VERIFY / EXACT MATCH
Verify a Torzon Onion Before You Connect
A phishing onion looks right and reads right. The only thing it cannot fake is the signature. This page is about the one habit that keeps you safe: check the key, then diff the address down to the last character.
The four gates an address passes before it earns your trust
Verification is not one action, it is a short chain. Each gate can fail on its own, and any failure means stop. Fetch the key, confirm it signed the list, diff the exact address, and only then open it. Skip a gate and you are trusting a look, not a signature.
One wrong character is a different server
A clone swaps a handful of letters deep inside the string, where your eye skips. Below, the canon line and a lookalike differ by a single character. That is enough to route you to someone else entirely. Never eyeball the middle; compare the whole thing.
Illustrative fragment, truncated on purpose. Pull the real string from the signed directory and diff the full length, not a preview.
Paste an address and test it
This tool normalizes harmless spacing and scheme differences, then accepts only an exact match from the embedded canon. A near-miss stays unverified, on purpose.
Runs entirely in your browser. Your input is matched against the embedded canon and is never sent anywhere.
What does the validator actually check?
It compares your string against the canon list baked into this page, character for character, after trimming spaces and a leading scheme. Match or no match, nothing between. It does not touch the network, so a green result means the text is correct, not that the node is live. Uptime is the status grid's job, and authenticity is still the signature's.
Import the key, then check the signature
pending (Phase 0)Show the verification commands
gpg --recv-keys <canon-fingerprint>
gpg --verify torzon-mirrors.sig
# reject any line the signature does not coverWhy is PGP the only proof that a link is official?
Anyone can copy our layout, our wording, and our color. No one can sign the mirror list without the private key that pairs with the fingerprint above. A signature that checks out is the one signal a clone cannot forge. The domain, the design, and the search ranking are all copyable. The key is not.
The fingerprint here reads pending. What does that mean?
The canon key is offline during Phase 0 and has not been published yet, so the fingerprint slot holds a placeholder on purpose. Do not trust a full fingerprint that turns up elsewhere claiming to be ours in the meantime. When the key goes live it will sign the directory, and this field will carry the real value.
How to tell a verified Torzon link from a good fake
What makes a link a verified Torzon link?
Two things at once. It sits in the signed directory, and its full string matches the address the canon key vouches for. Miss either half and it stays unverified, however right it looks. A verified link is not the one that ranks first in a search. It is the one the signature covers.
Where do clones usually hide the swap?
In the middle of the string, where the eye slides past. The first few characters and the tail often match on purpose, so a glance approves it and the click lands on someone else. Diff the whole length, not the ends. That is the entire reason the character check exists.
Do I need to validate again if the address worked yesterday?
Check the fingerprint each session, at least briefly. A link you trusted can be swapped in the source you copied it from, and a saved bookmark can point at a stale address after a rotation. The habit costs seconds. Being routed to a clone costs the whole session.
Pull the addresses to diff
The full onions and the fingerprint live on the home directory. Start there, then run each address through the check above.