OnionShare 2.7 has been released

We just released OnionShare 2.7. You can download it from onionshare.org or GitHub.

Here's the most important stuff included in this release since 2.6.5.

New Feature: Download from another OnionShare

The coolest new feature is a new mode called 'Download mode'.

Up until now, if you wanted to download files shared with you from someone running OnionShare, you had to download Tor Browser.

In version 2.7, you can now open a 'Download' tab and enter the Share URL, as well as the Private Key (if it was not a public share), then click 'Start downloading'.

OnionShare connects to the sender's OnionShare and fetches the download. If there were multiple files shared on that service, you'll get a zip file containing the files. If it was just a single file, you'll get that single file.

It also allows you to repeatedly poll that address at regular intervals. This can be useful if the sender is periodically replacing their share with new versions of files, but on the same address (e.g a persistent OnionShare address). The person running Download mode will replace their copy of the downloaded files each time the poll runs.

Of course, you can continue to use Tor Browser to download shares if you want.

At a later date, we're planning to add a 'manifest' to shares in OnionShare. This will be able to be used by the Download mode to list the available files in a public share, and you could then download just the individual files you want, if not all.

New Feature: Upload size limit in Receive Mode

OnionShare lets you run in 'Receive mode', to let people upload files to your computer. It's the opposite of 'Share' mode.

In 2.7, you can now set an upload size limit, to stop people sending files that are too big.
You can set the limit to be 'per file', or you can set it to apply to the entire lifetime of that Receive mode service. In the latter case, multiple uploads of smaller sizes are 'cumulative': once the upload size limit is reached, no more files can be received for that running service.

New Feature: Webtunnel bridges

In 2024, Tor released a new type of bridge called 'Webtunnel'.

WebTunnel works by wrapping the Tor traffic into traffic that looks like a WebSocket to other network observers. In some cases, this might be more effective than obfs4 bridges, and maybe faster than Snowflake or Meek.

If you have WebTunnel bridge addresses, you can enter those in the OnionShare Tor connection settings. Otherwise, you can request Webtunnel bridges, instead of obfs4 bridges, from the BridgeDB service that Tor runs. You can do this from the OnionShare Tor connection settings too.

OnionShare continues to support obfs4, Snowflake and meek bridges as well.

Security

We also fixed a moderate security issue. Back in 2.6.4 we fixed an issue where OnionShare followed symlinks when sharing multiple files. What we missed at the time was fixing the same issue when sharing just a single file. That's now fixed in 2.7 as well. Both cases require someone to have tricked you (or performed on your local machine themselves) into sharing something that is actually a symlink to a file you consider more sensitive than intended.

Thanks to manus-pi for the responsible disclosure. We want to take the opportunity, though, to note that OnionShare can't protect against attackers who have already hacked your computer. If you're running OnionShare on a computer where an attacker is able to manipulate the filesystem, the running processes, or anything else, OnionShare won't protect you from that attacker, or keep your onion service safe.

We also don't consider it a security vulnerability in OnionShare if someone is able to trick you into sharing files or contents of files from your computer that you didn't intend to. This includes somehow modifying the files after you start a share but before someone downloads them.

We've made this clear in the Security Model in our docs, moving forward.

Other fixes

We've fixed a bunch of other smaller bugs, and made some smaller improvements. For example, OnionShare now uses Unix sockets instead of TCP ports for its webserver, on Linux and Mac. This makes it slightly more secure, especially on computers that have multiple users.

Keyboard shortcut accessibility has been slightly improved, allowing you to tab from the last open tab to the 'new tab' button (this previously got skipped over). Certain buttons and AutoStart/Stop date/time labels also have improved localization.

Tor has also been upgraded to 0.4.9.14 (containing various security fixes of its own), and some bridges also got updated.

OnionShare is free and open source software, and is maintained by Lockdown Systems. We appreciate any donations you can provide to help our team keep working on the project! You can donate here.