Newsrooms use onions for two opposite jobs#
When someone hears that the BBC has a “dark website”, they usually picture something secret. In fact, it’s the opposite. The BBC’s onion is one of the most open things the organisation runs. It is set up so that anyone, wherever they are in the world, can read the same reports that are available on the regular website, including people whose governments have blocked access to it.
That is only one part of how newsrooms use onion services. The other part works in the opposite direction. Many of the same organisations also run SecureDrop, a separate onion service that lets people with sensitive information send it to journalists without revealing who they are.
The first is about getting news out to readers who have no other way of reaching it. The second is about getting information in from sources who cannot safely contact the newsroom any other way. They rely on the same basic technology for entirely different purposes, and they have to be handled very differently by the person on the other end.
This page covers both. It explains the three newsroom onions we currently verify as working, why several well-known ones are on hold, who actually reads the news this way, and how SecureDrop works should you ever find yourself needing it.
Direction one: getting the news out#
These newsroom onions passed at least 13 of the last 14 daily reachability checks as of October 11, 2026, and each organisation confirms its address itself. They are the same three listed in our Official Onion Mirrors Directory.
| Newsroom | Address | Proof |
|---|---|---|
| BBC News | www.bbcweb3hytmzhn5d532owbu6oqadra5z3ar726vq5kgwwn6aucdccrad.onionListed in our directory as BBC News (News).bbcweb3hytmzhn5d532owbu6oqadra5z3ar726vq5kgwwn6aucdccrad |
TLS certificate |
| Deutsche Welle | www.dwnewsgngmhlplxy6o2twtfgjnrnjxbegbwqx6wnotdhkzt562tszfid.onionNot in our directory. Find the page where the owner publishes this address before you trust it. How to verifydwnewsgngmhlplxy6o2twtfgjnrnjxbegbwqx6wnotdhkzt562tszfid |
Article on dw.com |
| The Guardian | www.guardian2zotagl6tmjucg3lrhxdk4dw3lhbqnkvvkywawy3oqfoprid.onionListed in our directory as The Guardian (News).guardian2zotagl6tmjucg3lrhxdk4dw3lhbqnkvvkywawy3oqfoprid |
theguardian.com |
Each of them uses https://, which shows they have taken the extra step of getting a certificate for their onion address, on top of the encryption every onion connection already provides.
BBC News#
The BBC launched its onion in October 2019, with the aim of getting the World Service’s reporting to people in countries where BBC News is blocked or restricted. At the time, press coverage cited China, Iran and Vietnam as examples. This is the international edition, the one seen by people outside the UK, not the UK homepage.
What matters most is the language services. At launch the BBC said the onion would carry services such as BBC Arabic, BBC Persian and BBC Russian, since these are the audiences most likely to find the clearnet site blocked. UK-only content, for example iPlayer, isn’t available because of broadcasting rights.
The address has changed once. The original was a short version 2 address, retired along with every other v2 address in 2021. If you come across an old article quoting a 16-character BBC onion address, it no longer works. Use the one above, which comes with a TLS certificate issued to the BBC.
Deutsche Welle#
Germany’s international broadcaster publishes in a large number of languages for audiences outside the country, many of them in places with heavily censored internet. Its onion is the DW website served over Tor, and DW gives the address in an article on its own website. If you read DW in a language other than English, check the language menu once you’ve arrived on the onion.
The Guardian#
The Guardian is the only one of the three that features in both halves of this story. It runs an onion edition of its website for readers, and it separately runs a SecureDrop for sources. These are two different onion services with different addresses. Don’t confuse them, and never use the newspaper’s reading onion to send anything sensitive.
Who actually reads news this way#
It’s tempting to think news onions are aimed at a small, technical audience. In reality there are three quite different kinds of readers, each with different needs.
People behind national firewalls. These are exactly the people the onions were designed for. If your government blocks the BBC or DW, it can’t block an onion address by name the way it can block a domain. The only way to stop access is to block Tor altogether. That is why, in the most heavily censored countries, the onion only works if Tor does, and Tor usually needs a bridge to get through. If Tor Browser’s progress bar freezes where you are, our guide to bridges, Snowflake and WebTunnel explains how to connect.
People who don’t want their reading watched. In some places the site isn’t blocked, but reading it can still be noticed. An onion hides which outlet you’re reading from your network provider, and hides who and where you are from the newsroom’s servers. That matters for people doing sensitive research, or living somewhere a reading habit could become evidence.
People who simply prefer it. Some readers use news onions because they already use Tor Browser for everything, and the onion keeps the whole journey inside the Tor network rather than leaving through an exit relay.
Whichever group you’re in, one point applies to all. Using Tor and reading mainstream news are legal in most countries, but not all, and the laws where you are still apply. If you’re not sure, read Is Tor Legal? Using Onion Services Responsibly before you begin.
What works well#
Most of what’s on news onions is articles, which makes them one of the best uses of Tor Browser’s highest security level. At Safest, JavaScript is switched off everywhere, which removes most of the ways a malicious page could attack your browser. Articles usually still display properly, though video and interactive graphics may not. Our guide to Tor Browser security levels explains the trade-off.
A few habits help.
- Bookmark the onion once you’ve checked it. Then use the bookmark instead of searching for the outlet’s name each time. Search results are where fake copies appear.
- Look for the purple button. If you visit a newsroom’s regular website in Tor Browser and it shows a ‘.onion available’ button, that is the newsroom itself pointing you to its official onion.
- On a phone, use a genuine Tor app. News reads well on small screens, but the app matters. Our guide to using Tor on Android and iPhone lists the legitimate ones.
The newsrooms on hold#
Right now our verified list doesn’t include some of the best-known newsroom onions. They are real and official, but they failed most or all of our latest reachability tests, and we don’t list addresses that fail to load.
| Newsroom | Status as of October 11, 2026 |
|---|---|
| The New York Times | Failed 14 of 14 checks, likely a TLS certificate issue |
| ProPublica | Failed 14 of 14 checks, likely a TLS certificate issue |
| The Intercept | Failed 14 of 14 checks |
| Bellingcat | Failed 14 of 14 checks |
It’s a striking list. ProPublica and The New York Times were among the first big news organisations to launch onion sites, and both have long served as examples for others to follow. The Intercept and Bellingcat are known for investigative work that depends on careful source protection.
The pattern in the checks is telling. The New York Times and ProPublica both seem to be failing for the same reason, probably an expired or misconfigured certificate on the onion. That is a maintenance issue, not a decision to shut the service down. It is also a reminder of the hidden cost of using https:// on an onion. A certificate gives readers an extra proof of identity, but it has to be renewed, and when it lapses, a careful browser will refuse to connect.
The Intercept and Bellingcat are not answering at all. That could be a server problem or a moved address. Until they pass our checks again, we won’t guess.
On hold doesn’t mean fake. We re-test all four at every monthly review and will move them back as soon as they work again. In the meantime, if you need one of them, go to the newsroom’s own website, find its current onion address or use the Onion-Location button, and check it as explained in How to Verify an Onion Address Is Official.
Other news organisations have launched onions too. The Tor Project has highlighted Mediapart, the French investigative website, among them. We only add new entries to the directory once we’ve matched the address to the newsroom’s own proof and it has passed our checks.
Direction two: SecureDrop, and getting information in#
A news onion is built so that as many people as possible can visit it. SecureDrop is built for very few visitors, and to protect each of them as completely as possible.
SecureDrop is an open-source system that newsrooms and a number of non-profits use to receive documents and messages from anonymous sources. It was originally written by the late Aaron Swartz and is now maintained by the Freedom of the Press Foundation. Each organisation that uses it runs its own copy, and each copy is an onion service that can only be reached through Tor.
What makes it different from email or a contact form#
The Freedom of the Press Foundation outlines a number of properties that matter.
- No third parties. The server belongs to the news organisation and sits inside it, so no email provider or cloud company holds copies that could be quietly demanded from them.
- Minimal records. SecureDrop is designed not to record your IP address, browser or computer. Since you reach it as an onion, the newsroom never knows where you’re connecting from in the first place.
- Encryption throughout. What you send is encrypted in transit and at rest, and on the journalist’s side submissions are opened on machines kept apart from the internet.
- Widely available. SecureDrop’s source interface is offered in 22 languages.
One design choice surprises people the first time. You don’t create an account or give an email address. Instead, SecureDrop gives you a randomly generated codename. You use it when you come back to read any reply from the journalist. If you lose it, nobody can recover it for you, which is the whole point.
What’s new in 2026#
SecureDrop is actively maintained. The project released SecureDrop 2.16.0 on June 24, 2026, followed by 2.16.1 on July 8, which it published as a security advisory release. On the journalist side, SecureDrop Workstation 1.9.0 came out on September 2, 2026, and the project’s latest news item is the release of SecureDrop Inbox 1.7.1. Newsrooms running SecureDrop keep their servers updated, which is one reason the system is trusted. It is not abandoned software.
Finding a newsroom’s SecureDrop safely#
This is the stage where people are most likely to be fooled, since a fake SecureDrop is exactly what someone trying to unmask a source would build.
The Freedom of the Press Foundation keeps an official directory of SecureDrop instances at securedrop.org/directory, listing organisations such as The Washington Post, The Guardian, Der Spiegel, The Globe and Mail, the French investigative outlet Disclose and Greekleaks. The SecureDrop project also publishes its own onion address on its homepage.
| Service | Address | Proof |
|---|---|---|
| SecureDrop project site and directory | sdolvtfhatvsysc6l34d65ymdwxcujausv7k5jk4cy5ttzhjoi6fzvyd.onionNot in our directory. Find the page where the owner publishes this address before you trust it. How to verifysdolvtfhatvsysc6l34d65ymdwxcujausv7k5jk4cy5ttzhjoi6fzvyd |
Published on securedrop.org |
We haven’t added this address to our main directory’s daily checks yet, so treat our table as a pointer and confirm it yourself on securedrop.org.
We deliberately don’t list individual newsrooms’ SecureDrop addresses on this page. They change from time to time, and a source should always take the address from the newsroom’s own website or the official SecureDrop directory, never from a third party, including us. Compare all 56 characters before you submit anything. Our guide to onion phishing and fake mirrors shows how convincing a fake copy can be, and Why Most ‘Hidden Wiki’ Lists Are Full of Scams explains why random link lists are the wrong place to look.
If you’re thinking of contacting a journalist#
This isn’t legal advice, and if you’re thinking of sharing information from your job or about a powerful organisation, the consequences could be serious. But some practical points come directly from SecureDrop’s own guidance and from how the technology works.
Don’t use work equipment or a work network. SecureDrop’s own website tells sources to choose a safe location and avoid using a work computer. Your employer may keep a record of which devices on its network connect to what, even if it can’t see what you send.
Use the desktop Tor Browser, at Safest. SecureDrop asks sources to use the desktop version of Tor Browser and warns you if your security level is too low. Set the shield to Safest before you open the page. If you haven’t installed Tor Browser yet, follow How to Download and Install Tor Browser Safely.
Consider Tails. For the highest-risk situations, Tails runs a whole computer through Tor from a USB stick and leaves nothing behind when you shut it down. See Tails 7.14: The Amnesic OS That Routes Everything Through Tor.
Remember that documents carry clues. Files can contain metadata such as author names, a record of edits or details of the device used, and some leaks have been traced through details inside the documents themselves rather than the way they were sent. Newsrooms know this and handle submissions with care, but you should know it too.
Write down your codename somewhere safe. You’ll need it to read replies. Don’t keep it anywhere your employer or anyone else could find it.
Tell no one. The technology protects the channel, but it can’t stop you being identified because you mentioned something to a colleague.
Using Tor and SecureDrop is legal in most countries, but the information you share may be covered by contracts, employment law or official secrets laws. If you’re unsure, our guide Is Tor Legal? Using Onion Services Responsibly covers the basics, and many newsrooms’ SecureDrop pages also explain what they can and can’t promise sources.
Where to go next#
- Want every verified onion in one place? See the Official Onion Mirrors Directory, including the Tor Project’s own official onion sites.
- Is Tor blocked where you are? Read Bridges, Snowflake and WebTunnel: Using Tor Where It’s Blocked.
- Need private search or email too? See Search Engines With Official Onion Sites and Secure Email Over Tor.
- Want to know what an onion address really is? Read What Is an Onion Service? .onion Addresses Explained.
- Run a newsroom and want an onion of your own? Our guide How to Host Your Own Onion Service explains how to set it up, add Onion-Location and publish a proof page.
Sources#
- SecureDrop, Freedom of the Press Foundation, including release listings and source guidance, read October 13, 2026
- SecureDrop directory, Freedom of the Press Foundation
- BBC launches censorship-dodging news site on the dark web, BetaNews, October 24, 2019
- BBC News launches Tor mirror site, TechRadar, 2019
- Real-World Onion Sites, daily status checks to October 11, 2026
- Tor Project blog, onion services category, including the Mediapart launch
3 comments