Feather, Cake and the official GUI. All three route through Tor and all three hand you words that matter more than the software.
Coin left on an exchange belongs to the exchange, sits under the identity you signed up with, and can be frozen or lost with the service. A wallet on your own machine holds the keys locally and asks nobody permission to spend.
A light desktop wallet, quick to set up, with a built in Tor option and an interface that does not get in the way. For most buyers this is the sensible default and the easiest place to start.
The strong option on a phone, on both platforms, with Tor routing available. Useful if you want the wallet with you rather than tied to a desktop. Set a real device lock before putting anything into it.
Monero own desktop wallet and the most complete of the three. It can run a full node for maximum independence, which costs disk space and a sync, or connect to a remote node over Tor instead. The choice for somebody who wants to run things themselves.
Every one of these gives you a recovery seed when you create it. Those words are the wallet. The software is replaceable, the words are not. Write them on paper, store them away from the device, and never type them into a website or paste them into a chat. Anyone holding the seed holds the coin, and no genuine service will ever ask for it.
blackops5l63qnwnmlnsfvtlu66md3x3vp3fdtpna42eq7ozujr67hid.onionblackops6kignp3eddmvqcfkjzf6qr6haxbmkypc2xtqlnhuu4ak4dqd.onionblackops27m32abqvbhnyswgazqawxqbznbzkkkv5sjo7gve2ndpsdad.onionBefore you sign in. Open these in Tor Browser only, and compare the onion printed on the login screen against your address bar. If they do not match, close the tab.
Two of three keys, held by three different parties. It is why a stranger ships to you first.
The deposit itself is dull. The routing before it is where the care goes.
A clone can copy the design perfectly. It cannot show you the real address while living somewhere else.
Three addresses, all reaching the same market. Which one you take does not matter, but where you take it from does.