OnionShare

onionshare.org
Awesome Privacy➔ Productivity➔ File Drop➔ OnionShare
OnionShare

An open source tool that lets you securely and anonymously share a file of any size, via Tor servers. OnionShare does require installing, but the benefit is that your files are transferred directly to the recipient, without needing to be hosted on an interim server. The host needs to remain connected for the duration of the transfer, but once it is complete, the process will be terminated.

Avoid

  • wetransfer
  • send anywhere
  • filemail
  • smash

Also Consider

Open Source

OnionShare Source Code

Author

onionshare

Description

Securely and anonymously share files, host websites, and chat with friends using the Tor network

#cross-platform#file-sharing#onion-service#onionshare#open-source#python#security#tor#tor-onion-service

Homepage

https://onionshare.org/

Repository

  • LicenseOther
  • Created20 May 14
  • Primary languagePython
  • Size42,879 KB
  • Stars7,123
  • Forks724
  • Watchers7,123

Language Usage

Language Usage

Project Health

  • Last commit7 days ago
  • Open issues65
  • Latest releasev2.6.5

Top Contributors

Recent Commits

  • mig5(06 Oct 26)

    Merge pull request #2120 from mdaleo404/mdaleo404/receive-max-upload-size Add size limit in receive mode

  • Miguel Jacq(06 Oct 26)

    Set a more realistic upload max size if the user checks the box (0.1kb is a funny default)

  • Miguel Jacq(06 Oct 26)

    only show the 'Apply this maximum for the service's entire lifespan' checkbox when the user has selected the 'Set a maximum' checkbox

  • Marco D'Aleo(05 Oct 26)

    Support per-request and persistent lifespan limits in CLI and Desktop receive mode

  • mig5(06 Oct 26)

    Merge pull request #2067 from Gerijacki/feat/2035-webtunnel-bridge-support feat: add WebTunnel pluggable transport bridge support

  • Miguel Jacq(06 Oct 26)

    Remove cd into webtunnel-client on snap build

  • Miguel Jacq(06 Oct 26)

    Fix webtunnel compile on snap

  • Miguel Jacq(06 Oct 26)

    Update snowflake and set webtunnel in flatpak/snap logic

  • Miguel Jacq(06 Oct 26)

    Fix Moat bridge requests and drop WebTunnel from built-in bridges - Point meek at the correct moat reflector (1723079976.rsc.cdn77.org); the CDN77 bridge meek cannot relay to bridges.torproject.org, which broke "Request a bridge" with SSL verification errors - Handle network errors in MoatDialog so failures are shown instead of a blank dialog; strip trailing newline from the meek port - Let the user pick the bridge type (obfs4/webtunnel) to request from BridgeDB, since it always serves the first transport of the fetch request's supported list - Remove WebTunnel from the built-in bridges dropdown: there are no built-in webtunnel bridges, so selecting it produced a fatal torrc; fail with a clear error instead if stale settings request it - Update Snowflake while I'm here

  • Saptak Sengupta(05 Oct 26)

    Merge pull request #2109 from weblate/weblate-onionshare-translations Translations update from Hosted Weblate

  • Besnik Bleta(05 Oct 26)

    Translated using Weblate (Albanian) Translate-URL: https://hosted.weblate.org/projects/onionshare/translations/sq/

  • Hosted Weblate(05 Oct 26)

    Update translation files Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Translation: OnionShare/Doc - Install Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-install/ Update translation files Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Translation: OnionShare/Doc - Sphinx Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-sphinx/ Update translation files Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Translation: OnionShare/Doc - Features Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-features/ Update translation files Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Translation: OnionShare/Doc - Index Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-index/ Update translation files Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Translation: OnionShare/Doc - Tor Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-tor/ Update translation files Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Translation: OnionShare/Doc - Develop Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-develop/ Update translation files Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Translation: OnionShare/Doc - Help Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-help/ Update translation files Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Translation: OnionShare/Doc - Security Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-security/ Update translation files Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Translation: OnionShare/Doc - Advanced Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-advanced/

  • Arif Budiman(05 Oct 26)

    Translated using Weblate (Indonesian) Currently translated at 100.0% (54 of 54 strings) Translation: OnionShare/Doc - Tor Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-tor/id/

  • Matthaiks(05 Oct 26)

    Translated using Weblate (Polish) Translate-URL: https://hosted.weblate.org/projects/onionshare/translations/pl/ Translated using Weblate (Polish) Translate-URL: https://hosted.weblate.org/projects/onionshare/translations/pl/

  • Oğuz Ersen(05 Oct 26)

    Translated using Weblate (Turkish) Translate-URL: https://hosted.weblate.org/projects/onionshare/translations/tr/

  • Sketch6580(05 Oct 26)

    Translated using Weblate (Chinese (Simplified Han script)) Translate-URL: https://hosted.weblate.org/projects/onionshare/translations/zh_Hans/ Translated using Weblate (Chinese (Simplified Han script)) Translate-URL: https://hosted.weblate.org/projects/onionshare/translations/zh_Hans/

  • Himmel(05 Oct 26)

    Translated using Weblate (Japanese) Translate-URL: https://hosted.weblate.org/projects/onionshare/translations/ja/

  • Aindriú Mac Giolla Eoin(05 Oct 26)

    Translated using Weblate (Irish) Translate-URL: https://hosted.weblate.org/projects/onionshare/translations/ga/

  • Ihor Hordiichuk(05 Oct 26)

    Translated using Weblate (Ukrainian) Currently translated at 100.0% (54 of 54 strings) Translation: OnionShare/Doc - Tor Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-tor/uk/ Translated using Weblate (Ukrainian) Currently translated at 100.0% (9 of 9 strings) Translation: OnionShare/Doc - Help Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-help/uk/ Translated using Weblate (Ukrainian) Currently translated at 100.0% (11 of 11 strings) Translation: OnionShare/Doc - Security Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-security/uk/ Translated using Weblate (Ukrainian) Translate-URL: https://hosted.weblate.org/projects/onionshare/translations/uk/

  • Saptak Sengupta(05 Oct 26)

    Merge pull request #2113 from onionshare/mig/fix-tor-cache-dir Use the cache dir for build_tor_dir.

  • Saptak Sengupta(05 Oct 26)

    Merge pull request #2116 from onionshare/mig/fix-receive-mode-autostop-timer Fix no-js Receive Mode exception when attempting to upload after autostop timer runs out

  • Gerijacki(05 Oct 26)

    Add Windows build script for webtunnel and run it in CI - Add desktop/scripts/build-pt-webtunnel.ps1 to build webtunnel-client.exe - Build and cache webtunnel in the Windows and macOS CI jobs - Document the webtunnel build scripts in desktop/README.md - Fix build-pt-webtunnel.sh: use an existing tag (v0.0.7), build from ./main/client and make it executable - Unpack the new webtunnel path from get_tor_paths() in Meek

  • Gerijacki(05 Oct 26)

    Merge branch 'main' into feat/2035-webtunnel-bridge-support # Conflicts: # desktop/onionshare/tor_settings_tab.py

  • Saptak Sengupta(05 Oct 26)

    Merge pull request #2112 from onionshare/mig/rename-meek-azure-to-meek Rename meek azure to meek

  • Miguel Jacq(04 Oct 26)

    Fix no-js Receive Mode exception when attempting to upload after autostop timer runs out

  • Miguel Jacq(02 Oct 26)

    Use the cache dir for build_tor_dir. In #2087 we started building a cache dir from XDG_CACHE_HOME, but we weren't using it for the main tor data dir, and probably should. (Technically torrc is config, but the 'state' and cached microdescriptors are better off in .cache I think)

  • Miguel Jacq(02 Oct 26)

    *Actually* try again with no bridges, in AutoConnect, when user says so. Previously it was actually a no-op and if bridges were already set, they stayed set.

  • Miguel Jacq(02 Oct 26)

    Switch from 'meek-azure' to just 'meek'. See upstream https://gitlab.torproject.org/tpo/anti-censorship/rdsys/-/issues/272 Also updates the default meek bridge URL to match current Tor Browser.

  • Saptak Sengupta(05 Oct 26)

    Merge pull request #2111 from onionshare/mig/update-tor-signing-key Refresh the Tor Browser signing key.

  • mig5(05 Oct 26)

    Merge pull request #2032 from zefr0x/main flatpak: use `io.qt.PySide.BaseApp` for PySide6

OnionShare Security

6.2/10

Repo Security Summary

Updated 24 Aug 26

  • Maintained10/10
  • Code-Review10/10
  • Dangerous-Workflow10/10
  • PackagingN/A
  • Token-Permissions0/10
  • CII-Best-Practices0/10
  • Binary-Artifacts10/10
  • Pinned-Dependencies0/10
  • Security-Policy0/10
  • Fuzzing0/10
  • License9/10
  • Branch-ProtectionN/A
  • Signed-Releases8/10
  • SAST9/10

Security Advisories (11)

  • mediumPatchedCVSS 5.4

    CVE-2026-54707OnionShare Receive mode writes uploaded files even when file uploads are disabled

  • mediumPatchedCVSS 4.8

    CVE-2026-54706OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files

  • lowPatched

    CVE-2022-21696OTF-005: Improper Input Sanitation: It is possible to change the username to that of another chat participant with an additional space character at the end of the name string

  • lowPatched

    CVE-2022-21694OTF-006: Broken Website Hardening Control: The CSP can be turned on or off but not configured for the specific needs of the website

  • lowPatched

    CVE-2022-21695OTF-009: Improper Access Control: Authenticated users (or unauthenticated in public mode) can send messages without being visible in the list of chat participants

  • lowPatched

    CVE-2022-21693OTF-013: Improper Hardening: The filesystem restriction could be hardened and should only allow for pre-defined subfolders

  • mediumPatched

    CVE-2022-21692OTF-003: Improper Access Control: Anyone with access to the chat environment can write messages disguised as another chat participant

  • mediumPatched

    CVE-2022-21691OTF-004: Improper Access Control: Chat participants can spoof their channel leave message, tricking others into assuming they left the chatroom

  • mediumPatched

    CVE-2022-21689OTF-012: Denial of Service: The receive mode limits concurrent uploads to 100 per second and blocks other uploads in the same second, which can be triggered by a simple script

  • highPatched

    CVE-2022-21690OTF-001: Improper Input Sanitation: The path parameter of the requested URL is not sanitized before being passed to the QT frontend

  • highPatched

    CVE-2022-21688OTF-014: Out-of-bounds Read: The desktop application was found to be vulnerable to denial of service via an undisclosed vulnerability in the QT image parsing

OnionShare Website

Website

OnionShare

OnionShare is a tool for anonymous peer-to-peer file sharing, chatting, and web hosting.

Redirects

Does not redirect

Security Checks

All 65 security checks passed

Server Details

  • IP Address178.128.10.165
  • Hostnameonionshare.org
  • LocationSanta Clara,California,United States of America,NA
  • ISPDigitalOcean LLC
  • ASNAS14061

Associated Countries

  • USUS

Safety Score

Website marked as safe

100%

Trackers

No known trackers found

Blacklist Check

onionshare.org was found on 0 blacklists

  • AntiSocial Blacklist
  • Artists Against 419
  • Badbitcoin
  • Bambenek Consulting
  • CERT Polska
  • CoinBlockerLists
  • CRDF
  • CryptoScamDB
  • EtherAddressLookup
  • EtherScamDB
  • Fake Website Buster
  • MetaMask EthPhishing
  • NABP Not Recommended Sites
  • OpenPhish
  • PetScams
  • PhishFeed
  • PhishFort
  • Phishing.Database
  • PhishStats
  • PhishTank
  • Phishunt
  • RPiList Not Serious
  • Scam.Directory
  • SecureReload Phishing List
  • Spam404
  • StopGunScams
  • Suspicious Hosting IP
  • ThreatFox
  • ThreatLog
  • TweetFeed
  • URLhaus
  • ViriBack C2 Tracker

Website Preview

Website preview
View full report atweb-check.xyz

OnionShare Reviews

More File Drop

  • FileSend

    FileSend

    filesend.standardnotes.org

    Simple, encrypted file sharing, with a 500mb limit and 5-day retention. Files are secured with client-side AES-256 encryption and no IP address or device info is logged. Files are permanently deleted after download or after specified duration. Developed by StandardNotes, and has built-in integration with the SN app.

    Open Source standardnotes/FileSend
    View FileSend Report
View More...

About the Data: OnionShare

Edit OnionShare Data

You can edit OnionShare's entry in this section of awesome-privacy.yml by submitting a PR to our GitHub repo.
Note that some of the information shown above has been aggregated from external sources, a list of these can be found data documentation.

Origin Data

Modify Data

Delete OnionShare Submit Edit to OnionShare Add alternative

API

You can access OnionShare's data programmatically via our API. Simply make a GET request to:

https://api.awesome-privacy.xyz/v1/services/onionshare

The REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.

Share OnionShare

Help your friends compare File Drop, and pick privacy-respecting software and services.
Share OnionShare and Awesome Privacy with your network!

← Previous

FileSend

View File Drop (2)