OnionShare

onionshare.org
Awesome Privacy ➔ Productivity ➔ File Drop ➔ OnionShare
OnionShare

An open source tool that lets you securely and anonymously share a file of any size, via Tor servers. OnionShare does require installing, but the benefit is that your files are transferred directly to the recipient, without needing to be hosted on an interim server. The host needs to remain connected for the duration of the transfer, but once it is complete, the process will be terminated.

Avoid

  • wetransfer
  • send anywhere
  • filemail
  • smash

Also Consider

Open Source

OnionShare Source Code

Author

onionshare

Description

Securely and anonymously share files, host websites, and chat with friends using the Tor network

#cross-platform#file-sharing#onion-service#onionshare#open-source#python#security#tor#tor-onion-service

Homepage

https://onionshare.org/

License

NOASSERTION

Created

20 May 14

Last Updated

12 Jul 26

Latest version

v2.6.4

Primary Language

Python

Size

40,703 KB

Stars

7,018

Forks

712

Watchers

7,018

Language Usage

Language Usage

Star History

Star History

Top Contributors

Recent Commits

  • mig5 (08 Jul 26)

    Merge pull request #2089 from weblate/weblate-onionshare-translations Translations update from Hosted Weblate

  • 109247019824 (07 Jul 26)

    Translated using Weblate (Bulgarian) Currently translated at 100.0% (74 of 74 strings) Translation: OnionShare/Doc - Install Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-install/bg/

  • Saptak Sengupta (07 Jul 26)

    Merge pull request #2084 from onionshare/mig/run-cli-web-in-thread Fix Python 3.14 compatibility in range request live-server tests

  • mig5 (07 Jul 26)

    Merge pull request #2085 from weblate/weblate-onionshare-translations Translations update from Hosted Weblate

  • Mona Lisa (06 Jul 26)

    Translated using Weblate (Swedish) Currently translated at 100.0% (27 of 27 strings) Translation: OnionShare/Doc - Develop Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-develop/sv/ Translated using Weblate (Swedish) Currently translated at 100.0% (74 of 74 strings) Translation: OnionShare/Doc - Install Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-install/sv/ Translated using Weblate (Swedish) Currently translated at 100.0% (54 of 54 strings) Translation: OnionShare/Doc - Tor Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-tor/sv/ Translated using Weblate (Swedish) Currently translated at 100.0% (62 of 62 strings) Translation: OnionShare/Doc - Features Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-features/sv/ Translated using Weblate (Swedish) Translate-URL: https://hosted.weblate.org/projects/onionshare/translations/sv/

  • curtisb (06 Jul 26)

    Translated using Weblate (German) Currently translated at 100.0% (74 of 74 strings) Translation: OnionShare/Doc - Install Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-install/de/

  • Miguel Jacq (21 Jun 26)

    Fix Python 3.14 compatibility in range request live-server tests. Looks like Python 3.14 uses forkserver as the default start method. We previously started a local run() function which passed it to multiprocessing.Process, which works under fork but fails under forkserver, because local functions must be pickleable. Switch to running Wekzeug in a thread which avoids needing to pickle a local process target at all.

  • Saptak Sengupta (15 Jun 26)

    Merge pull request #2083 from weblate/weblate-onionshare-translations Translations update from Hosted Weblate

  • Himmel (14 Jun 26)

    Translated using Weblate (Japanese) Currently translated at 100.0% (74 of 74 strings) Translation: OnionShare/Doc - Install Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-install/ja/

  • Aindriú Mac Giolla Eoin (14 Jun 26)

    Translated using Weblate (Irish) Currently translated at 100.0% (74 of 74 strings) Translation: OnionShare/Doc - Install Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-install/ga/

  • Ecron (14 Jun 26)

    Translated using Weblate (Catalan) Currently translated at 100.0% (9 of 9 strings) Translation: OnionShare/Doc - Help Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-help/ca/

  • Maryam Azad (14 Jun 26)

    Translated using Weblate (Persian) Currently translated at 100.0% (74 of 74 strings) Translation: OnionShare/Doc - Install Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-install/fa/

  • Saptak Sengupta (10 Jun 26)

    Merge pull request #2079 from weblate/weblate-onionshare-translations Translations update from Hosted Weblate

  • mig5 (10 Jun 26)

    Merge pull request #2081 from GautierPicon/update-license-year License: change copyright year to 2026

  • Gautier Picon (09 Jun 26)

    License: change copyright year to 2026

  • Matthaiks (09 Jun 26)

    Translated using Weblate (Polish) Currently translated at 100.0% (74 of 74 strings) Translation: OnionShare/Doc - Install Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-install/pl/

  • Sketch6580 (09 Jun 26)

    Translated using Weblate (Chinese (Simplified Han script)) Currently translated at 100.0% (74 of 74 strings) Translation: OnionShare/Doc - Install Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-install/zh_Hans/

  • Oğuz Ersen (09 Jun 26)

    Translated using Weblate (Turkish) Currently translated at 100.0% (74 of 74 strings) Translation: OnionShare/Doc - Install Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-install/tr/

  • Weblate Translation Memory (09 Jun 26)

    Translated using Weblate (Filipino) Translate-URL: https://hosted.weblate.org/projects/onionshare/translations/fil/ Translated using Weblate (Interlingua) Translate-URL: https://hosted.weblate.org/projects/onionshare/translations/ia/ Translated using Weblate (Korean) Translate-URL: https://hosted.weblate.org/projects/onionshare/translations/ko/ Translated using Weblate (Hungarian) Translate-URL: https://hosted.weblate.org/projects/onionshare/translations/hu/ Translated using Weblate (Hebrew) Translate-URL: https://hosted.weblate.org/projects/onionshare/translations/he/ Translated using Weblate (Hindi) Translate-URL: https://hosted.weblate.org/projects/onionshare/translations/hi/ Translated using Weblate (Bosnian) Translate-URL: https://hosted.weblate.org/projects/onionshare/translations/bs/ Translated using Weblate (Esperanto) Translate-URL: https://hosted.weblate.org/projects/onionshare/translations/eo/ Translated using Weblate (Malay) Translate-URL: https://hosted.weblate.org/projects/onionshare/translations/ms/ Translated using Weblate (Georgian) Translate-URL: https://hosted.weblate.org/projects/onionshare/translations/ka/ Translated using Weblate (Kabyle) Translate-URL: https://hosted.weblate.org/projects/onionshare/translations/kab/ Translated using Weblate (Macedonian) Translate-URL: https://hosted.weblate.org/projects/onionshare/translations/mk/ Translated using Weblate (Gujarati) Translate-URL: https://hosted.weblate.org/projects/onionshare/translations/gu/

  • Hosted Weblate (09 Jun 26)

    Update translation files Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Translation: OnionShare/Doc - Features Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-features/ Update translation files Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Translation: OnionShare/Doc - Index Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-index/ Update translation files Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Translation: OnionShare/Doc - Sphinx Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-sphinx/ Update translation files Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Translation: OnionShare/Doc - Security Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-security/ Update translation files Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Translation: OnionShare/Doc - Install Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-install/ Update translation files Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Translation: OnionShare/Doc - Help Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-help/ Update translation files Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Translation: OnionShare/Doc - Develop Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-develop/ Update translation files Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Translation: OnionShare/Doc - Advanced Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-advanced/ Update translation files Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Translation: OnionShare/Doc - Tor Translate-URL: https://hosted.weblate.org/projects/onionshare/doc-tor/

  • mig5 (09 Jun 26)

    Merge pull request #2080 from onionshare/update-changelog-fix-test Update changelog fix test

  • Saptak S (09 Jun 26)

    Adds changelog for 2.6.4

  • Saptak S (09 Jun 26)

    Adds additional cheks for failing condition

  • Saptak S (09 Jun 26)

    Updates test to check no receive directory created if no file or message

  • Saptak Sengupta (09 Jun 26)

    Merge commit from fork Prevent symlink traversal

  • Saptak Sengupta (09 Jun 26)

    Merge commit from fork Prevent upload of files when file upload mode is disabled. Prevent creation of empty folder on empty POST request payload

  • mig5 (09 Jun 26)

    Merge pull request #2078 from onionshare/release-2.6.4 Release 2.6.4

  • Saptak S (08 Jun 26)

    Updates release date in appdata.xml

  • Saptak S (08 Jun 26)

    Updates team ID for apple release

  • Miguel Jacq (04 Jun 26)

    include backports.zstd in the setup-freeze.py

OnionShare Security

5.7/10

Repo Security Summary

Updated 29 Jun 26

  • Maintained 10/10
  • Packaging N/A
  • Code-Review 7/10
  • Dangerous-Workflow 10/10
  • CII-Best-Practices 0/10
  • Token-Permissions 0/10
  • Binary-Artifacts 10/10
  • Pinned-Dependencies 0/10
  • Security-Policy 0/10
  • Fuzzing 0/10
  • License 9/10
  • Branch-Protection N/A
  • Signed-Releases 6/10
  • SAST 9/10

Security Advisories (11)

  • medium Patched CVSS 5.4

    CVE-2026-54707 OnionShare Receive mode writes uploaded files even when file uploads are disabled

  • medium Patched CVSS 4.8

    CVE-2026-54706 OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files

  • low Patched

    CVE-2022-21696 OTF-005: Improper Input Sanitation: It is possible to change the username to that of another chat participant with an additional space character at the end of the name string

  • low Patched

    CVE-2022-21694 OTF-006: Broken Website Hardening Control: The CSP can be turned on or off but not configured for the specific needs of the website

  • low Patched

    CVE-2022-21695 OTF-009: Improper Access Control: Authenticated users (or unauthenticated in public mode) can send messages without being visible in the list of chat participants

  • low Patched

    CVE-2022-21693 OTF-013: Improper Hardening: The filesystem restriction could be hardened and should only allow for pre-defined subfolders

  • medium Patched

    CVE-2022-21692 OTF-003: Improper Access Control: Anyone with access to the chat environment can write messages disguised as another chat participant

  • medium Patched

    CVE-2022-21691 OTF-004: Improper Access Control: Chat participants can spoof their channel leave message, tricking others into assuming they left the chatroom

  • medium Patched

    CVE-2022-21689 OTF-012: Denial of Service: The receive mode limits concurrent uploads to 100 per second and blocks other uploads in the same second, which can be triggered by a simple script

  • high Patched

    CVE-2022-21690 OTF-001: Improper Input Sanitation: The path parameter of the requested URL is not sanitized before being passed to the QT frontend

  • high Patched

    CVE-2022-21688 OTF-014: Out-of-bounds Read: The desktop application was found to be vulnerable to denial of service via an undisclosed vulnerability in the QT image parsing

OnionShare Website

Website

OnionShare

OnionShare is a tool for anonymous peer-to-peer file sharing, chatting, and web hosting.

Redirects

Does not redirect

Security Checks

All 65 security checks passed

Server Details

  • IP Address 178.128.10.165
  • Hostname onionshare.org
  • Location Santa Clara, California, United States of America, NA
  • ISP DigitalOcean LLC
  • ASN AS14061

Associated Countries

  • US US

Safety Score

Website marked as safe

100%

Blacklist Check

onionshare.org was found on 0 blacklists

  • AntiSocial Blacklist
  • Artists Against 419
  • Badbitcoin
  • Bambenek Consulting
  • CERT Polska
  • CoinBlockerLists
  • CRDF
  • CryptoScamDB
  • EtherAddressLookup
  • EtherScamDB
  • Fake Website Buster
  • MetaMask EthPhishing
  • NABP Not Recommended Sites
  • OpenPhish
  • PetScams
  • PhishFeed
  • PhishFort
  • Phishing.Database
  • PhishStats
  • PhishTank
  • Phishunt
  • RPiList Not Serious
  • Scam.Directory
  • SecureReload Phishing List
  • Spam404
  • StopGunScams
  • Suspicious Hosting IP
  • ThreatFox
  • ThreatLog
  • TweetFeed
  • URLhaus
  • ViriBack C2 Tracker

Website Preview

Website preview
View full report at web-check.xyz

OnionShare Reviews

More File Drop

View More...

About the Data: OnionShare

API

You can access OnionShare's data programmatically via our API. Simply make a GET request to: 

https://api.awesome-privacy.xyz/v1/services/onionshare

The REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.

Share OnionShare

Help your friends compare File Drop, and pick privacy-respecting software and services.
Share OnionShare and Awesome Privacy with your network!

← Previous

FileSend
View File Drop (2)