The link is the account system and the shop at the same time. Here is what the string means, how to move it without damage, and what a real one shows you that a copy cannot.
What is inside a 56 character label
nexusb2l7fmqnefwphyy7m5zjhlkytlbo7qbb5lu5dlczr3azgii2gyd.onion
- 5 letters what the market named the label after
- 50 characters the base32 public key of the service
- 1 character checksum at the end, Tor Browser checks it before routing
The first letters are vanity, the market chose a label that spells its own name. The long middle part is the public half of a key pair, which is why the address cannot be shortened or rewritten into something memorable: change one character and the key changes with it. Tor Browser checks the last character before it even tries to route, so a mistyped label usually fails with a service error instead of opening something wrong. That is the good outcome; the bad one is a clone holding a similar label and a familiar layout.
Because of that, the address belongs in your clipboard and not in your fingers. Every block on this page has one button per address and nothing else next to it. Once pasted, the string in the address bar should be compared with the banner inside the market and with the picture on the login screen; all three are the same text, and a mismatch is the whole warning you need.
And what a clearnet link is
Pages that reach you over an ordinary https domain are one of two things: an access page like this one, which publishes the addresses and sells nothing, or a page built to be logged into. The market itself keeps no clearnet checkout, so any page that asks for credentials on an https address deserves the same checks as the onion one, and a page that asks for coins first deserves no checks at all, just a closed tab.
Common questions about the link
What is the current Nexus Market onion address?
Three copies of one label, 56 characters each: 5 vanity letters, 50 characters of public key and 1 checksum character. The full strings sit at the top of this page and in the list above, with the date they were last updated.
Is an https link to Nexus Market the real thing?
It is a copy of the shop, not the shop. The market keeps no clearnet checkout, so a clearnet page with a login form is either a mirror site like this one or a page built to look like one.
Why should I never type the address?
A v3 label is 56 characters of base32: 5 letters of vanity plus 51 generated. One wrong character is a valid address belonging to somebody else, and for a market this copied that is a business model. Copying removes the mistake; the button next to each address here does one thing and nothing else.
What is the fingerprint in the login picture for?
It is the same onion address baked into the captcha image. A clone can copy the layout and the wording, but it has to generate its own picture, so the string inside the picture is the part that is hardest to fake.