Nexus Link Desk Provenance, not popularity
Link Desk / Checking one

Current Nexus addresses

Three nodes, one platform behind them. Copy, never retype, and verify the signature when you arrive.

Node 01 nexusb2l7fmqnefwphyy7m5zjhlkytlbo7qbb5lu5dlczr3azgii2gyd.onion
Node 02 nexusma2iqgauqqvjcgds4ckv5xbf272tkfagq4epojjhsgleqpwxiqd.onion
Node 03 nexusabcd6tyfhdwilyitaqiri6tisj2v2hueyjuj6qkvd6azvi5tuqd.onion

An address that loads is not an address that is genuine. The check that settles it takes under a minute.

Reading an address

The cheapest improvement anyone can make to their habits, and it takes about five seconds longer than what most people currently do.

What people actually do

Shown a fifty six character string, almost everyone reads the first four or five characters, glances at the end, and accepts it. This is not laziness, it is how reading works. Long strings of unpredictable characters are processed by sampling, and the samples people take are the ends because those are the boundaries.

Forgery is designed around that behaviour. Matching a recognisable opening is cheap, matching the middle is not worth the compute, and matching the whole string is impossible. So the differing characters are placed exactly where sampling does not reach.

The five second fixIf you are going to spot check rather than compare properly, check characters twenty through forty. That is the region a forged address differs in, and checking it takes as long as checking the ends.

Better than reading it

  1. Do not compare by eye at all. Paste both strings into something that will tell you whether they match exactly. Human comparison of random characters is unreliable no matter how carefully you do it.
  2. Copy, never retype. Every manual transcription is a chance to introduce an error that will look like an attack when it fails.
  3. Copy from a current roster, not from a saved note, a message, or memory.
  4. Then verify at the destination, which establishes what no amount of string comparison can.

Things that are not the problem

Confusable charactersBase32 as used here excludes visually ambiguous pairs by design. An address that looks slightly off genuinely is off. This is never a font issue.
CaseOnion addresses are case insensitive. Seeing one in mixed case somewhere is a formatting choice, not a different address.
The .onion suffixAlways the same and carries no information. Anything with a different suffix, appended to look similar, is not an onion address at all.
LengthAlways fifty six characters before the suffix. A shorter one is from a retired protocol version and has not resolved for years.

That last row is worth knowing because a short address is an immediate and certain answer. Sixteen characters means a v2 address, which stopped working across the whole network some time ago. Anything publishing one has not been maintained in years, whatever its timestamp claims.

What the string can never tell you

Who runs it, where it is, or whether it is safe. Identifiers carry no reputation and there is no property of the characters that distinguishes a market from a clone of it. Two addresses that look equally random may be either.

This is where habits from clearnet mislead. A domain name carries a hint about who registered it and a certificate carries slightly more. An onion address carries exactly one claim, that whoever answers holds the key, and reading it carefully only protects you from arriving at the wrong string. The signature is what tells you about the party at the other end.