Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Protecting a confidential source takes more than choosing an encrypted app. Plan what could happen if the source is identified, agree on a way to verify contact, select a channel and file-transfer route the source can use safely, and protect the material after it arrives. The right workflow depends on the threat, the devices and accounts involved, newsroom policy, and local law; no app or submission system can guarantee that a source is untraceable.
Start with the source’s risk, not the app
Before requesting sensitive information, consider what the information reveals, how serious the consequences would be if the source were identified, and who might try to identify them. An employer, a government agency, a private individual, and a technically capable attacker may have very different access and powers. Consider the risk to the reporter and newsroom as well as to the source.
Explain practical risks in plain language and ask what the source is comfortable sharing. Agree on a way to verify that a message is really from them, such as a question or unusual phrase arranged in person or through a previously trusted channel. Do not rely on a new message alone to prove identity if an account could have been taken over.
Before promising confidentiality, check newsroom policy and the law that applies to the people and records involved. Some organizations expect reporters to disclose a source’s identity to an editor; legal protections and obligations vary by country. The Committee to Protect Journalists (CPJ) sets out these cautions in its source-protection guidance. For questions about a specific jurisdiction, seek qualified local advice rather than treating general security guidance as legal advice.
#1 Best Overall
- Certified to FIPS 197 - High-level information security standard approved by the U.S. Government
- Brute-Force Password Attack Protection - Data is automatically erased after 6 failed access attempts. The data and encryption key are securely destroyed and the crypto drive is reset
- Rugged Double-Layer Waterproof* Design - Protects the crypto drive against knocks, drops, break-in and submerging in water. The electronics are shielded by a hardended inner case. The rubberised silicone outer casing provides a final layer of protection
- Auto-lock - The crypto drive will automatically encrypt all data and lock when removed from a PC/Mac or when the screen saver or "computer lock" function is activated on the host PC/Mac
- Secure Entry - Data cannot be accessed without the correct high-strength alphanumeric 8-16 character password. A password hint option is available. The password hint cannot match the password
What encryption protects—and what it does not
End-to-end encryption is designed to protect message content from intermediaries while it travels between the participants. It does not make the participants anonymous. Information such as who contacted whom, when contact happened, and how often may still be exposed, depending on the service and circumstances. A device that is unlocked, compromised, or physically accessed can also reveal messages or files, as can an account that has been taken over. CPJ’s Digital Safety Kit and Reporters Without Borders’ (RSF) encryption explainer describe why encryption should not be confused with anonymity.
Keep transfer and storage separate in your plan. Encryption during transfer is not the same as encryption at rest on a phone, computer, or drive. A protected transfer does not secure a file after it is saved to an exposed device; encrypting a drive does not secure a file while it is being sent. RSF explains this distinction in its encryption guidance.
Rank #2
- Certified to FIPS 197 - High-level information security standard approved by the U.S. Government
- Brute-Force Password Attack Protection - Data is automatically erased after 6 failed access attempts. The data and encryption key are securely destroyed and the crypto drive is reset
- Auto-lock - The crypto drive will automatically encrypt all data and lock when removed from a PC/Mac or when the screen saver or "computer lock" function is activated on the host PC/Mac
- Secure Entry - Data cannot be accessed without the correct high-strength alphanumeric 8-16 character password. A password hint option is available. The password hint cannot match the password
- SuperSpeed USB 3.0 - Transfer all your confidential files and folders faster than ever before. Works on both PC & Mac
Choose a communication and file-transfer route
Choose a route by asking what it protects, what exposure remains, whether the source can realistically use it, and whether the newsroom can safely handle what arrives. Do not ask a source to use a tool they cannot operate securely just because it sounds more protective.
| Route | What the guidance supports | Important limits |
|---|---|---|
| Signal or another suitable end-to-end encrypted service | CPJ suggests receiving documents under 100 MB through Signal or another end-to-end encrypted service in its source-protection guidance. | The under-100-MB figure is CPJ’s operational recommendation, not a universal technical limit. Encryption does not hide every contact detail or protect a compromised device. |
| OnionShare | CPJ suggests OnionShare for files over 100 MB in the same guidance. | This recommendation does not by itself establish that the source’s access path, device, or file is safe. Consider the source’s ability to use the service and the traces involved. |
| A newsroom’s SecureDrop instance | A newsroom that operates SecureDrop can direct sources to its own submission instructions. CPJ’s 2016 account describes its implementation using Tor-based access, encrypted submissions, and an offline viewing station for decryption: CPJ’s deployment account. | That account documents CPJ’s implementation at the time, not a guarantee or current specification for every installation. SecureDrop requires knowledgeable setup and safe operation. |
Is Signal safe for sending files?
Signal is one option CPJ names for receiving smaller documents, but “safe” depends on the whole workflow. Consider the source’s device and account, how they reach the service, who can access the recipient’s device, and what identifying details may appear in the contact or file. The service cannot protect content from someone who can read it on either endpoint. CPJ also lists WhatsApp and Wire as examples of encrypted communication options in its guidance; that is not a claim that the services provide identical protections or fit every threat model.
Recommended Free Tools
Rank #3
- Certified to FIPS 197 - U.S. Government Approved High Level Information Security Standard.
- Protection against brute force password attacks - Data is automatically erased after 6 unsuccessful access attempts. The data of the USB flash drive type c encryption with dual connectors is destroyed and the cryptographic drive is reset.
- Durable dual-layer waterproof design* — Protects the crypto reader from bumps, drops, run-in and immersion in water. The electronics are protected by a hardened internal case. Rubberized silicone outer case provides a final layer of protection.
- Auto-Lock —The cryptographic key automatically encrypts all data and locks when removed from a PC/Mac or when screen protection or "computer lock" is enabled.
- Secure Entry —Data on these flash drives cannot be accessed without the correct alphanumeric password of 8 to 16 characters. A password indication option is available for this flash drive. The hint cannot match the password.
When a newsroom offers SecureDrop
Use the specific newsroom’s published instructions rather than a link or workflow supplied by an unverified person. The newsroom should have security expertise for deployment and operation; CPJ’s documented offline viewing station is an example of one implementation, not a setup recipe for every organization. Sources should not assume that using a submission system eliminates all identifying traces or risks.
When email is the only practical channel
Email may expose provider-held metadata or be retained by services and accounts. If it is necessary, consider whether an account tied to the source’s personal identity creates additional exposure, and assess the account and devices on both ends. Do not assume that encrypting a file attachment also conceals who sent the email or when.
Rank #4
- FIPS 197 with XTS-AES 256-bit Encryption: Provides business-grade security with hardware-based encryption to protect your sensitive data
- Brute Force and BadUSB Attack Protection: Safeguards against unauthorized access attempts and malicious USB attacks with digitally-signed firmware
- Multi-Password Option with Complex/Passphrase modes: Offers flexible password configuration options to meet various security requirements and user preferences
- New Passphrase Mode: Enhanced security feature allowing users to create longer, more memorable password phrases for easier access without compromising protection
- Dual Read-Only (Write-Protect) Settings: Enables write protection functionality to prevent accidental data modification or deletion when needed
Harden accounts and devices before contact
Basic account hygiene reduces avoidable exposure, though it cannot neutralize every spyware, targeted attack, or physical seizure risk. CPJ’s Digital Safety Kit emphasizes software updates, two-factor authentication, phishing awareness, and reviewing account access.
- Use long, unique passwords and enable two-factor authentication on relevant accounts.
- Keep operating systems, apps, and security updates current. Be cautious with unexpected links, attachments, and login prompts, especially if a contact is unusual or urgent.
- Review account access and recovery options, and remove sessions or devices you no longer recognize or use.
- Where practical and proportionate to the threat, avoid handling sensitive contact on a device used for unrelated personal or work activity. A separate device is not a complete defense and can introduce its own handling and storage risks.
Disappearing-message settings may reduce what remains visible on a device, but they are not guaranteed erasure. A recipient may save or capture content, copies may exist elsewhere, and someone with device access may see messages before they disappear.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallBest Value
- FIPS 140-3 Level 3 (Pending) Certified Military-Grade Security
- OS/Device Independent
- XTS-AES Hardware Encryption
- Enforced Alphanumeric PIN
- Multi-PIN (Admin and User) Option
Protect files after they arrive
Limit the number of people and devices that can access sensitive material, and avoid making unnecessary copies. Encrypt devices, documents, and external drives where possible. For particularly sensitive material, CPJ recommends considering an air-gapped computer and identifies Tails as a specialized option; it also advises seeking help from a security specialist when needed in its source-protection guidance.
Plan backups and deletion with both source safety and newsroom obligations in mind. Establish where working files and backups may be stored, who can access them, and how they will be handled when no longer needed. Deleting a file does not guarantee that it cannot be recovered. The U.S. Journalist Assistance Network’s 2026 data-protection resource recommends auditing data and storage, encrypting stored materials and devices, powering devices down regularly, and setting backup and deletion processes. Its advice is explicitly U.S.-focused; newsroom and legal requirements elsewhere may differ.
Also consider what a document itself reveals. Files can contain identifying metadata, such as details about their creation or editing. Think about whether that information is necessary to your reporting and how to handle it without altering evidence or compromising verification. If the material’s evidentiary integrity matters, consult newsroom policy or a qualified specialist before modifying an original.
Make the workflow fit the threat
A practical comparison should cover each layer rather than treating one app as a complete solution:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Identity and contact: Could the source’s identity be exposed by the account, contact list, timing, or way they access the service?
- Transfer: Is the content protected while moving, and is the route feasible for the source and file size?
- Accounts and endpoints: Could either person’s account or device be accessed, compromised, or seized?
- Storage and copies: Where will the material and backups live, who has access, and what is the deletion plan?
- People and law: Who in the newsroom may need access, what policy applies, and what jurisdiction-specific obligations may matter?
- Operational capacity: Can the newsroom set up and maintain the chosen system safely, and is specialist support available?
No single tool covers every layer. CPJ warns that communication metadata can reveal relationships, while RSF explains that encryption at rest does not secure transfer. If the likely consequences are severe, uncertainty is high, or the newsroom lacks the expertise to operate a system safely, consult a digital-security specialist before asking the source to send material. CPJ’s source-protection page captures the stakes succinctly: “Protecting confidential sources is a cornerstone of ethical reporting.”
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
