Verify before you type a password

Before entering a password, run the mechanical check. A valid v3 address is exactly 56 characters long, including the .onion ending. Count them out loud if you have to. If the count is off by even one character, stop. Do not proceed.

The body of the address must match one of the three specific strings listed on the mirrors page. This is a letter-by-letter comparison, not a visual scan. Humans miss subtle differences like b versus 8 or l versus 1 easily. Copy the string from the site and paste it into a plain text editor for side-by-side viewing.

If any single character fails the test, the address is wrong. Do not log in. Close the tab and reopen the correct mirror. Logging into a mismatched address means your credentials are being sent to an unknown server. Ten years of watching people skip this step confirms that saving thirty seconds here is worth the inconvenience.