Nexus market onion links
& verified mirrors 2026
Four working v3 .onion addresses, each cross-referenced against PGP-signed admin announcements on Dread. Copy any of them — they all reach the same platform. All four verified on 23 April 2026. If a mirror is unreachable, switch to another; session state is shared across all four.
All 4 Nexus .onion addresses
Every address below is a 56-character v3 .onion. They are not shortcuts or aliases — each is a fully independent hidden service routing to the same Nexus backend. Choose whichever loads fastest over your current Tor circuit.
Loading...
30-day uptime: 96.6% · Latency: avg 340ms over Tor
Loading...
30-day uptime: 94.1% · Recommended backup
Loading...
30-day uptime: 95.3% · Low latency
Loading...
30-day uptime: 93.8% · DDoS resilient
Nexus has the most visually distinctive interface in the darknet ecosystem. Phishing operators copy it character for character. The only reliable way to tell the real Nexus from a clone is to verify the full 56-character .onion address against a PGP-signed announcement. Never rely on visual confirmation alone.
Mirror status · April 2026
Status data is updated daily. Uptime percentages cover the rolling 30-day window. Last-checked timestamps reflect our most recent automated verification run against Dread PGP-signed announcements.
| Mirror address (truncated) | Label | Status | 30d uptime | Last verified | PGP signed |
|---|---|---|---|---|---|
| nexusaldu7wwewcpcn4…wwyaqd.onion | Primary | Online | 23 Apr 2026 | ✓ Yes | |
| nexusbbqsh42lvde33…svtqd.onion | Mirror 02 | Online | 23 Apr 2026 | ✓ Yes | |
| nexuscr3cittluc2rcu…vqd.onion | Mirror 03 | Online | 23 Apr 2026 | ✓ Yes | |
| nexusd6kh4at2iof2tg…lcid.onion | Mirror 04 | Online | 23 Apr 2026 | ✓ Yes |
Uptime measurements are taken from Tor Browser sessions on three separate circuits and averaged. A mirror must respond with a valid HTML document — not a timeout or a non-200 status code — to count as available. These numbers represent user-experienced availability, not server-level ping tests.
How to verify a Nexus .onion address with PGP
This is a 5-step process. It takes about four minutes the first time. After the first verification, re-checking takes under 60 seconds. The core principle: you are confirming that the .onion address was signed by the same private key the Nexus administrators have used consistently on Dread since November 2023.
The real Nexus login screen. Phishing copies replicate this layout exactly. Visual matching is not verification — address matching is.
Install GnuPG
Download GnuPG for your operating system. On Tails and Whonix it is pre-installed. On Linux: sudo apt install gnupg. On macOS: install via Homebrew with brew install gnupg.
Import the Nexus admin key from Dread
Navigate to the official Nexus subdread on Dread. Find the pinned "Official Nexus PGP Key" thread. Copy the full key block including the BEGIN PGP PUBLIC KEY BLOCK header. Import it with: gpg --import nexus-admin.asc
Locate the signed mirror announcement
Admin mirror update posts on Dread are always PGP-signed inline. Copy the full message including the BEGIN PGP SIGNED MESSAGE block. Save it as nexus-mirrors.txt locally.
Run the verification command
Execute: gpg --verify nexus-mirrors.txt. A valid result shows Good signature from "Nexus Admin" along with the key fingerprint. If you see BAD signature, stop — do not use any address from that message.
Compare addresses character by character
After confirming the signature is valid, compare each .onion address in the announcement against the ones on this page. All 56 characters must match exactly. A single character difference indicates a phishing variant. Use a monospace font and compare in segments of 8 characters.
Further reading on PGP and verification
Distinguishing real Nexus from phishing copies
Nexus uses the most visually distinctive design in the darknet ecosystem — a cyberpunk palette with hot pink, cyan, and deep purple. Phishing operators copy this design in its entirety, down to the font choices. Visual trust is not reliable. Address verification is the only reliable method.
Signs of a phishing site
- Address differs by 1-2 characters from the verified list
- Site asks for credentials without PGP login option
- Page loads unusually fast (no Tor latency)
- SSL/clearnet redirect on connection
- No PGP-signed announcement on Dread with matching address
- Login page design matches Nexus but URL does not
- Requests personal info during registration
- No 2FA option shown on account creation
Signs of the real Nexus
- Address matches all 56 characters of a PGP-verified announcement
- PGP login available on login screen
- Typical Tor latency (2-8 seconds to load)
- TOTP 2FA offered during account setup
- Multisig escrow selection available on order page
- Vendor bond mentioned in the register flow
- Forum and dispute log accessible in-platform
- 15+ language options in settings
"I spent 20 minutes comparing two Nexus addresses once — they differed by one character in position 31. The phishing site was so convincing I would have logged in without a second look." — anonymous user report via Dread, March 2026
If you encounter a suspected phishing .onion, do not enter any credentials. Close Tor Browser, clear Tor circuits, and return to this page for fresh verified addresses. Report suspected phishing addresses on Amnesty Tech or darknet-focused security communities.
Privacy and browser tools
Common questions about Nexus mirrors and link verification
Questions from users navigating Nexus for the first time. For the access walkthrough, see the opsec guide. For background on the platform, see the origin page.
Nexus maintains 4 verified v3 .onion addresses. All four connect to the same backend, share the same order database, and carry identical balance state. There is no functional difference between them — they exist purely for redundancy against DDoS and circuit-level failures. Uptime across the four mirrors ranges from 93.8% to 96.6% over the past 30 days, meaning you are highly unlikely to find all four unavailable at the same time.
When Nexus updates its mirror set, the administrators post a new PGP-signed announcement on Dread. This page updates within hours of any verified address change. Bookmark both the mirrors and this directory.
Cross-reference each address with PGP-signed announcements posted by the Nexus admin key on Dread. Install GnuPG, import the Nexus admin public key from the pinned Dread thread, then run gpg --verify on the signed announcement. A valid result shows "Good signature from Nexus Admin."
After confirming the signature, compare the address from the announcement to the address on this page, character by character. All 56 characters must match. This is not optional — phishing operators have replicated Nexus character-for-character with only single-digit differences in the address.
Try the remaining three mirrors from this page. Before concluding the mirror itself is down, try clicking "New Circuit for this Site" in Tor Browser — most failed loads are circuit failures, not mirror outages. Tor circuits can degrade silently.
If three or four mirrors are unreachable simultaneously, wait 30 minutes. Simultaneous outage is rare and usually resolves within an hour. Do not search for "Nexus alternative links" on clearnet search engines — phishing operators specifically target users in this frustrated state. Return to this page and wait.
v3 onion addresses are 56 characters long and use ed25519 key pairs with SHA3-256 hashing. The older v2 format used 16-character addresses with SHA1 — now deprecated and disabled by Tor Project as of October 2021. v3 addresses are both cryptographically stronger and harder to enumerate: there is no practical way to scan the .onion namespace to discover v3 services, unlike the older format.
For users, the practical implication is that a 56-character address is harder to mistype — and harder for phishing operators to craft a convincing near-duplicate of. The longer the address, the more characters they must fake, and the more likely a careful user will catch the difference. Always compare in 8-character segments: it is much easier to catch a substitution in nexusaldu than in the full 56-character string.
Yes, bookmarking reduces your exposure to phishing — you do not need to search for the address each session. However, addresses can change after major security updates or infrastructure transitions. When they do, only PGP-signed announcements on Dread carry the authoritative new addresses.
The safest approach: bookmark both the current primary mirror and this directory. When you load your bookmark and the address no longer appears on this page's verified list, treat the discrepancy as a flag and re-verify from Dread before logging in. Keep both KeePassXC and your PGP keychain updated to make future re-verification fast.
No. Nexus operates exclusively on Tor. There is no clearnet version, no .com, no .net, and no redirect service. Any site claiming to be Nexus Market on the clearnet — including sites that look identical to the Tor interface — is either a phishing operation or an unaffiliated information directory (like this one).
This site (nexus-onion.top) is an information and navigation resource. It is not affiliated with Nexus and does not host the marketplace. Its purpose is to provide a verified, up-to-date set of .onion addresses cross-referenced against PGP-signed announcements. Access Nexus only through Tor Browser using one of the four .onion addresses on this page.
Phishing operators register v3 .onion addresses with similar-looking character sequences — substituting lowercase L for the numeral 1, or the numeral 0 for uppercase O. They then copy the Nexus cyberpunk design exactly: the hot pink and cyan palette, the Unbounded typeface, the grid layouts, even the floating status cards. The result is a pixel-perfect replica at a fraudulent address.
When users enter credentials on a phishing mirror, those credentials are captured and used to drain balances on the real Nexus. The phishing site may then redirect to the real Nexus to delay detection. The only reliable distinguisher is the address itself — visual matching is not verification. Read our opsec guide for a full threat model.
Yes. All four mirrors connect to the same backend infrastructure. Your orders, wallet balance, PGP key, and vendor reputation are accessible from any mirror. You can start a browsing session on Mirror 01 and continue on Mirror 03 without any loss of state. The mirrors are entry-point routing layers, not separate databases.
This is also why it does not matter which mirror you use for a transaction — the escrow state and dispute history live in the same backend regardless of which .onion you connected through. If a mirror goes down mid-session, switch to another and your session context will be intact. For more on how Nexus handles session security, see the platform overview.
Set Tor Browser to Safest mode before navigating to any Nexus mirror. The shield icon in the toolbar controls this setting. Safest disables JavaScript, which removes the largest attack surface for browser fingerprinting and drive-by exploits. Nexus is designed to function without JavaScript — every feature, including login and order management, works in Safest mode.
Safer or Standard mode are not recommended for marketplace access. JavaScript fingerprinting can leak information about your browser, installed fonts, and screen resolution even through Tor. If you encounter a site that claims to be Nexus but does not load in Safest mode, treat that as a strong warning signal — the real Nexus explicitly supports JavaScript-free operation.
Still have questions? The opsec guide covers Tor Browser setup, PGP key generation, and TOTP 2FA in detail. The platform overview covers Nexus features, payment methods, and escrow mechanics.
Copy a verified Nexus mirror link
All four addresses on this page are PGP-verified against the official Nexus admin key. Last confirmed 23 April 2026. Open in Tor Browser only, security level set to Safest.