What Is SecureDrop and Why Use the Onion Address
SecureDrop is open-source software that allows news organizations to set up secure submission portals. Each organization hosts its own instance with a unique onion address. The onion address ensures that your connection is routed through multiple Tor nodes, making it extremely difficult to trace your location or identity. Unlike clearnet versions, the onion address adds an extra layer of protection by keeping the entire communication within the Tor network. This is particularly important for sources in countries with internet surveillance or for individuals reporting on sensitive topics. The platform was originally developed to support whistleblowers and has been adopted by major news outlets worldwide.
Setting Up Tor Browser for SecureDrop Access
Before accessing any onion address, you need Tor Browser installed on your device. Download it only from the official Tor Project website to avoid compromised versions. Extract the archive and run the executable. On first launch, Tor Browser will establish a connection to the Tor network, which may take 30 seconds to a few minutes. Once connected, you'll see a green onion icon in the address bar. Do not modify Tor Browser settings unless you understand the security implications. Keep your operating system and all software updated. Consider using a dedicated device or virtual machine for sensitive submissions. Never maximize your browser window, as this can reveal your screen resolution to websites you visit.
Locating and Accessing SecureDrop Onion Addresses
Each news organization maintains its own SecureDrop instance with a unique onion address. These addresses are typically published on the organization's official website under a security or tips section. To find the correct address, visit the news outlet's clearnet site first, then look for a link labeled 'SecureDrop,' 'Submit a Tip,' or 'Contact Us Securely.' Copy the onion address carefully—even a single character difference will lead to a different site. Paste it into Tor Browser's address bar. The site may take longer to load than regular websites due to Tor routing. Verify the page displays the organization's branding and matches what you expect. If the page looks unfamiliar or contains unusual requests, do not proceed. Bookmark the onion address in Tor Browser only, never in your regular browser.
Making a Secure Submission: Step-by-Step Process
Once you've accessed the SecureDrop interface, you'll see a form asking for your message and optional files. Type your submission directly into the browser—do not copy and paste from other applications, as this can leave traces. Be specific about what you're submitting and why it matters, but avoid including personally identifying details unless absolutely necessary. SecureDrop generates a unique codename for your submission; write this down on paper and memorize it if possible. Do not save it in any file or password manager. Upload documents if needed, but be aware that metadata in files (like creation dates or author information) can reveal your identity. After submission, SecureDrop will display a confirmation page with your codename. This is your only way to check for responses from journalists. The entire process should take 10-15 minutes. Do not rush or submit multiple times.
Security Best Practices and Common Mistakes
Never use SecureDrop on a shared computer or public WiFi without a VPN. Even with Tor, using public networks introduces additional risks. Do not open documents or files while connected to SecureDrop, as this can leak your IP address. Disable JavaScript in Tor Browser before accessing SecureDrop—go to Settings, Privacy & Security, and toggle off JavaScript. Do not install plugins or extensions in Tor Browser. Never take screenshots of the SecureDrop interface. Avoid submitting documents with embedded metadata; use tools like Metadata Anonymization Toolkit (MAT2) to strip file information. Do not mention your codename anywhere else online. If you need to follow up, access SecureDrop again using the same Tor Browser instance and enter your codename. Do not use the same device for SecureDrop and regular internet activity on the same day. Consider using Tails, a live operating system designed for anonymity, for maximum security.
Combining VPN and Tor for Enhanced Anonymity
While Tor alone provides strong anonymity, adding a VPN creates an additional layer of protection. The recommended setup is VPN first, then Tor—this prevents your ISP from seeing that you're using Tor. Connect to a reputable VPN service before opening Tor Browser. Some users prefer Tor first, then VPN, but this approach has trade-offs. Never use a VPN that logs user activity or requires payment methods that identify you. Free VPNs often sell user data and should be avoided for sensitive submissions. After connecting to VPN, launch Tor Browser and proceed normally. This combination means your ISP sees only encrypted VPN traffic, the VPN provider sees Tor traffic but not your destination, and SecureDrop sees only Tor exit node traffic. The trade-off is slightly slower connection speeds. Test your setup by checking your IP address on a test site before accessing SecureDrop.
Checking for Responses and Maintaining Anonymity
Journalists will respond to your submission through SecureDrop's secure messaging system. To check for responses, access the same onion address and enter your codename. The interface will show any messages from the news organization. Read responses carefully and consider your next steps. If you need to provide additional information, submit it through the same secure channel. Do not switch to email or other communication methods, as this breaks the anonymity chain. Responses may take days or weeks depending on the organization's workflow. Do not repeatedly check for messages, as this creates unnecessary traffic patterns. If you decide to stop communicating, simply do not return to the site. SecureDrop automatically deletes messages after a set period if they remain unread. Never discuss your submission with anyone, even after publication. If your information becomes public, do not confirm or deny your involvement.
Frequently asked questions
Is it illegal to access SecureDrop through Tor?
No. Accessing SecureDrop or any onion address is legal in most countries. SecureDrop is designed specifically for journalists and sources to communicate securely. However, the legality of your submission's content depends on local laws. Submitting information about genuine crimes or corruption is protected in most jurisdictions, but submitting classified information or trade secrets may have legal consequences depending on your location and circumstances.
Can my ISP see that I'm accessing SecureDrop?
Your ISP can see that you're using Tor, but cannot see which onion address you're accessing. If you use a VPN before Tor, your ISP sees only encrypted VPN traffic. Using Tor alone is sufficient for most users; adding a VPN provides additional protection if your ISP's Tor usage is monitored or restricted in your region.
What if I lose my SecureDrop codename?
If you lose your codename, you cannot retrieve previous messages or submissions. Write down your codename immediately after submission and store it securely—on paper in a safe location is best. Do not save it in files, emails, or password managers. If you lose it, you'll need to make a new submission if you want to follow up with journalists.
How long does it take for journalists to respond?
Response times vary widely depending on the news organization and the volume of submissions they receive. Some organizations respond within days; others may take weeks or months. Do not expect immediate replies. Check for responses periodically, but avoid checking too frequently, as this creates unnecessary traffic patterns that could potentially be analyzed.
Should I use the same device for SecureDrop and regular internet activity?
It's safer to use a separate device or at least a separate user account. If you must use the same device, avoid switching between SecureDrop and regular browsing on the same day. Better yet, use Tails, a live operating system designed for anonymity, which leaves no traces on your device after shutdown.
