same place the rest of PGP fails: not in the cipher, in the one file that was supposed to stay yours.
PGP 2FA Questions
What is PGP 2FA?
PGP 2FA is a login check where the site encrypts a fresh code to your public key and you decrypt it with your private key. The password still comes first. The code changes every login, so a password from an old dump does not open the account. The step is also called decrypt-to-login.
Is PGP 2FA safer than an authenticator app?
Against a stolen password, and against a fake page that only asks you to type a six-digit code, yes. A TOTP code can be typed into a clone and relayed while it is still valid, and the app's setup QR can be phished. A static clone cannot invent a PGP challenge the real site will accept. A live clone that fetches the real challenge and shows it to you still receives the code you paste back. The address check is what stops that clone.
What if I lose my private key?
On DrugHub and Omega the key is required for the account, and there is no email reset. A lost private key is a lost login. Black Ops lets you look around without the key and locks deposits, withdrawals and purchases until it is there. Back the private key up offline before the account holds a balance.
Which markets require PGP 2FA?
DrugHub decrypts a challenge at every login. Omega requires a public key to register and a second check at login, plus a PIN on sensitive actions. Black Ops requires the key before the first deposit and decrypts a challenge at login. TorZon, Bazaar and Awazon offer PGP 2FA and leave it off until you turn it on. TorZon's default second factor is a six-digit PIN. WeTheNorth and Catharsis have no 2FA. Mars pairs a PGP key with a TOTP code instead of a decrypt challenge.