The route, in order
1. Install Tor Browser from the Tor Project
Download only from the official site, verify the signature on the first install, and set the security level to Safest. An ordinary browser cannot open an onion address, and a copy of Tor Browser from a forwarded link is not one to trust.
2. Copy an address from the index
Take one from the address list rather than typing it. Fifty six characters of noise is not something to reproduce by hand, and a single wrong character can land you on a lookalike.
3. Open it and read the login screen
Before anything is typed, compare the onion printed on the page against the one in your address bar. The market prints it inside the anti-phishing image and in the header. A mismatch means close the tab.
4. Set the account up properly
A username used nowhere else, a long unique password generated in a local manager, the recovery phrase written on paper, and PGP two factor enabled. No genuine login ever asks you to type the recovery phrase.
5. Keep the index bookmarked
When an address goes quiet, the replacement should already be in front of you. Searching for one during an outage is the single most reliable way to end up on a clone.
Addresses to start from
nexusb2l7fmqnefwphyy7m5zjhlkytlbo7qbb5lu5dlczr3azgii2gyd.onionnexusma2iekjhhyenua3u4zlyfsj2ubwxr2nt6gdte5rvwukzze63fyd.onionnexusabcdrstn74osnr67fsbzbo44kjpxqbbz5ymcwhlxjg6dloyhoyd.onionA login page that asks for your recovery phrase is a fake, without exception. Close the tab and start again from a verified address.
What the first session looks like
Expect it to be slower than a normal website and expect that to be normal. Traffic is routed through several relays before it reaches the market, so pages take a beat to load and images take longer. That latency is the privacy working rather than a fault, and rushing it by lowering the security level or switching to an ordinary browser removes the entire point of being here.
The login screen itself is the only part worth slowing down for. Read the address printed on it, compare it with your bar, and only then type. Everything after that is ordinary web use with a longer wait between clicks.
Mistakes that catch people
Typing an address from memory is the first, and it is why the index exists. Reusing a username from a forum or another market is the second, because it ties an anonymous account to something that is not anonymous. Leaving the security level on Standard is the third, since it keeps scripting enabled for no benefit on a market that works fine without it.
The fourth is impatience during an outage. Somebody whose usual address is quiet goes looking, finds a page that looks right, and signs in. There is no way to recover from that, which is why waiting is a technique rather than a lack of one.