**Third parties don't have access to anything that happens in OnionShare.** Using OnionShare means hosting services directly on your computer. When sharing files with OnionShare, they are not uploaded to any server. If you make an OnionShare chat room, your computer acts as a server for that too. This avoids the traditional model of having to trust the computers of others.
**Network eavesdroppers can't spy on anything that happens in OnionShare in transit.** The connection between the Tor onion service and the Tor Browser is end-to-end encrypted. This means no network attackers can eavesdrop. Only Tor traffic is available to anyone at any point of the exchange. Even if eavesdropper is a malicious rendezvous node used to connect the Tor Browser with OnionShare's onion service, the traffic is encrypted using the identity private key.
**Anonymity of OnionShare users are protected by Tor.** OnionShare and Tor Browser protect the anonymity of the users. As long as the OnionShare user anonymously communicates the OnionShare address with the Tor Browser users, the Tor Browser users and eavesdroppers can't learn the identity of the OnionShare user.
**If an attacker learns about the onion service, it still can't access anything.** Prior attacks against the Tor network to enumerate the onion services amount to discovering the .onion address of the services on it. Accessing them is stopped by a random password (unless the OnionShare user chooses to turn it off and make it public). The password is generated by choosing two random words from a list of 6800 words, making 6800^2, or about 46 million possible passwords. Only 20 wrong guesses can be made before OnionShare stops the server, preventing brute force attacks against the password.
**Communicating the OnionShare address might not be secure.** Communicating the OnionShare address to people is the responsibility of the OnionShare user. If sent insecurely (such as through an e-mail message monitored by an attacker), an eavesdropper can tell OnionShare is being used. By loading the address in Tor Browser before the legitimate recipient gets to it, the service can be accessed. If this is to be avoided, the address must be communicateed securely, via encrypted e-mail, or in person. Voice call is a better secondary option than unencrypted chat in most cases, as it is a different network to eavesdrop. This isn't necessary when using OnionShare for something that isn't secret.
**Communicating the OnionShare address might not be anonymous.** To ensure maximum privacy, extra steps must be taken to ensure the OnionShare address is communicated securely. A new e-mail or chat account, only accessed over Tor, can be used to share the address. This isn't necessary unless anonymity is an absolute goal.
