Nexus Market login: where and how
Login happens on the .onion, inside Tor, on the market's own page. Nothing on this reference page will ever ask for your password, and neither should anything else outside Tor.
The route, in order
Open a verified address
Copy one from the mirrors page, paste it into the Tor Browser, run the four checks on the verification page while the page loads.
Pass the market's checks
Browser check, then the DDoS captcha with the red circle and the 60 second timer. No credentials are requested on either screen. If one is, stop.
Reach the login page
The shop loads. The login form is a page inside it, with the market's address still in the bar. Check the last six characters one final time, then type.
Username, password, PIN
The form takes your username, your password, and the six digit PIN you set at registration. Not an email. Not a "recovery code" from a third party. Those three fields, nothing else.
What your credentials are made of
Registration on the market asks for a username, a strong password, and a six digit PIN, plus the captcha that proves you are not a script. After that, the market gives you a mnemonic phrase. This is the part people get wrong, so it is worth a full paragraph.
The mnemonic is the only path back into your account if you lose the password or the PIN. It is not stored in your email, because there is no email. It is not on any server you can request a reset from, because a reset link would defeat the point of the market. If the mnemonic is lost, the account and the balance in it are gone in the practical sense. Write it down on paper, keep it somewhere dry and private, and test yourself against it once, in front of a witness if you can. People remember they wrote it down and forget what they wrote.
Forgot the password, lost the PIN
- Mnemonic intact. Use it to restore the account. The restore flow is inside the market, on the login screen, under the option that mentions the recovery phrase.
- Mnemonic lost too. The account cannot be recovered by any support desk, because the market does not hold the key material in a form support can spend. If your escrow still has coins in an open order, open a dispute before anything else, while the order is still in escrow.
- You suspect a leak, not a loss. Change the password from inside a fresh Tor identity. Then change the withdrawal address in your profile to a new one you control. Then move the balance. A leaked password plus an old withdrawal address is how balances evaporate.
Hygiene that actually matters
A different password for the market. The market is where your crypto money sits. Do not give that password to your bank, your email, or your gaming account. One leak, three problems.
A different Tor identity per session. Ctrl+Shift+I on desktop before you open the address. It costs five seconds and means a slow or blocked circuit cannot be blamed on your previous browsing.
Log out, then close the window. The market's session stays in the Tor profile until it expires. On your own machine that is acceptable. On any machine that is not only yours, log out first.
Withdraw to a fresh address each time. The withdrawal address in your profile is visible to the vendor during an order. Reusing it links your orders. A fresh address per withdrawal is the habit the market's own guidance pushes.
The phishing shape to recognize
Fake login pages for the market follow one pattern: a clearnet URL, or an onion that failed the checks above, a page that looks 90 percent right, and a password field waiting a little too eagerly. The 10 percent that gives it away is usually the missing check sequence, no captcha, no 30 second browser check, just the form. You skipped the part that costs the fake nothing to include, which means you are the reason it was built. The verification page has the full tell list.