Tile captcha, honeypot, careful registration.
Three things happen between arriving and being signed in, and each one confuses somebody.
Arrivals are held briefly before the form appears. This is flood absorption, not a fault, and it exists because hidden services have no upstream provider to soak up abuse. Passing it issues a token that carries you through on the next request.
Four causes. Storage blocked for that address, so the token never persists and every visit is a first visit. A circuit change between passing and using the token. A reload during the check, which throws away a nearly complete pass. Or saturation, where the gate is shedding arrivals. Letting one attempt run untouched resolves most of them, and opening the market in several tabs guarantees the opposite.
Anything reused from elsewhere links this account to a history you did not intend to attach to it, and the linking is trivial for anybody who looks. There is no way to unpick it afterwards, which makes this a thirty second decision with a permanent effect.
Generated, long, used nowhere else, kept in a manager running on your own machine. The recovery phrase goes on paper before you click past the screen showing it. Not a screenshot, since galleries sync, and not a note in an application that backs up under your name.
It converts a stolen password into a nuisance. Turn it on during registration rather than intending to later, because later has a habit of not arriving, and the window in between is the one where a credential leaked from an unrelated site is sufficient on its own.
Anubis Market