Open source · Python · Tor

Tiny Desk: an anonymous notice board and message desk for Tor onion services

A minimal, JavaScript-free self-hosted app. Post notices and files, and let visitors send anonymous messages with no account, e-mail or name. One Python file, built on Flask and SQLite.

Star on GitHub Install in 5 minutes

Python 3.10+FlaskSQLiteTor onion serviceNo JavaScriptAES-256-GCM

Features

Notices

Public posts with image or .txt attachments, optional countdown timers, draft and hide controls.

Anonymous messaging

Visitors get a Ticket and Key. No account, e-mail or name. Messages are stored AES-256-GCM encrypted.

No JavaScript

Server-rendered pages with a strict Content-Security-Policy. Threads refresh through a meta-refresh iframe.

Downloads

Operator-uploaded files of any type, served as attachments.

Hardening

CSRF tokens on every POST, Argon2 admin password, short-lived admin sessions, request size limits, rate limits, magic-byte checks on attachments.

Housekeeping

Storage quotas, retention-based purge, orphan file sweep, and a check command for missing or stale files.

Install and run

You need Python 3.10+, a non-root user, and Tor if you want to publish it as an onion service.

Clone and install

git clone https://github.com/Sheikhlipu123/tinydesk.git
cd tinydesk
pip install -r requirements.txt

Set your directories and admin prefix

export ONION_SECRETS=/etc/tinydesk
export ONION_DATA=/var/lib/tinydesk
export ADMIN_PREFIX=$(python3 -c "import secrets;print(secrets.token_hex(8))")

python app.py init
python app.py setpass
python app.py status

Run it

gunicorn -w 1 --threads 4 -b 127.0.0.1:8000 --access-logfile /dev/null app:app

Publish over Tor by adding this to torrc, restarting Tor, and reading your address from the hostname file:
```
HiddenServiceDir /var/lib/tor/tinydesk/
HiddenServiceVersion 3
HiddenServicePort 80 127.0.0.1:8000
```

Configuration

Variable	Default	Meaning
`ONION_SECRETS`	`/etc/onionsite`	Keys and admin hash
`ONION_DATA`	`/var/lib/onionsite`	Database and uploaded files
`ADMIN_PREFIX`	`admin`	URL prefix of the admin area. Set your own.
`MAX_FILE_MB`	`25`	Largest upload
`QUOTA_MB`	`500`	Total space for files and attachments
`CONV_QUOTA_MB`	`200`	Total space for messages
`RETENTION_DAYS`	`30`	Delete idle threads on purge. 0 keeps everything.

Security model

Tiny Desk is honest about what it does and does not protect:

Tor protects the transport between visitor and server.
Messages are encrypted at rest, but the operator can read them. This is not end-to-end encryption.
A Ticket and Key cannot be recovered or reset. Anyone holding both can read and write in that thread.
Uploaded downloads can be any file type. Never open them on a privileged machine.
Back up the secrets directory. Losing msg.key makes stored messages unreadable.

Found a vulnerability? Please do not open a public issue. Use GitHub's private vulnerability reporting on the repository's Security tab.

Frequently asked questions

What is Tiny Desk?

Tiny Desk is a minimal, JavaScript-free notice board and anonymous message desk for Tor onion services, built with Flask and SQLite in a single Python file.

Does Tiny Desk require JavaScript?

No. Pages are server-rendered. Message threads refresh through a meta-refresh iframe.

Is Tiny Desk end-to-end encrypted?

No. Messages are encrypted at rest with AES-256-GCM, but the operator can read them. Tor protects the transport.

Do visitors need an account?

No. Visitors receive a Ticket and Key after sending a message. No account, e-mail or name is required.

Can I run it without Tor?

Yes, for local or internal use. Set COOKIE_SECURE=1 only when you serve it behind HTTPS.

Get involved

If Tiny Desk helps you, star the repository, open an issue with your use case, or send a pull request. Source code: github.com/Sheikhlipu123/tinydesk.