Fawkes Market PGP Guide

PGP (Pretty Good Privacy) is the trust layer of darknet markets. On Fawkes Market it does three jobs: two-factor logins (your account lock), signed announcements (proof a message really comes from the team) and encrypted messages (private conversations with vendors). This guide covers all three — starting from zero.

Part 1 — Generate your key pair

1Pick your tool

Windows: Kleopatra (install the free Gpg4win suite).
macOS: GPG Suite (gpgtools.org).
Android: OpenKeychain.
Linux: GnuPG is usually pre-installed.

2Create the key

New key pair → RSA 4096-bit (or the default ECC) → name it with your market pseudonym → choose a strong passphrase you have never used anywhere else. The passphrase protects your private key if your device is compromised — make it long.

3Export the public key

Right-click the key → Export. You get a text block starting with:

-----BEGIN PGP PUBLIC KEY BLOCK-----
...your public key...
-----END PGP PUBLIC KEY BLOCK-----

Copy the entire block — headers and footers included.

Part 2 — Enable PGP two-factor authentication

Log in to Fawkes Market via a verified link.
Open account settings → security → PGP key, and paste your public key block.
Enable 2FA. The market sends a test challenge; decrypt it with your tool (Kleopatra: "Decrypt/Verify", then paste the challenge; it prompts for your passphrase) and enter the result.
Done. From now on, every login requires both your password and your private key.

The detailed version — including what to do if you lose your key — is in the 2FA guide.

Part 3 — Verify the market's signed announcements

The Fawkes team signs important announcements — link changes, maintenance windows — with the market's own PGP key. To verify: import the market's public key (published in darknet directories and on its official pages), then use "Decrypt/Verify" on the signed message. A valid signature shows the key's identity and a "verified" result; a tampered or fake message fails.

The safest source of truth is always the market's canonical page, fawkes.sc — signed announcements confirm what fawkes.sc publishes.

A Fawkes Market public key, as published in public darknet directory listings, is reproduced below for reference. Always cross-check it against the key published on the market's own pages before trusting it:

Reproduced from public directory listings of the Fawkes Market key; treat fawkes.sc as the authoritative source and verify signatures against the key published there.

Part 4 — Encrypt messages to vendors

For anything sensitive in conversation with a vendor: import their public key from their profile, write your message, and use "Encrypt" with their key selected. Only they can read it. Signing your message with your own key lets them verify it came from you. This is optional politeness and protection — market private messages are already functional; PGP adds end-to-end privacy.

Key management: the two rules

Back up your private key — encrypted export on a USB stick or in your password manager. Lose the key, lose the account (there is no email-based reset on darknet markets).
Never share the private key or its passphrase with anyone — no market, vendor or "support agent" will ever ask for it. Anyone who does is a scammer by definition.

FAQ

Do I need PGP to use Fawkes Market?

It's optional but strongly recommended — 2FA protects your account even if your password is phished. Message encryption is a further optional step.

I lost my private key — can I recover my account?

Contact the market's support with proof of ownership, but assume it's gone. This is why offline backups matter: see the 2FA guide.

Can I use the same key on other markets?

You can, but separate keys per identity are cleaner OPSEC — see the OPSEC checklist.

Next steps

The 2FA guide in depth — challenges, backups, recovery.
Phishing defence — where PGP saves you.
Verified mirrors — where to log in safely.