The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Protecting a source takes more than choosing an encrypted app: plan for the consequences of identification, agree on how to verify contact, choose a transfer method the source can use safely, and protect files after they arrive. No app or submission system guarantees anonymity. The right workflow depends on the threat, the devices and accounts involved, newsroom policy, and local law.
Plan source contact before sensitive information is shared
Start by asking what could happen if the source is identified, who might target the source or reporter, and what technical or legal powers those people may have. Consider the sensitivity and reliability of the material, too: not every document needs the same level of protection. Explain the practical risks to the source in plain language and get their consent before arranging contact or requesting files.
As an Amazon Associate I earn from qualifying purchases.
Agree on a way to verify that a message really comes from the source, such as an unusual phrase or a question with an agreed answer. A familiar account or phone number is not, by itself, proof that the person using it is the source.
Recommended Free Tools
Before promising confidentiality, check newsroom policy and the law that applies to the reporter and source. Some news organizations expect reporters to disclose a source’s identity to editors; legal protections and obligations differ by country. The Committee to Protect Journalists (CPJ) advises journalists to seek country-specific guidance rather than treating general source-protection advice as legal advice. CPJ’s source-protection guidance
#1 Best Overall
- Certified to FIPS 197 - High-level information security standard approved by the U.S. Government
- Brute-Force Password Attack Protection - Data is automatically erased after 6 failed access attempts. The data and encryption key are securely destroyed and the crypto drive is reset
- Rugged Double-Layer Waterproof* Design - Protects the crypto drive against knocks, drops, break-in and submerging in water. The electronics are shielded by a hardended inner case. The rubberised silicone outer casing provides a final layer of protection
- Auto-lock - The crypto drive will automatically encrypt all data and lock when removed from a PC/Mac or when the screen saver or "computer lock" function is activated on the host PC/Mac
- Secure Entry - Data cannot be accessed without the correct high-strength alphanumeric 8-16 character password. A password hint option is available. The password hint cannot match the password
Secure the accounts and devices used for contact
Protect both the reporter’s and source’s accounts and devices. An encrypted conversation offers little protection if someone can unlock a phone, access an account, or install spyware. CPJ’s Digital Safety Kit, updated February 20, 2026, recommends practices including using two-factor authentication (2FA), installing software updates, reviewing account access, and watching for targeted phishing.
- Use long, unique passwords and turn on 2FA for relevant accounts.
- Keep devices and apps updated, and treat unexpected links or requests for credentials with caution.
- Where practical and proportionate to the risk, avoid sensitive source contact on a personal or work device that is used for unrelated activities.
These steps reduce exposure; they do not defeat every targeted attack or protect a device that is physically seized. If the source or reporter faces a serious, specific threat, get advice from a qualified digital-security specialist before choosing a workflow.
Rank #2
- Certified to FIPS 197 - High-level information security standard approved by the U.S. Government
- Brute-Force Password Attack Protection - Data is automatically erased after 6 failed access attempts. The data and encryption key are securely destroyed and the crypto drive is reset
- Auto-lock - The crypto drive will automatically encrypt all data and lock when removed from a PC/Mac or when the screen saver or "computer lock" function is activated on the host PC/Mac
- Secure Entry - Data cannot be accessed without the correct high-strength alphanumeric 8-16 character password. A password hint option is available. The password hint cannot match the password
- SuperSpeed USB 3.0 - Transfer all your confidential files and folders faster than ever before. Works on both PC & Mac
Choose a communication channel with its limits in mind
For sensitive conversations, prefer an end-to-end encrypted channel that both people can use safely. CPJ names Signal, WhatsApp, and Wire as examples in its source-protection guidance. End-to-end encryption helps protect message content from intermediaries, but it does not make the users anonymous. Contact identities, timing, and other metadata may still reveal a relationship; device access, compromised accounts, or someone observing either person can expose content or contact patterns. CPJ and Reporters Without Borders (RSF) explain these distinctions in their guidance on journalist digital safety and encryption.
Disappearing-message settings can reduce how long content remains visible in an app, which may help if someone later gains access to a device. They are not guaranteed erasure: a recipient or another person with device access may copy or capture content, and traces may remain elsewhere. If email is necessary, consider what identifying details are tied to the account and what metadata or retention the provider may keep. RSF distinguishes end-to-end encryption from transport encryption, which protects a different part of the communication path.
Rank #3
- Certified to FIPS 197 - U.S. Government Approved High Level Information Security Standard.
- Protection against brute force password attacks - Data is automatically erased after 6 unsuccessful access attempts. The data of the USB flash drive type c encryption with dual connectors is destroyed and the cryptographic drive is reset.
- Durable dual-layer waterproof design* — Protects the crypto reader from bumps, drops, run-in and immersion in water. The electronics are protected by a hardened internal case. Rubberized silicone outer case provides a final layer of protection.
- Auto-Lock —The cryptographic key automatically encrypts all data and locks when removed from a PC/Mac or when screen protection or "computer lock" is enabled.
- Secure Entry —Data on these flash drives cannot be accessed without the correct alphanumeric password of 8 to 16 characters. A password indication option is available for this flash drive. The hint cannot match the password.
Select a route for transferring files
Choose based on what the newsroom can safely operate, what the source can realistically access, the file size, and the risks created by the source’s route to the service. These options protect different parts of the process; none removes every risk.
| Route | When it may fit | Important qualification |
|---|---|---|
| A newsroom’s SecureDrop instance | When the newsroom has a properly maintained instance and can give the source its specific submission instructions. | CPJ’s 2016 account of its own deployment described Tor-based access, encrypted submissions, and an offline viewing station for decryption. That is a documented CPJ implementation, not a guarantee about every installation or interaction. CPJ’s deployment account |
| Signal or another end-to-end encrypted service | When a SecureDrop route is unavailable and the source can use the service safely. | CPJ’s 2021 source-protection guidance suggests receiving documents under 100 MB through Signal or another end-to-end encrypted service. This is CPJ’s operational recommendation, not a universal technical limit. CPJ’s guidance |
| OnionShare | For larger files when the source and journalist can use it safely. | CPJ’s 2021 guidance suggests OnionShare for files over 100 MB. The threshold is that guidance’s recommendation, not a universal limit or a guarantee of anonymity. CPJ’s guidance |
A newsroom offering SecureDrop should direct sources to its own instructions and ensure the system is operated by people with the necessary expertise. CPJ’s 2016 article describes its deployment; it should not be read as a current specification for every newsroom. For any route, consider how the source reaches the service and what traces the process may leave on their device or account.
Rank #4
- FIPS 197 with XTS-AES 256-bit Encryption: Provides business-grade security with hardware-based encryption to protect your sensitive data
- Brute Force and BadUSB Attack Protection: Safeguards against unauthorized access attempts and malicious USB attacks with digitally-signed firmware
- Multi-Password Option with Complex/Passphrase modes: Offers flexible password configuration options to meet various security requirements and user preferences
- New Passphrase Mode: Enhanced security feature allowing users to create longer, more memorable password phrases for easier access without compromising protection
- Dual Read-Only (Write-Protect) Settings: Enables write protection functionality to prevent accidental data modification or deletion when needed
Protect files after they arrive
Secure transfer and secure storage are separate tasks. End-to-end encryption during a transfer does not encrypt a downloaded file on a laptop or external drive. Encryption at rest can help if a device or drive is stolen or seized, but it does not protect a file while it is being transferred. RSF explains this distinction in its encryption guide.
- Encrypt devices, documents, and external drives where possible, and restrict access to the people who need the material.
- Keep the number of copies as small as newsroom requirements allow. Account for working copies, backups, and storage locations.
- Consider whether document metadata could identify a source or reveal sensitive details before sharing or publishing a file.
- Set a backup and deletion process that balances source safety with newsroom requirements and legal obligations. Deleting a file may not remove every copy, and deleted material may be recoverable.
For particularly sensitive material, CPJ suggests considering an air-gapped computer and identifies Tails as a specialized option; seek security-specialist help with setup rather than assuming these tools are safe by default. A U.S.-focused resource from the U.S. Journalist Assistance Network recommends auditing data and storage, encrypting stored materials and devices, powering devices down regularly, and establishing backup and deletion processes when seizure is a concern. CPJ’s source-protection guidance · U.S. Journalist Assistance Network data-protection resource
Best Value
- FIPS 140-3 Level 3 (Pending) Certified Military-Grade Security
- OS/Device Independent
- XTS-AES Hardware Encryption
- Enforced Alphanumeric PIN
- Multi-PIN (Admin and User) Option
Match the workflow to the threat, not just the app
Before settling on a method, check what it protects and what remains exposed: account access, message content, file transfer, stored files, source identity, and contact metadata. Also consider who controls the service and keys, whether the source can use it safely, how the newsroom will handle the files, and which jurisdictions apply. No single tool covers every layer. When the threat or legal consequences are unclear, consult newsroom security staff, a qualified specialist, and appropriate legal counsel before inviting the source to send material.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
