PGP, done once

PGP does three jobs here. It checks signed posts, it hides your address from anyone but the vendor, and it locks your login so a stolen password is not enough. Set it up once and forget about it.

Make a key

gpg --full-generate-key
gpg --armor --export "you@handle" > mypub.asc

Check signed lists

Import the market key once and check any signed address list, the way the verify page shows.

Encrypt to a vendor

gpg --recipient VENDOR --armor --encrypt address.txt

Paste the result into your order so only the vendor can read it. Do it on your own machine. The point of PGP is that the plain text never leaves you.

Lock your login

Turn on PGP login in your account. From then on the market gives you a coded challenge, you decrypt it on your side and paste the answer back. Someone with your password still cannot get in.

Updated 2026-07-16 · Security