Who Sees What
Awazon market onion addresses
awazonloedcyl2otgftfg7qm6e2klbgg2dhouyli3hdno6gdkueh6byd.onion
awazonozc4jwyrveu4473igv5ldt2hnccl2s7lerm2z27cvrc22e4uyd.onion
awazonth6ocz5cyos63czmhtsglqr7ydkdcc4lopux7nxbauoo2qmvyd.onion

Printed exactly as supplied, in the order supplied, with no labels and no ranking between them. This site runs no checks against any of them. It publishes no uptime figure, no status light and no date of last checking, because it never looks. An address that opens is not by itself evidence of anything.

Typing a delivery address into a form on the site

A delivery address is the only field on a market that points at a physical place. Everything else on the site is a label. This one is a location.

Who sees it

The market server · Whoever runs the platform · Anyone who later obtains the server

Every other exposure in this section is indirect. A username is a string. A timestamp is a number. A browse trail is a sequence. An address is different in kind, because it names somewhere a parcel can arrive and a person can be found. Treating it as one field among several is the mistake this card exists to correct.

The rule about forms, stated plainly

Anything typed into a form on a web page is received by the server that renders the next page. That is not a policy or an implementation detail, it is how a form works. The browser collects the field values and sends them to the server, which is what allows the server to act on them at all. Any encryption applied afterwards for the vendor's benefit is applied to something that has already arrived.

There is exactly one exception, and it is the whole of the interesting case. If the text was already encrypted before it reached the form, then what arrives is a block of unreadable characters, and the server received exactly that and nothing more. The encryption has to happen before submission, on your machine, in something that is not the page. Order of operations is the entire subject here.

Typed in plain, encrypted by the site
The server received the plain text first. Whatever it does next happens after receipt.
Encrypted elsewhere, then pasted in
The server received a block it cannot read. What it holds is the block, plus the fact that a block was submitted, by which account, at what time, and to which vendor.
Typed in plain, not encrypted at all
The server holds an address in readable form, and so does anyone who later obtains it.

What encrypting beforehand changes

Encrypting a note on your own machine before pasting it in changes one specific thing: the readability of the contents to anyone who is not the intended recipient. That includes the platform, and it includes anyone who obtains the platform later. It is the single largest available change to what this field discloses, and it is the reason sending an encrypted note is a card in its own right.

What it does not change

It does not hide that a message was submitted, by which account, to which vendor, or when. Those facts are structural, and they are the subject of the market inbox.

It does not protect the address from the vendor. The vendor is the intended reader. Encryption is aimed at everyone in the middle, and it delivers the plain text intact to the far end, which is what it is for. What the vendor then does with it is a separate question, dealt with in the address you hand over.

It does not undo an earlier plain submission. If the same address was typed in plain once, in a message, in a dispute, in a profile field or in an earlier order, that copy exists independently of every later encrypted one.

It does not deal with the copy on your own machine. Composing text somewhere before encrypting it means the plain version existed in an editor, possibly in an autosave, possibly on the clipboard. That is covered by the clipboard and what lands on the disk, and it is the most commonly overlooked half of this.

It does not make the address wrong. The parcel still has to arrive, so the postal system necessarily handles the real place, which is an entirely separate observer with its own section. See the outside of the packet.

Where people put the address without noticing

The order form is the obvious place. It is not the only one. An address, a name, a building description or a set of directions can end up in a message to a vendor asking whether they ship to a region, in a dispute explaining that nothing arrived, in a note added to an order after the fact, or in a profile field filled in once and forgotten. Every one of those is a form on the same site.

Partial disclosures accumulate. A region in one message, a city in another, a building type in a third, and the set is more specific than any member of it. Nothing has to join them deliberately for the effect to exist. They are all attached to the same account row.

What changes the answer

5 things change how much this action gives away. None of them takes it to zero, and none of them is a promise.

  1. Encrypt before the text touches the pageEncryption performed on your machine, in a separate tool, means the site receives a block rather than a place. This is the only step that changes what the server holds. It does nothing about who sent it, to whom, or when.
  2. Type the address once and nowhere elseEvery additional place the same details appear is another copy under the same account. Keeping it to the one field it belongs in limits the count. It does not affect the copy that field already holds.
  3. Keep messages free of location detailQuestions about shipping can be asked without naming a place, and disputes can be described without repeating an address. This avoids creating a plain copy beside an encrypted one, and it is unrelated to what the order form itself contains.
  4. Mind where the plain text was composedText encrypted before submission still existed in plain somewhere while you wrote it. Composing in a place that does not autosave, and not leaving it on the clipboard, addresses that. It has no effect on any observer other than your own device.
  5. Assume the field is permanentThe realistic assumption is that anything submitted in plain may be readable later by a party you have never dealt with. It is an assumption rather than a technique, and it is the one that most reliably changes what people type.

What this card is not

This card does not describe how any market handles addresses, and does not tell you how to encrypt anything. It states where in the sequence encryption has to happen for the server to receive something unreadable.

Questions that come up

If the site says it encrypts my address, is that the same thing?

Not for the question this card asks. Encryption applied by the site happens after the site has received the field. It may protect the value from other parties later. It cannot un-receive it.

Does the vendor see the address either way?

Yes. The vendor is the intended recipient, and a parcel cannot be sent to a place nobody knows. Encryption changes who else can read it in transit, not whether the far end can.