How Bloom Works

What is Bloom?

Bloom is a Tor-native marketplace. There are no passwords, no emails, no tracking scripts. Your identity is a PGP keypair that lives on your machine. The server never sees your private key. Every page is plain HTML — no JavaScript runs in your browser.

You log in by proving you hold a private key. You pay with Bitcoin or Monero. Deliveries are discreet.

Step 1 — Get a PGP Key

You need a PGP keypair. The public half goes on Bloom; the private half stays on your machine.

Windows

Download Kleopatra from gpg4win.org. Open it. Click New Key Pair → Create a personal OpenPGP key pair. Enter any name and email (can be fake). Set a passphrase you'll remember. Click Create.

macOS

Install GPG Suite from gpgtools.org. Open GPG Keychain. Click New. Enter a name, email, and passphrase. Click Generate.

Linux

Open a terminal and run:

gpg --full-generate-key

Choose EdDSA (Ed25519) when asked. Set no expiry unless you want to rotate keys on a schedule.

Tails / Whonix

GPG is already installed. Open a terminal and run the same command above.

Step 2 — Export Your Public Key

You need the ASCII-armored version of your public key to paste into Bloom.

Kleopatra (Windows)

Right-click your key → Export. Save as a .asc file, or copy the text.

Terminal (any OS)

gpg --armor --export you@example.com

Copy everything from -----BEGIN PGP PUBLIC KEY BLOCK----- to -----END PGP PUBLIC KEY BLOCK-----, including those lines.

Step 3 — Register on Bloom

1. Go to /register
2. Pick a username — this is your public alias, choose wisely
3. Paste your full public key block
4. You will receive 24 recovery words
5. Write them down on paper. If you lose your PGP key, these 24 words are the only way back into your account. Do not save them on your computer.
6. Verify 3 random words to prove you wrote them down

Step 4 — How Login Works

Bloom uses a PGP challenge-response flow. No password is ever sent or stored.

1. Enter your username at /login
2. Bloom encrypts a random token with your public key
3. Download the .asc challenge file
4. Decrypt it on your machine:

   gpg --decrypt bloom-challenge.asc

5. Paste the decrypted token back into the form

Only someone holding the matching private key can decrypt the token. This is how Bloom knows it's really you — without ever seeing your private key or a password.

Step 5 — Start Shopping

1. Browse the Market — filter by category, search, sort
2. Add items to your Bag
3. At checkout, you will need to elevate to Trade tier — another quick PGP challenge
4. Choose Bitcoin (BTC) or Monero (XMR) to pay
5. Track your order from the Orders page

Security Tips

• Never share your private key. Anyone with it can impersonate you.
• Use Tor Browser for maximum privacy. Bloom is built for it.
• Set Tor Browser to Safest mode. Bloom needs zero JavaScript.
• Back up your 24 recovery words on paper, not digitally. A screenshot can be stolen; paper in a lockbox can't.
• Your alias is public; your PGP fingerprint is your real identity.
• Check the warrant canary each time you log in. It's embedded in every challenge file.
• Verify signatures. If something feels off, check that PGP signatures validate.