Define the task before opening the browser
A clear objective reduces exposure. Write down what you need to confirm and what you will not do. A useful task might be to compare an organization’s clearnet announcement with its onion counterpart. “Explore whatever is there” has no natural stopping point and produces unnecessary risk.
Separate observation from participation
Reading a public page is different from creating an account, joining a community, messaging an operator, making a payment, or downloading a tool. Each additional action creates new legal, security, and privacy consequences.
For ordinary verification work, observation is usually enough. Do not perform transactions or “test purchases” to prove that a questionable service operates.
Protect personal information
Do not reuse:
- personal email addresses;
- usernames associated with other accounts;
- passwords;
- profile photographs;
- recovery phone numbers;
- cryptocurrency addresses tied to your identity;
- writing signatures that reveal an employer or location.
The simplest protection is often not to create an account at all.
Treat every download as a separate risk decision
A page can be harmless to read while its download is unsafe. Do not open executable files, scripts, archives, or office documents from an unverified service. Even a familiar file type can contain active content or metadata.
When documentation can be read in the browser, prefer that route.
Avoid financial interaction
A promise of privacy does not eliminate fraud, tracing, theft, or legal risk. A cryptocurrency request can still be linked to exchanges, wallets, devices, timing, and later transactions.
This publication does not verify commercial vendors and does not provide purchasing instructions.
Be careful with screenshots and evidence
Screenshots can capture:
- personal identifiers;
- browser tabs;
- system clocks and time zones;
- account details;
- victim information;
- unlawful imagery;
- addresses that should not be redistributed.
When documenting a public-interest address, collect only what is necessary. Redact personal and victim data. Do not save or forward suspected child sexual abuse material; use the appropriate specialist reporting channel and follow its instructions.
Recognize urgency tricks
Common pressure patterns include:
- “mirror changed—act now”;
- countdown timers;
- claims that only one seller is genuine;
- instructions to disable browser protections;
- demands for deposits before support will respond;
- promises to recover stolen funds;
- claims that a directory guarantees a vendor.
Urgency is a reason to slow down, not speed up.
Know the limits of directories
A directory can identify where a link was found. It cannot certify every operator behind it. Status checks, crowdsourced votes, and positive comments are all weaker than a first-party source.
Use the verification methodology and record uncertainty explicitly.
Exit cleanly
When the task is complete:
- close the relevant tabs;
- use Tor Browser’s identity controls where appropriate;
- store only necessary notes;
- remove temporary files;
- record the source and review date;
- report errors through a documented process.
The safest research session is the one that ends when its defined purpose has been met.