Every character weighs the same

The claim people make is that you have to check the whole thing. Correct, and the interesting part is why there is no shortcut hiding anywhere in the string.

Why there is no shortcut

In some identifier formats, part of the string is structure. A card number has an issuer prefix. A registration number might encode a region. Onion addresses have nothing like that. The bytes are the output of a key generation process, which means they are indistinguishable from random.

Random has a specific consequence here. You cannot tell from looking whether a character is important, because they are all equally unpredictable. There is no low information region to skim.

The one apparent exception

The addresses on this site start with the market's name. That looks like structure, and it is not. Those characters were produced by generating keys over and over until one came out with a readable start. The prefix is a coincidence somebody paid for in electricity.

Which means the readable part is the single least trustworthy part of the string, because it is the part somebody chose to make. Anyone else can make it too. The prefix page covers what that costs and why it is affordable.

How people actually check

Badly, and predictably. Eyes go to the first six characters and the last four. The middle is a blur and everybody knows it is a blur, which is why the middle is where a lookalike address will differ.

The fix is not to concentrate harder. It is to stop comparing by eye. Paste both strings somewhere they can be compared mechanically, or paste the one you trust and never type any of it. Human character comparison over 56 random symbols is a task people are bad at and do not get better at with practice.

The checksum does not save you

There is a two byte checksum in the address and it does exactly one job. It catches accidental corruption before your client wastes time on a lookup. It does not catch a deliberately generated lookalike, because whoever generated it produced a valid checksum along with everything else.

So a client accepting the address as well formed means it was not mangled in transit. It does not mean it is the awazon market url you wanted.

A better habit

Keep one copy you trust, in a place you control, and never produce a second one by hand. Copy from that place every time. The number of copies is the number of chances to introduce an error, and hand copying an awazon market address is the highest risk operation most people perform in a week.

If you must compare two strings, compare them as a machine would. Put them on consecutive lines in a plain text editor and look at whether the ends line up, or search for one inside a page containing the other. Both are faster than reading and neither depends on attention.

What would move this

An address format with a human meaningful component, such as a registered short name plus a key fingerprint. That format exists in other systems and it does make partial checking meaningful, at the cost of adding a registry. If onion addresses ever gained one, this statement would become conditional and the condition would be which part of the string you were looking at.

• Checking the first characters
• Why 56
• The addresses