A source who wants to hand a journalist or a watchdog group evidence of wrongdoing has a hard problem: proving the document is real without exposing who they are. Whistleblowing platforms exist specifically to solve that problem, and most of the credible ones run as onion services for exactly that reason.
How Whistleblowing Platforms Actually Work
Tools like SecureDrop and GlobaLeaks are built so that a submission travels through Tor, arrives on a server that’s kept separate from the newsroom’s regular network, and gets stripped of identifying metadata before anyone reviews it. The newsroom staff who read submissions typically work from an offline, air-gapped machine specifically to reduce the chance that malware or a compromised network exposes a source.
Why Onion Access Specifically Matters Here
For a source, the moment of highest risk is the connection itself; a corporate or government network that can see a connection to a newsroom’s submission page has already learned something. Routing that connection through Tor removes that visibility, and using the onion address instead of the clearnet one keeps the entire session inside the Tor network end-to-end.
Who Actually Runs These Systems
SecureDrop was built by the Freedom of the Press Foundation and is used by major newsrooms including The Washington Post and The Guardian. GlobaLeaks is used by a range of NGOs and transparency organizations. In both cases, a legitimate instance is announced and linked from the parent organization’s own verified website, never from an anonymous third party claiming to host it on their behalf.
Basic Opsec If You’re Considering Submitting Something
Don’t do research about the leak, the platform, or the story from a device or network connected to your identity or your employer. Use the Tor Browser, don’t log into any personal account in the same session, and avoid including any file metadata that could identify you, such as a document’s author field. If you’re unsure, most legitimate platforms publish their own guidance on exactly this before you submit anything.
Why Newsrooms Publicize These Platforms Openly
Unlike most of what a newsroom keeps confidential, whistleblowing platforms are meant to be found. An outlet that runs SecureDrop or GlobaLeaks usually links to it prominently from its homepage or an About/Tips page, because the whole point is that a potential source needs to locate it before they can use it. That openness is part of what makes it verifiable: you’re not relying on a stranger’s link, you’re going directly to the newsroom’s own site. For more on how outlets structure this kind of public-facing transparency, see our piece on digital rights and press freedom groups that use Tor.
If you’re a source rather than a journalist, the same rule of thumb applies to picking a platform as it does to picking anything else on this site: legitimate whistleblowing platforms are announced by an organization you can independently verify, not discovered through an anonymous forum post.
It’s also worth remembering that whistleblowing platforms are only one part of responsible disclosure. Many organizations that run them also publish editorial policies describing what kinds of documents they’ll act on, how long review typically takes, and what happens if they can’t verify a submission. Reading that policy first, before you submit anything, tells you whether the platform you’re looking at fits what you actually want to accomplish.
That same policy usually spells out what happens after review, too, including whether the newsroom will contact you back through a secure channel and how they handle a submission they decide not to pursue. Knowing that upfront helps set realistic expectations before you go through the effort of preparing anything.
