OnionShare is a free, open-source (GPLv3) tool for sharing files, receiving anonymous submissions, hosting static sites and chatting over Tor onion services, originally written by Micah Lee and now a project of Lockdown Systems, a worker-owned collective (Lockdown Systems LLC on the App Store) whose members are publicly named. Its privacy policy states the project collects no information about users and the apps do no analytics or behavioural tracking; the design runs a web server on the user's own computer, so no OnionShare-operated server ever sees the content and the App Store label reads 'Data Not Collected'. Documented caveats are that anonymity depends on how the user shares the onion address and private key out-of-band, that 'public' mode removes the private key, that the desktop app checks for updates over Tor by default, and that the optional censorship-circumvention path sends the real IP to the Tor Project's bridge API. Two Radically Open Security audits are published (desktop/CLI 2021, funded by the Open Technology Fund; Android 2023) and a 2014 deanonymising XSS bug was disclosed and fixed by the maintainer the same day; no breach, regulatory action or bug bounty was found.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
16 ON FILE
COLLECTION
The iOS App Store listing for OnionShare, published under seller Lockdown Systems LLC, carries Apple's "Data Not Collected" privacy label — the developer declares the app collects no data — which is consistent with the project's own privacy policy, though Apple notes the declaration is self-reported and unverified.
OnionShare's documentation describes the architecture as a web server started locally on the user's own computer and exposed as a Tor onion service, protected by default with a private key; there is no account, no sign-up and no OnionShare-operated server through which content or metadata passes, so the developers themselves cannot see what is shared.
OnionShare's own privacy policy (last updated October 16, 2023) states that the project does not collect any information about its users and that neither the desktop nor the mobile apps collect analytics or perform behavioral tracking; the only data flow it discloses is app-store telemetry governed by Apple, Google or Snapcraft, not by OnionShare.
OnionShare's website states that the project belongs to the Lockdown Systems collective and is open source under the GPLv3; the site also names its mobile-app collaborators (Guardian Project and The Calyx Institute), lists partner organisations including the Tor Project and Science & Design, and links a verifiable onion mirror and PGP signatures for its desktop downloads.
Lockdown Systems describes itself as an international worker-owned collective and a for-profit company that open-sources its technologies where it can, lists OnionShare among its projects, and publishes the names and bios of its collective members — Micah Lee, Saptak S, redshiftzero, Yael Grauer, Em and Eriol — so the people behind the tool are identifiable, though as a private LLC it files no public financial statements.
The OnionShare repository's LICENSE.txt places the complete desktop and CLI source under the GNU General Public License version 3, with copyright held by Micah Lee et al. (2014-2026), so the running code can be inspected, audited and reproduced by anyone.
Lockdown Systems' donation page states that its fiscal sponsor for tax-deductible donations is Lucy Parsons Labs, a 501(c)(3) nonprofit, and publishes that organisation's EIN (81-3046769), giving a traceable public-charity conduit for the collective's donation-funded open-source work including OnionShare.
OnionShare's Tor-connection documentation discloses one optional third-party data flow: if the initial Tor connection fails and the user picks automatic censorship circumvention, the app makes a non-Tor, Meek domain-fronted request to the Tor Project's Censorship Circumvention API, and the "determine my country from my IP address" option lets that API see the user's real IP address to select bridges. This is opt-in per connection attempt and goes to the Tor Project, not to OnionShare's maintainers.
Privacy Guides lists OnionShare as a recommended file-sharing tool under criteria that require the tool must not store decrypted data on a remote server, must be open-source, and must have Linux/macOS/Windows clients or a web interface — an independent listing that corroborates the no-intermediary-server design.
OnionShare's published security design states that third parties do not have access to anything that happens in OnionShare because services are hosted directly on the user's computer and files are never uploaded to any third-party server, with the connection between the onion service and Tor Browser end-to-end encrypted. The same page lists what the tool does not protect against: the OnionShare address and private key are communicated by the user out-of-band, and if that channel is insecure or non-anonymous an eavesdropper can learn that OnionShare is being used or access a still-running service.
In a security advisory dated July 16, 2014, OnionShare's author Micah Lee disclosed that Jacob Appelbaum had found an input-sanitisation (XSS) bug in OnionShare 0.3 that could let a recipient deanonymise the sender by forcing the GUI to load a non-Tor resource, and stated it was fixed in 0.4 released the same day — the only user-deanonymising vulnerability found in this research, disclosed publicly by the maintainer.
The OnionShare repository publishes, in its security/ directory, a penetration-test report by Radically Open Security B.V. (Diemen, NL) commissioned by the Open Technology Fund, covering the OnionShare 2.4 desktop and CLI code between September 26 and October 8, 2021, with a retest dated December 3, 2021. The report lists nine findings — two Elevated (an unsanitized history-path parameter allowing HTML rendering in the desktop UI, and a Qt image-parsing out-of-bounds read), three Moderate and four Low — and the project's 2.5 changelog (January 2022) records security fixes matching those findings.
The OnionShare Android repository's README states that the Android app was audited by Radically Open Security on June 30, 2023 and links the report; the linked report (crystal-box pentest of tag 0.1.11, June 12-23, 2023) recorded one Elevated, two Moderate and one Low finding, and the README states all found issues have since been resolved. Together with the 2021 desktop audit this gives two named-firm audits within five years; no funded bug-bounty program was found.
The F-Droid listing for the Android app (built and signed by F-Droid from the published source, GPLv3) enumerates only networking and foreground-service permissions — view network connections, view Wi-Fi connections, run foreground service, full network access — with no advertising, identity or location permissions and no third-party tracker components disclosed.
OnionShare's configuration reference documents a use_autoupdate setting, default True on macOS and Windows, under which the desktop app periodically checks for updates over Tor and records an autoupdate_timestamp — a small first-party network contact that is on by default but routed through Tor rather than a direct connection. The same page documents the "public OnionShare service" option that disables the private key, which removes the client-authentication protection described in the security design.
OnionShare's privacy policy discloses the only first-party server-side record it keeps: the onionshare.org website retains two weeks of web-server logs that exclude IP addresses; no analytics, advertising or crash-reporting SDK is disclosed for the apps.