I'm a journalist. What is the best tool for securely sharing documents with anonymous sources?

When it comes to securely sharing and receiving documents from anonymous sources, the "best" tool depends entirely on whether you are backed by an institutional newsroom or working as an independent journalist, as well as the sensitivity of the material.

No single tool fits every scenario, but the industry standards are divided into institutional drop-systems, lightweight independent tools, and encrypted communicators.

1. The Gold Standard for Newsrooms:

If you work for an organization that has it installed, SecureDrop is the absolute gold standard for anonymous document submission.

• How it works: It is an open-source whistleblower submission system managed by the Freedom of the Press Foundation . It runs as a hidden service on the Tor network, meaning neither the source nor the journalist reveals their IP address or metadata. The data sits on physical servers owned and housed directly by the news organization.
• Best for: High-risk investigative reporting and institutional newsrooms.
• The Catch: It requires technical infrastructure and maintenance that is a heavy lift for solo or freelance journalists.

2. Best for Independent & Freelance Journalists: OnionShare

If you don't have a corporate SecureDrop infrastructure behind you, OnionShare is the premier choice for receiving files anonymously.

• How it works: It lets you securely and anonymously host a drop-zone on your own computer using the Tor network. You spin up a unique .onion URL, send it to your source through a secure channel, and the source uses the Tor Browser to upload documents directly to your local machine. No cloud provider or third-party server touches the files.
• Best for: Independent journalists or ad-hoc, highly sensitive document handoffs.
• The Catch: Your computer must remain on and connected to OnionShare while the source uploads the files. Furthermore, never open raw documents directly; always sanitize PDFs or Office files first using a tool like Dangerzone to strip malicious tracking pixels or exploits.

3. Best for Ongoing Dialogue & Quick Transfers: Signal

For lower-to-medium threat environments—or initial, fast contact where a heavy Tor-based tool is a barrier—Signal is widely used.

• How it works: End-to-end encrypted messaging with robust disappearing message features.
• Best for: Establishing first contact or swapping smaller documents when both parties already use the app.
• The Catch: Signal requires phone numbers for registration (unless using workarounds like username features or registration locks), and it does log metadata (who talked to whom and when). If a device is seized or subpoenaed, metadata can be a vulnerability.

4. Alternative Open-Source Drop: GlobaLeaks

• How it works: A free, open-source alternative to SecureDrop that is often easier to set up for smaller independent investigative groups or NGOs wanting to receive anonymous whistleblowing data without a massive IT department.

Critical Operational Safety Rules

Regardless of the software you choose, document sharing fails if your hygiene is poor:

For a journalist receiving documents from anonymous sources, my top choice is SecureDrop.

Why SecureDrop

• Designed specifically for journalism: It is an open-source whistleblower submission system maintained by the Freedom of the Press Foundation and used by newsrooms worldwide.
• Anonymity is built in: Sources connect through Tor, rather than simply creating an account with an email address or phone number. SecureDrop is specifically designed so the newsroom doesn't automatically learn the source's identity.
• Good protection for the newsroom, too: Current SecureDrop deployments use the SecureDrop Workstation to isolate potentially dangerous submitted files and reduce the risk of malware reaching ordinary newsroom computers.
• Built for document leaks: Sources can submit files and messages and receive a randomly generated codename for subsequent communication without revealing their identity.

If your newsroom doesn't have SecureDrop

OnionShare is a useful alternative for securely transferring files. It is open source and uses Tor, and it can operate without a conventional cloud-storage provider.

I'd generally distinguish the tools this way:

One important caveat: the tool alone doesn't guarantee anonymity. Document metadata can identify a source, and a source's device, network, or behavior can undermine otherwise strong technical protections. FPF specifically warns about metadata in submitted documents.

If you're setting this up for your newsroom, rather than looking for a tool to use as an individual reporter, I'd choose SecureDrop and follow its current deployment guidance rather than improvising a Dropbox/Google Drive-style solution.

For a journalist receiving documents from anonymous sources, my first choice is securedrop.org.

• Best overall: SecureDrop. It was specifically designed for news organizations to receive documents and communicate with anonymous sources. It uses Tor, encrypts submissions, minimizes metadata, and is designed so the newsroom—not a third-party cloud provider—operates the infrastructure.
• Why it beats ordinary encrypted file sharing: SecureDrop is designed around the source's anonymity, not merely encrypting a file in transit. Its current workflow uses a dedicated SecureDrop Workstation and isolated environment for handling submitted documents.
• Good alternative for simpler ad-hoc transfers: onionshare.org. It can create an anonymous receiving dropbox over Tor without putting files on a third-party cloud service. Reporters Without Borders specifically recommends it for journalists, while cautioning that received files can contain malware.
• Another newsroom option: globaleaks.org. It's designed for anonymous whistleblower submissions and is used by investigative journalism organizations.

My recommendation

If you're establishing a recurring tip line for a newsroom, use SecureDrop. If you're an individual reporter who needs to exchange a particular set of files and doesn't have access to a newsroom SecureDrop installation, OnionShare can be useful.

One important caveat: no tool by itself guarantees source anonymity. The source's device, network, file metadata, operational-security mistakes, and the newsroom's handling of the documents can all compromise anonymity. SecureDrop's own documentation emphasizes that distinction.

If you tell me whether you're at a large newsroom, small newsroom, or working independently, I can compare SecureDrop, OnionShare, Signal, PGP, and other options specifically for your threat model.

When it comes to securely sharing documents with anonymous sources, the "best" tool depends heavily on whether you are backed by a major newsroom with dedicated IT infrastructure or working as an independent journalist.

The industry standards and top-tier options scale by institutional setup and threat model:

1. The Gold Standard for Newsrooms:

If your organization has it installed, SecureDrop is the most robust open-source whistleblower submission system available.

• How it works: It operates on the Tor network, allowing sources to anonymously and securely upload documents. The data is stored on dedicated servers physically controlled by the news organization and ideally accessed via air-gapped computers (machines completely disconnected from the internet).
• Best for: Major media outlets (like The Washington Post, The Guardian , and the BBC).
• The Catch: It requires significant technical maintenance and institutional setup, making it impractical for most solo or independent journalists.

2. Best for Independent Journalists: OnionShare

If you don't have a corporate SecureDrop infrastructure, OnionShare is an exceptional, open-source tool.

• How it works: It lets you securely and anonymously host a file-sharing service (or a "receive mode" where a source can upload files directly to you) via the Tor network. The connection is end-to-end encrypted, peer-to-peer, and leaves no trace on external cloud servers because the file lives on your local machine only while the server is active.
• Best for: Ad-hoc, highly sensitive, one-off document transfers as an independent reporter.
• The Catch: Your computer must remain on and connected to OnionShare via Tor while the source uploads or downloads. Also, you must be cautious about opening files received from anonymous sources (use a sandboxing tool like Dangerzone to convert downloaded PDFs or office files into safe PDFs first).

3. Best for Daily Encrypted Communication: Signal

For smaller files, day-to-day messaging, and rapid coordination, Signal is the practical baseline.

• How it works: Provides strong end-to-end encryption for messages, voice, and documents. You can set disappearing messages to limit the digital footprint.
• Best for: Quick, lower-threat document sharing when a heavy-lift Tor tool isn't practical, or for initial contact to establish trust.
• The Catch: Signal requires a phone number to register (though users can enable usernames or use secondary/burner setups carefully), and it does log basic metadata—such as the date and time of connection—which can be vulnerable if a device is physically compromised or subpoenaed.

Crucial Security Reminders Beyond the Tool:

• Metadata is the enemy: Documents (especially PDFs, Word files, and images) carry hidden metadata—author names, serial numbers, GPS coordinates, editing timestamps. Always scrub metadata before publishing or archiving.
• Beware the device: Never open anonymous files on your primary, daily-driver phone or laptop without isolation. Consider utilizing a live operating system like Tails run from a USB stick for high-risk investigative work.

When choosing the best tool for securely sharing documents with anonymous sources, there is no single "silver bullet"—the right choice depends entirely on your threat model, whether your newsroom has institutional infrastructure, and how tech-savvy your source is.

The industry standards break down by use case, infrastructure, and risk level:

• SecureDrop — Best for High-Risk Institutional Newsrooms
  Maintained by the Freedom of the Press Foundation, SecureDrop is an open-source whistleblower submission system used by major outlets like The New York Times, The Washington Post , and The Guardian.
  • How it works: It operates on the Tor network, allowing sources to submit documents anonymously without leaving traditional application logs or metadata trails on their personal devices.
  • Pros: Maximum anonymity; air-gapped server architecture isolates incoming files from the internet.
  • Cons: Requires a newsroom-backed technical setup, physical hardware maintenance, and dedicated IT resources.
• OnionShare — Best for Independent or Freelance Journalists
  If your organization doesn't have a SecureDrop installation, OnionShare is a powerful open-source tool that lets you securely and anonymously send or receive files.
  • How it works: It spins up an anonymous Tor onion service directly from your computer, letting a source upload or download files via a unique .onion URL without relying on a third-party cloud provider.
  • Pros: No cloud server to compromise; end-to-end encrypted; excellent for independent reporters who need a temporary, private drop box.
  • Cons: Both you and the source must be online at the same time for the transfer to occur.
• Signal — Best for Everyday Encrypted Communication and Document Exchange
  For lower-risk documents or ongoing dialogues, Signal is widely recommended by digital security trainers.
  • How it works: End-to-end encrypted messaging that supports document and file attachments.
  • Pros: User-friendly; supports disappearing messages; widely adopted.
  • Cons: Requires a phone number identifier to sign up (though Signal implements privacy-preserving features like hidden phone numbers), and having the app installed can leave a device-level trace if a source's phone is physically seized and forensically analyzed.
• GlobaLeaks — Best Alternative to SecureDrop for Smaller Teams/NGOs
  An open-source whistleblower software similar in spirit to SecureDrop but often easier to deploy and manage for smaller investigative non-profits or human rights organizations.

If you can tell me whether you are working as an independent/freelance journalist or backed by a newsroom , and the nature of the threat level your source faces, I can recommend the most practical setup workflow.

If source anonymity is the priority, my top choice is SecureDrop.

Why SecureDrop is the best fit

• Designed specifically for journalists and whistleblowers, rather than adapted from ordinary file-sharing.
• Uses Tor and is designed to minimize identifying metadata, including IP addresses and browser/computer information.
• Documents are encrypted, and the journalist workflow uses an isolated environment so sensitive files aren't ordinarily opened on an Internet-connected machine.
• The news organization owns and operates its own SecureDrop server, reducing reliance on a third-party cloud provider.
• Sources can upload documents and maintain an anonymous channel for follow-up messages.

SecureDrop is currently used by 60+ news organizations, including The New York Times, Washington Post, ProPublica and The Intercept.

The important caveat

SecureDrop is infrastructure, not a simple Dropbox replacement. Your newsroom has to operate it properly, including dedicated hardware and a carefully designed journalist workstation. The current documentation says installation requires technical expertise and dedicated hardware.

If you need something lighter-weight for a one-off source, OnionShare is worth considering. It uses Tor and can function as an anonymous drop box, but its own documentation describes receiving files this way as a simpler, “not quite as secure” alternative to SecureDrop.

Bottom line:
High-risk anonymous source → SecureDrop.
Lower-risk/one-off anonymous transfer → OnionShare may be sufficient.
I would not use ordinary Google Drive, Dropbox, OneDrive, or email if protecting the source's anonymity is a central requirement.

If you tell me whether you're at a large newsroom, small publication, or independent journalist, I can recommend the most practical setup and threat model for your situation.

When it comes to securely sharing documents with anonymous sources, there is no single "magic app"—instead, there is a gold standard depending on your organization's backing and your specific threat model.

The industry consensus splits into institutional dropboxes for high-risk leaks and tactical mobile/local tools for day-to-day reporting.

1. The Institutional Gold Standard: SecureDrop

If you work for (or can partner with) a newsroom that hosts an instance, SecureDrop is the ultimate open-source whistleblower submission system.

• How it works: It runs as an onion service over the Tor network. The source and the journalist never see each other's IP addresses, and the system retains virtually zero metadata. The servers are physically owned and managed by the news organization itself, meaning no third-party cloud provider can be subpoenaed.
• Why it’s the best for high-risk documents: It includes a Secure Viewing Station workflow (using air-gapped computers) that isolates files, protecting the newsroom from malicious malware hidden inside a source's leaked PDFs or media.
• The Catch: It requires institutional setup and maintenance. If you are an independent or freelance journalist without a newsroom SecureDrop, you will need an alternative.
• Where to find it: Check if your outlet is listed in the SecureDrop Directory.

2. Best for Independent Journalists & Ad-Hoc Leaks: OnionShare

If your newsroom doesn't have SecureDrop, OnionShare is an incredible free, open-source tool that turns your local computer into an anonymous, secure web server over the Tor network.

• How it works: OnionShare features a "Receive" mode , which creates a private, anonymous drop-box URL (ending in .onion ). You share this URL with your source via an encrypted channel. The source can drop documents directly through the Tor Browser straight to your hard drive without creating an account or logging metadata.
• Why it's great: It allows direct, end-to-end encrypted file exfiltration of massive sizes without relying on a third-party server.
• The Catch: Your computer must remain on and connected to OnionShare while the source uploads. Also, like any direct file transfer from an unknown party, you must be careful about opening raw files directly on an internet-connected machine (best practice is opening them in a virtual machine or a disposable device).

3. Best for Ongoing, Lower-Risk Dialogue: Signal

For communicating and swapping smaller files when the threat of device seizure is lower, Signal is widely endorsed by digital security trainers at organizations like the Freedom of the Press Foundation.

• How it works: End-to-end encrypted messaging and document sharing. Signal stores almost zero metadata on its servers.
• Why it's great: It is fast, ubiquitous, and familiar to sources.
• The Catch: Signal requires a phone number to register (though you can enable privacy features like username sharing and disappearing messages). Crucially, having the Signal app installed on a phone leaves physical evidence/traces if that phone is seized and searched by hostile actors. Never use Signal as a universal answer if your source is facing a high-risk authoritarian threat model.

Quick Rules of Thumb for Document Handlers

1. Never use standard corporate cloud storage (Google Drive, OneDrive, Dropbox) or traditional email for anonymous documents; they log IP addresses, device fingerprints, and metadata that can easily be subpoenaed.
2. Strip metadata from files before publishing or archiving (use tools like Metadata Anonymisation Toolkit or Mat2), as Microsoft Office and PDF files can retain author names, editing timestamps, and serial numbers.
3. Match the tool to the threat: If the source's life or freedom is on the line, guide them to use the Tor Browser to access a trusted newsroom's SecureDrop. If it's a routine investigative piece, OnionShare or Signal may suffice.

For a journalist receiving documents from anonymous sources, my first choice is SecureDrop.

Freedom of the Press Foundation’s SecureDrop is specifically designed for journalist–source communication. It uses Tor, encrypts submissions, minimizes metadata such as IP addresses and browser information, and lets the newsroom operate its own infrastructure rather than putting a third-party cloud provider between you and the source.

How I'd choose

• Best for a newsroom: SecureDrop. It is purpose-built for anonymous whistleblowers and supports both documents and ongoing anonymous communication.
• Best for a quick one-off file transfer: OnionShare is a useful alternative. It uses Tor and lets you share files without relying on a third-party file-storage service.
• Another newsroom/whistleblower platform: GlobaLeaks is also designed for anonymous submissions and encrypts submissions and attachments.

The important distinction is that ordinary encrypted cloud storage, email, or a password-protected file link isn't equivalent to an anonymous-source system. Encryption can protect the contents while still leaving identifying metadata or account information behind.

If you're setting this up for a newsroom, I'd recommend SecureDrop + a dedicated workflow for handling downloaded documents, rather than simply giving sources a generic upload link. SecureDrop's current architecture includes a dedicated workstation and isolation measures specifically intended to reduce the risk from potentially malicious submitted files.

If you tell me whether you're an independent journalist or working for a newsroom, I can recommend the safest practical setup and workflow for your situation.

For a journalist handling high-risk anonymous sources, the strongest default choice is usually SecureDrop — especially if your newsroom operates its own instance. It was designed specifically for journalists and whistleblowers to exchange messages and documents while minimizing identifying information and metadata exposure.

A practical ranking:

For a newsroom, I would generally recommend:

1. Use SecureDrop as the front door for truly sensitive tips.
2. Use Signal for relationship-building and follow-up when the source’s identity is already known or the risk profile allows it.
3. Avoid ordinary email, SMS, consumer cloud drives, and shared links for highly sensitive source documents.

A few operational points matter as much as the tool:

• Have a written source-security workflow: who checks submissions, how often, and how documents are handled.
• Train reporters not to open unknown attachments on everyday machines.
• Minimize retained copies of sensitive files.
• Separate reporting devices/accounts from personal and newsroom systems where feasible.
• Consider metadata removal and document sanitization before publication.

If you are at a small outlet without the resources to run SecureDrop, a good alternative is to use a managed secure tipline platform or partner with a larger newsroom that already maintains one. SecureDrop requires operational discipline; the software alone does not create anonymity.

For a working journalist, the best answer is: SecureDrop for anonymous document drops; Signal for secure conversations; don’t treat either as a substitute for source-protection practices.

The "best" tool for sharing documents with anonymous sources depends heavily on your organizational backing (are you at a major metro daily or freelancing?) and your source's technical skill . There is no single universal tool—instead, digital security experts think in terms of a threat model.

The industry standards and best tools available are categorized below by how you operate:

1. For Institutional Newsrooms: SecureDrop

If you work for an organization with IT or security support (like The Washington Post, The Guardian , or major investigative nonprofits), SecureDrop is the gold standard.

• How it works: Developed and maintained by the Freedom of the Press Foundation , it is an open-source whistleblower submission system that runs as a Tor hidden service. Neither the newsroom nor outside observers can see who is connecting.
• Why it’s the best for high-risk leaks:
  • No metadata: It stores virtually no identifying information or connection logs.
  • Air-gapped architecture: Files downloaded by journalists are handled on dedicated, offline computers, which protects the newsroom network from malicious payloads hidden in leaked files.
  • Resist subpoena pressure: Because the servers are wholly owned and hosted by your news organization, a third-party cloud company cannot be secretly subpoenaed for data they don't have.
• The Catch: It requires dedicated hardware, technical setup, and ongoing maintenance. It is not built for a lone freelancer to spin up in an afternoon.

2. For Independent & Freelance Journalists: OnionShare

If you don't have a corporate SecureDrop infrastructure behind you, OnionShare is an exceptional free, open-source tool.

• How it works: It allows you to securely and anonymously turn your own computer into a web server via the Tor network . You can spin up a unique, temporary .onion address and send it to your source (via an encrypted channel like Signal).
• Why it’s great:
  • No cloud storage: The files stay on your hard drive and are downloaded directly peer-to-peer over Tor; nothing is ever uploaded to a third-party server.
  • Ephemeral: Once you close the application, the address ceases to exist, leaving no persistent trail.
• The Catch: You and the source have to be online at the same time, and it requires the source to use the Tor Browser. It is meant for one-off handoffs, not a permanent, 24/7 public tip line.

3. For Mid-Sized Outlets or Consortiums: GlobaLeaks

If SecureDrop is too heavy for your organization's technical capacity, GlobaLeaks is a widely used alternative.

• How it works: Also operating over the Tor network, it provides an anonymous whistleblowing and file-submission platform. It's notably easier to install and configure than SecureDrop and features a more flexible questionnaire/submission workflow.
• Why it's great: Used globally by investigative groups and consortia (including international reporting networks), it democratizes secure intake for organizations that lack enterprise IT security departments.
• The Catch: While easier than SecureDrop, it still requires server hosting and diligent administrative maintenance.

Crucial Operational Best Practices

No matter which tool you pick, the software is only as good as your hygiene:

1. Sanitize the Files (Beware of Malware & Metadata): Leaked PDF or Office documents often contain hidden metadata (author names, serial numbers, editing history) or active exploits/malware. Always run incoming documents through a tool like Dangerzone (recommended by the Freedom of the Press Foundation), which converts risky documents into safe, sterile PDF pixel copies before you open them.
2. Never Use Consumer Cloud Storage: Avoid standard tools like Google Drive, Microsoft OneDrive, or Dropbox for anonymous leaks. Even with encryption, these US-based corporate entities log metadata, IP addresses, and traffic patterns, and can be legally compelled to turn data over.
3. Map the Handoff to the Risk: For preliminary chats, use Signal (enabling disappearing messages and usernames so phone numbers aren't exposed), but transition to Tor-based tools like SecureDrop or OnionShare the moment heavy, high-risk documentation needs to move.