SecureDrop Onion Address: Secure Document Submission Over Tor

SecureDrop is free, open-source software designed to allow journalists and news organizations to receive anonymous tips and documents from sources. The onion address variant exists because it provides an additional layer of anonymity compared to accessing SecureDrop through standard HTTPS. When you connect via Tor to a SecureDrop onion address, your traffic is routed through multiple Tor relays before reaching the destination, and the receiving server's IP address remains hidden. This dual anonymity—both client and server—is critical for whistleblowers facing surveillance or legal risk. Each news organization that runs SecureDrop hosts its own onion instance, so there is no single universal SecureDrop onion address; instead, each organization publishes its own .onion URL on its official website or through verified channels.

Phishing clones of SecureDrop onion addresses are common, so verification is essential before submitting sensitive documents. Follow these steps to confirm authenticity: First, visit the official website of the news organization or institution you wish to contact using standard HTTPS in your regular browser. Look for a link labeled 'SecureDrop,' 'Submit a Tip,' or 'Leak Documents'—this link should point to their onion address. Second, check if the organization publishes a PGP public key or security statement alongside the onion URL; legitimate SecureDrop instances often include a PGP fingerprint for additional verification. Third, cross-reference the onion address with the Freedom of the Press Foundation's directory of known SecureDrop instances if available. Never click an onion link from an email, forum post, or untrusted source without first verifying it through the organization's official website. A v3 onion address (56 characters long) is more secure than a v2 address (16 characters), so prefer v3 addresses when available.

To access a SecureDrop onion address safely, use the official Tor Browser rather than a general Tor client. Download Tor Browser from the official Tor Project website only—never from third-party mirrors or app stores. After installation, launch Tor Browser and allow it to connect to the Tor network; this process typically takes 30–60 seconds. Once connected, you will see a green onion icon in the address bar. Open a new tab and paste the SecureDrop onion address into the address bar. Tor Browser will route your connection through the Tor network before reaching the onion service. Do not maximize your browser window, as this can make your browser fingerprint easier to track; Tor Browser defaults to a standard window size for privacy. Disable JavaScript in Tor Browser's security settings if you are submitting highly sensitive material, as JavaScript can potentially leak your real IP address in certain attack scenarios. Keep Tor Browser updated to the latest version to receive security patches.

Onion addresses are cryptographic identifiers derived from the public key of the hidden service. A v3 onion address consists of 56 alphanumeric characters followed by '.onion'—for example, a typical format is 'abcdefghijklmnopqrstuvwxyz1234567890abcdefghijklmnopqrst.onion'. The v3 standard, introduced in 2019, replaced the older v2 format (16 characters) due to security improvements. V3 addresses use stronger cryptography and are resistant to certain types of attacks that affected v2 addresses. When you access a v3 onion address, Tor performs a cryptographic handshake with the hidden service to verify its authenticity; this process is transparent to the user but provides protection against impersonation. The address itself does not reveal the server's location or the organization's identity unless you already know who operates it. This design means that even if you see an onion address, you cannot determine its purpose or owner without additional context.

Several operational security errors can undermine your anonymity when submitting documents via SecureDrop. Using your regular browser instead of Tor Browser exposes your real IP address to the receiving server. Submitting documents with embedded metadata—such as creation dates, author names, or file properties—can identify you even if your IP is hidden; use a tool to strip metadata before uploading. Logging into personal email accounts, social media, or other identifying services while using Tor Browser on the same device can create a linkage between your anonymous submission and your real identity. Submitting documents that contain unique information known only to you (such as internal emails with your name or specific project details) can lead to identification through process of elimination. Resizing your Tor Browser window to fit your screen or installing browser extensions can make your browser fingerprint unique and trackable. Accessing SecureDrop over an insecure network (public WiFi without a VPN) before connecting to Tor can expose your traffic to network-level monitoring. Always assume that the document itself, not just your connection, is the primary vector for identifying you.

Tor, VPN, and I2P are three distinct technologies for anonymous communication, each with different strengths. Tor routes traffic through multiple volunteer-operated relays, hiding your IP address and the destination server's IP address; it is designed for accessing both clearnet and onion services. A VPN encrypts your traffic and routes it through a single provider's server, hiding your IP from the destination but not hiding the destination from your ISP; VPNs are faster than Tor but offer less anonymity because the VPN provider can see your traffic. I2P is a decentralized network designed for internal communication and file sharing; it is less suitable for accessing external websites but offers strong anonymity for peer-to-peer applications. For accessing SecureDrop, Tor is the recommended choice because it hides both your IP and the server's IP, and SecureDrop is specifically designed to work with Tor. Using a VPN in addition to Tor does not significantly increase anonymity and may introduce new risks if the VPN provider is compromised. I2P is not compatible with SecureDrop and is not designed for this use case.

After submitting documents through a SecureDrop onion address, do not check back immediately or repeatedly, as this can create a pattern that links your submissions. Most SecureDrop instances provide a unique codename or message key that allows you to check for responses from journalists without logging in with credentials. Store this codename securely and separately from the documents you submitted. Do not discuss your submission with anyone, including friends or family, as this is the most common way anonymous sources are identified. If the news organization publishes a story based on your submission, do not confirm or deny your involvement, even indirectly. Monitor the organization's website and news output through Tor to see if your information has been acted upon, but do not access the SecureDrop interface more frequently than necessary. If you need to submit additional documents, use a fresh Tor Browser session and avoid reusing the same codename across multiple submissions if possible. Remember that the news organization may contact you through SecureDrop's messaging system, so check back periodically for responses.