A new SecureDrop Inbox will be released in the next few weeks, the result of work begun by the team in July 2025 to redesign how journalists process submissions on the SecureDrop Workstation.
What journalists and administrators need to know:
- Journalists will switch over to the new SecureDrop Inbox experience automatically through a system update.
- The legacy Client will still be available for one month. In case there are any issues with the new Inbox, the legacy Client can be opened by using Qubes Menu â–¸ Gear Icon â–¸ Other â–¸ SecureDrop Client (legacy).
- If you encounter any bugs or issues in the new Inbox, please let us know and we’ll get them fixed.
- The Support Team will keep you updated on specific dates and other details through your Signal Group. If you are using SecureDrop and don’t yet have a Support Signal Group, please reach out.
Why rewrite?
The legacy SecureDrop Client was originally written as a prototype for what an integrated journalist workstation could look like. It was successful at that, proving that it would dramatically simplify the process of reviewing submissions, saving countless journalist hours.
On a technical level, however, there were significant architectural problems that needed fixing, and we found ourselves unable to ship new features at a reasonable speed.
After exploring alternatives, we made the decision to do a full rewrite of the application, taking the opportunity to fix long-standing issues and set us up on a foundation that would make development faster going forward.
Notably, the Inbox is implemented in the Electron framework, which uses web technologies like HTML, CSS, and JavaScript, and allows us to benefit from a rich ecosystem of libraries and advanced developer tools. It’s the same tool kit used by other usable secure apps like Signal Desktop and 1Password.
Based on our experience over the past few months, the switch has paid off. Implementing new features takes a fraction of the time as in the legacy client application.
What’s better?
Check out our companion post for a full list, but here are some quick highlights:
- Sync has been fully reimplemented to be faster and more efficient, which will help with slow Tor connections.
- Performance should be much better for instances with a large number of sources (though you should still delete inactive sources regularly).
- You can now search the contents of messages, as well as sort and filter the source list.
- Large file downloads should be more robust; they can also now be canceled and resumed.
The new Inbox has undergone a security audit conducted by X-41 D-Sec (details to be published shortly).
What’s coming next?
In general, we are better equipped to make faster and more frequent improvements to the SecureDrop Inbox experience, and will be working through our feature backlog, as well as through new feature requests from journalists.
For the team’s next major project, we’ve already started work on integrating document sanitization via Dangerzone and supporting export to Signal.
If you are not yet using SecureDrop Workstation and would like to learn more, please reach out to our Support team.