What a working link actually means
The word working hides three different questions, and people asking it usually mean the least important one.
Working is the most searched and least precise word on this beat. Somebody typing it into a search box is asking one of three things, and the one they usually mean is the one that matters least.
The three questions
Does it load. The weakest sense, and the one most people mean. A phishing clone loads. A clone loads faster than the real platform, because it has no load on it and no defences to run. Loading is not evidence of anything except that a machine answered.
Is it current. Whether the address is still in the production pool rather than one that was retired. Better, and checkable against a roster, but a roster is only as trustworthy as its source and retired addresses are exactly what gets recycled by other people.
Is it genuine. Whether the thing answering holds the key it claims to. This is the only question with a definitive answer, and the answer comes from a signature rather than from anything you can see on the page.
Why the first two mislead
They correlate with genuineness in ordinary conditions, which is exactly what makes them dangerous. Most of the time a current address that loads is genuine, so the habit of checking only those things works most of the time and builds confidence. The habit fails precisely in the situations it was supposed to protect you in, which is when somebody has gone to the trouble of setting up a convincing clone.
The clearest illustration is a retired address that starts answering again. It loads. It is an address you recognise, possibly one you used for a year. Every heuristic short of a signature check says it is fine. It is not fine, and nothing about the experience of using it will tell you so.
The bar this site applies
An address is published here when it answers our probe, appears on the current roster, and carries a signature that verifies against the pinned fingerprint. All three, and the third is not negotiable. An address that satisfies the first two and fails the third does not go on the page, and an address we cannot verify does not go on the page even if we believe it is real.
That policy costs us occasionally. A genuine new mirror sometimes circulates for a while before we can confirm it, and during that window this site looks out of date next to sites that publish whatever they find. That is the correct trade. Being late with a real address inconveniences a reader. Being early with a fake one costs them their account.
What to do with a link someone sent you
Treat where it came from as carrying no information at all. A link from a forum you trust, a person you have talked to for years, or a site that has been right before, is exactly as unverified as a link from a stranger. Not because those sources are dishonest, but because none of them can prove anything about the address, and the one thing that can prove it takes under a minute to check.
Verified working Nexus Market mirrors
Three v3 onion addresses currently serving the production market, signed under PGP fingerprint 0x7F2A0A9D. Use the Copy buttons.