← Privacy Guides

Communications

Secure file sharing: hand over a file without a middleman

Emailing an attachment or dropping a file on a shared drive leaves a readable copy on servers you do not control. OnionShare lets you send a file straight from your computer to the recipient over the Tor network, with no company in the middle; this guide shows when to use it, how, and what it cannot do.

  • Medium threat
  • Time 30 minutes
  • Difficulty Moderate
  • Last verified

What this protects, and what it doesn't

Protects

  • Third-party copies: with OnionShare the file goes directly from your device to the recipient, so no cloud, email host or transfer service keeps a copy.
  • Identity exposure of the endpoints: traffic rides the Tor network, so when the recipient connects over Tor they do not learn your IP address and the network does not see the file contents. (Getting the address and key to them is a separate step that may not itself be anonymous.)
  • Link guessing: the address is a long random onion address protected by a private key, not a short guessable link.
  • Lingering availability: a "share" can stop automatically after the first download, so the file is not left reachable indefinitely.

Does not protect

  • It only works while your computer is online. OnionShare serves the file from your own machine; if you close the laptop or lose connectivity, the transfer stops until you are back.
  • You still have to deliver the address safely. Anyone who gets the onion address and key can fetch the file, so send them over a separate secure channel (not the same email you are trying to avoid).
  • The recipient usually needs Tor Browser — though OnionShare 2.7 and later add a Download Mode that can fetch a share without it. Plan for whichever the recipient can use.
  • It does not vet the recipient. Encryption and anonymity do not stop you from sending to the wrong person; confirm who you are talking to.
  • Very large transfers over Tor are slow. It is built for privacy, not speed.

Prerequisites

  • OnionShare installed on your computer (Windows, macOS or Linux).
  • A separate secure channel (such as Signal) to send the recipient the onion address and private key.
  • The recipient has Tor Browser, or OnionShare 2.7+ (its Download Mode can fetch a share without Tor Browser).

Step by step

  1. How OnionShare works

    OnionShare is free and open-source. When you share something, it starts a small web server on your own computer and publishes it as a Tor onion service, protected by a private key. It hands you a long .onion address; the recipient opens that address in Tor Browser and downloads the file. Because your machine is the server, no company ever holds the data, and Tor hides the network addresses of both ends. There is no account and no upload to anyone else’s storage.

  2. Pick the right mode

    OnionShare has four modes; the first two cover most needs:

    • Share Files — send files to someone. You can set it to stop sharing after the first download.
    • Receive Files and Messages — turn your computer into a drop box so someone can send you a file or a note, useful when you do not want them emailing it.
    • Host a Website — serve a static site as an onion service.
    • Chat Anonymously — an ephemeral chat room over Tor.

  3. Send a file

    1. Open OnionShare and choose Share Files; add the files or folders.
    2. Leave "Stop sharing after files have been sent" enabled unless the same file must go to several people.
    3. Start sharing. OnionShare connects to Tor and gives you the onion address and a private key.
    4. Send the address and key to the recipient over a different secure channel — for example a Signal message — never in the clear.
    5. Keep your computer awake and online until the recipient confirms the download, then stop the share.

    If Tor is blocked on your network, OnionShare can try to connect using automatic censorship circumvention, or you can set Tor bridges manually.

  4. Receive a file from someone

    To collect a file without the sender using email or a cloud link, choose Receive Files and Messages, start it, and send the sender the onion address and key. They open it in Tor Browser and upload to you. For a journalist or anyone taking submissions, this is a lightweight alternative to a full secure-drop system, though it offers none of the newsroom workflow around one.

  5. When OnionShare is not the right tool

    OnionShare is ideal for a direct, no-middleman transfer, but both parties must be online and willing to use Tor. For other situations:

    • Both already use Signal: sending the file as a normal attachment there is end-to-end encrypted and simple (mind the "send as file" metadata note in Remove hidden metadata).
    • You want a stored, resumable copy: put it in end-to-end encrypted cloud storage and share access deliberately.
    • A file that must stay encrypted at rest for the recipient: encrypt it into a container first (see Encrypted files and containers) and send that.

Common mistakes

  • Sending the onion address and the private key through the very channel you are trying to avoid (plain email), which hands the file to anyone reading it.
  • Closing the laptop or letting it sleep mid-transfer, which stops the share before the file arrives.
  • Leaving "stop after first download" off and forgetting the share is still live for anyone with the link.
  • Expecting fast transfer of huge files over Tor; use it for sensitivity, not bulk speed.
  • Assuming anonymity vets the recipient — double-check you are sending to the right person.

Going further

OnionShare runs on Tor, so it pairs naturally with Tor Browser on the recipient’s side. For routine encrypted messaging and file hand-offs between people who both use it, see Messaging apps compared and Signal hardening. For the highest-risk situations, read High-risk messaging.