Keeping the account yours

With 2FA, a stolen password is a locked door: the attacker has the key and no code, and the account is still yours while you reset. Without it, a stolen password is the account. There is no middle position. Turn it on at registration, store the recovery codes somewhere you will find them in a panic, and treat the 2FA device like part of the password, because it is.

Long, random, and used nowhere else. A market password shared with your email password is one leak from total loss, and email accounts leak. A password manager solves this without making your life worse; the alternative is a spreadsheet, which is its own kind of leak. If you reuse a password for the market that you also use for anything reachable from a normal browser, assume it will eventually be tried on both.

The market email is for notifications and recovery, which means it is load-bearing: lose the email and the recovery path with it. Use an address you will still own in two years, ideally one that is not your main identity on the open internet. A separate mailbox for market business is cheap, and it keeps the recovery channel clean from the rest of your digital life.

The rule from the payments page, restated because it matters more than the rest: the market wallet holds what you are spending, not what you have. The difference between a bad day and a catastrophe is usually the size of the number sitting in a spending account. Top up before an order, withdraw after one, and let the two balances stay apart.

A password typed into Tor Browser is only as safe as the machine it was typed on. A laptop full of browsers you log into everywhere, on a network you do not control, is where keyloggers live. You do not need paranoia, you need a boundary: use the market on a machine you actually use, keep the Tor Browser updated, and close the tab when you are done. The rest of this page protects the account; that one protects the typing.