PGP File Encryption Guide — How to Encrypt Your Messages for Darknet Market Transactions

A vendor on Nexus Market messaged a buyer last month asking for a “plain text address update” because their PGP was acting up. The buyer sent the full name, street, and apartment number in the clear. Within 48 hours, a fraudulent charge hit the buyer’s card, and the address was cross-referenced with a package interception scheme. The vendor’s account was later confirmed compromised. The whole collapse started because one person skipped the encryption step that takes under 30 seconds.

Why PGP Matters for Market Communications

Pretty Good Privacy isn’t a nice-to-have on markets like DarkMatter, DrugHub, Nexus, or Torzon — it’s the baseline. Every message containing shipping details, order adjustments, or tracking numbers must be encrypted with the recipient’s public key. If a market server gets seized (Hansa in 2017, AlphaBay in 2017, Hydra in 2022), plaintext messages become evidence. A 2020 analysis of Hansa vendors found that experienced sellers who moved across multiple markets invested heavily in PGP specifically to deny law enforcement useful plaintext, while newer vendors skipped it and got burned.

The Five Eyes intelligence community has publicly labeled end-to-end encryption as the “problem of going dark,” which tells you exactly how effective PGP is at protecting your messages. If intelligence agencies want it weakened, that’s a strong signal to use it correctly.

Prerequisites Before You Generate Keys

Before touching GPG, make sure you’re running Tails OS or a hardened Whonix setup, not your daily-driver Windows machine. Key generation on a compromised host leaks your private key the moment it’s created. You’ll also need a reliable password manager to store passphrases, plus at least two encrypted USB drives for key backups stored in physically separate locations.

Download GnuPG (GPG) from gnupg.org only — never from a third-party mirror. On Windows, the Gpg4win 4.3.3+ installer bundles Kleopatra, which gives you a graphical interface. On macOS, GPGTools 2024.2 works. On Tails, GPG is pre-installed and routes through Tor automatically. Verify the SHA256 checksum of any installer before running it.

Generating Your Key Pair

Open a terminal and run gpg --full-generate-key. Choose RSA and RSA, set the key size to 4096 bits, and pick an expiration of 1-2 years — never “never,” because a leaked key with no expiration stays valid forever. For the Name and Email fields, use a market-specific alias, not your real identity or any address linked to your clearnet persona. The Comment field can stay blank.

The passphrase is the single point of failure if someone copies your key file. Aim for 20+ characters mixing uppercase, lowercase, numbers, and symbols — a diceware phrase like correct-horse-battery-staple-7!Quantum works better than P@ssw0rd123. GPG will ask you to type the passphrase twice and then generate entropy by asking you to move your mouse or type random keys. Don’t skip this step; weak entropy produces predictable keys.

Exporting and Backing Up Keys

Export your public key with gpg --armor --export your-alias@market.onion > publickey.asc. The .asc format is what you paste into your market profile under “PGP Key.” Never paste your private key anywhere — markets only need the public half to encrypt messages to you.

For the private key, run gpg --armor --export-secret-keys your-alias@market.onion > privatekey.asc, then immediately encrypt that file with a separate GPG passphrase and store it on two encrypted USB drives kept in different physical locations. Generate a revocation certificate with gpg --gen-revoke and store it offline too — you’ll need it if your key is ever compromised before the expiration date.

Encrypting a Message to a Vendor

First, import the vendor’s public key. Copy the block from their profile, save it as vendor.asc, and run gpg --import vendor.asc. Verify the key fingerprint out-of-band if possible — a 2024 phishing wave against Torzon users distributed fake vendor keys that routed messages to attacker-controlled inboxes.

To encrypt your shipping address, run gpg --armor --encrypt --recipient vendor-alias@market.onion address.txt. The output is an ASCII block you paste into the market’s message field. Never include your real name and address in any message that isn’t encrypted to the vendor’s verified key.

Decrypting Incoming Messages

When a vendor replies, copy the encrypted block into a file called message.asc and run gpg --decrypt message.asc. GPG prompts for your passphrase and outputs the plaintext. In Kleopatra on Windows, open the Decrypt/Verify tab, paste the message, and enter your passphrase. The decrypted text appears in the output box.

If decryption fails with “no secret key,” your private key isn’t loaded — re-import it from your backup. If it fails with “decryption failed,” the message wasn’t encrypted to your key fingerprint, which usually means the vendor used the wrong public key. Confirm the fingerprint before trusting any shipping instructions.

Scam Comparison

Common Issues and Troubleshooting

If GPG hangs during key generation, your system lacks entropy — run apt install rng-tools on Debian-based systems or just keep typing and moving the mouse. If you see “unsafe permissions” warnings, your key files are world-readable; fix it with chmod 600 privatekey.asc.

Lost your passphrase? There’s no recovery — that’s the design. If you backed up the encrypted private key file, you can still use it on any machine with GPG installed, but you’ll need the passphrase to unlock it. Lost both? Generate a new key, update your market profile, and accept that old messages encrypted to the old key are unrecoverable.

Additional Security Recommendations

Set a calendar reminder 30 days before your key expires so you can generate a new one and migrate contacts without service interruption. Use a separate key for each market persona — cross-contamination of keys links identities. Never reuse a passphrase from clearnet accounts, and never type your private key into any web form, even ones that claim to be “secure PGP tools.”

For high-value transactions, consider adding a second encryption layer by encrypting the already-encrypted PGP message inside a 7z archive with AES-256 and a unique password shared over a different channel. Paranoia is just good OPSEC when packages worth real money are in transit.