A government agency sends a legal notice to a hosting company. A court orders a domain registrar to suspend a name. A platform’s trust and safety team flips a switch and a page that existed a moment ago simply stops resolving. For most of the internet’s history, this has been the anatomy of a takedown, and it has worked because the modern web rests on a small number of chokepoints: the company that rents you server space, the registrar that leases you a domain name, the internet service provider that routes traffic to your address. Control any one of those chokepoints and you control whether a piece of information stays visible.
Over the past several years, a different model of publishing has moved from cryptography mailing lists and academic papers into daily use by journalists, archivists, and human rights researchers. Instead of storing a website on a single server owned by a single company, this model spreads copies of the content across many independent computers around the world, retrieves files by what they contain rather than where they sit, and in some cases pays once for storage that is designed to outlast the company that sold it. The result is publishing infrastructure that does not have an obvious single point to pressure, sue, or switch off.
This is not a hypothetical concept confined to whitepapers. Newsrooms have used it to keep archives of war crimes evidence intact. Press freedom organizations have used it to preserve records of journalists being arrested, so that the record of the arrest cannot itself be erased. Document-preservation nonprofits have used it to protect millions of pages of public records from disappearing when a government agency changes its mind about what the public should be allowed to see. At the same time, the very feature that makes this infrastructure valuable to a persecuted journalist, that nothing can be quietly deleted, makes it just as attractive to people publishing material that most societies agree should be removable: harassment campaigns, extremist propaganda, and material that exploits real victims.
The pattern is familiar to anyone who has watched a controversial news story vanish overnight. A domain gets seized by a law enforcement agency acting on a court order. A cloud provider terminates an account after a policy complaint, sometimes within hours and with little opportunity for the publisher to appeal before the content is already gone. A payment processor cuts off a nonprofit’s ability to accept donations, starving it of the resources needed to keep its own servers running. None of these actions require proving anything in an open courtroom; they only require persuading, or pressuring, the one company sitting between a publisher and its audience. Censorship-resistant publishing did not emerge to make any single one of these pressure points illegal or impossible to use. It emerged because enough people who depend on getting information online, and keeping it there, decided the safest strategy was to stop depending on any single company at all.
This article works through both sides of that trade-off in plain language, written for a reader who has never used a peer-to-peer network and does not need to become a programmer to follow along. It starts with what censorship-resistant publishing actually means and how the underlying technology differs from a conventional website. It walks through the specific tools involved, including the peer-to-peer storage network known as IPFS and the permanent-storage systems Arweave and Filecoin. It then turns to documented, real-world examples of the technology in use, drawn from journalism organizations, archival nonprofits, and human rights investigators who have published verifiable accounts of their work. From there, it examines who benefits most from publishing that resists removal, followed by an honest look at the moderation problems this same durability creates, and the practical and legal limits that keep decentralized hosting from being truly unstoppable. The goal is not to promote or dismiss this technology, but to give a reader with no prior background a clear, grounded picture of what it can and cannot do.
What Censorship-Resistant Publishing Actually Means
To understand what makes a website resistant to takedowns, it helps to first understand how an ordinary website can be taken down in the first place. A typical site lives on a server, which is a computer owned or rented by a hosting company. That server has a numeric internet address, and a domain name system, or DNS, translates a human-readable address like a news outlet’s web address into that number so browsers know where to send requests. Every part of that chain is a business relationship: the site owner pays a hosting company, and pays a separate registrar to lease the domain name for a fixed period. If the hosting company receives a legal order, a policy complaint, or simply decides the content violates its terms of service, it can remove the files from its server and the site disappears. If a registrar suspends or reassigns the domain, visitors typing in the familiar address no longer reach the site at all, even if the underlying files still exist somewhere.
Censorship-resistant publishing changes this arrangement by removing the single company in the middle. Instead of one server, the content is stored, in whole or in part, on a network of independent computers run by unrelated people and organizations, sometimes numbering in the thousands, who volunteer or are paid to keep copies. Instead of being retrieved by its location, meaning the address of a specific server, the content is retrieved by what is called content addressing: a unique digital fingerprint is generated from the file itself, and any computer on the network holding a copy that matches that fingerprint can serve it to a requester. This distinction matters enormously. A location address points to one place, and if that place goes offline or refuses to answer, the content is unreachable. A content address points to the content itself, and as long as any single node on the network still holds a copy, the fingerprint will resolve to it.
It is worth being precise about what content addressing does and does not solve, since the distinction gets lost in casual descriptions of the technology. Content addressing solves the problem of finding a specific, verifiably unaltered file without depending on a single server’s continued existence. It does not, by itself, guarantee that a copy of the file will always exist somewhere on the network, and it does not make the file undiscoverable to anyone trying to trace who originally uploaded it. Those are separate engineering problems, addressed by separate parts of the broader decentralized publishing toolkit, and conflating them is one of the most common sources of confusion for newcomers evaluating whether this technology suits their needs.
Several distinct technologies build on this idea, and they are often confused with one another despite doing different jobs. The InterPlanetary File System, universally known as IPFS, is a protocol for storing and sharing files across a peer-to-peer network using content addressing; it does not guarantee permanence on its own, since a file only stays available as long as some node chooses to keep, or “pin,” a copy. Arweave and Filecoin are separate networks built around the economics of long-term storage: they use blockchain-based payment and incentive systems so that people storing data are compensated, and in Arweave’s case, a single upfront payment is intended to fund storage indefinitely. Sitting alongside these storage systems are blockchain-based naming systems, most notably the Ethereum Name Service, or ENS, which let a publisher register a human-readable name that is recorded on a blockchain rather than in the conventional domain name system, making it far harder for a single registrar or government order to reassign or suspend. None of these tools were originally built with censorship resistance as their headline feature; all of them acquired that reputation because of what their underlying architecture makes structurally difficult to do, which is remove content by leaning on one company.
The domain seizure is worth dwelling on for a moment, because it is one of the most common and least understood forms of takedown. Domain names are not owned outright the way a piece of physical property is; they are leased for a period, usually a year at a time, from a registrar that itself answers to a central registry and, ultimately, to the legal jurisdiction in which it operates. Courts and law enforcement agencies in the United States and elsewhere have used this leverage for years to seize domains associated with piracy, fraud, and other unlawful activity, redirecting visitors to a government notice instead of the original site, and the same legal mechanism can be, and periodically has been, aimed at domains hosting political speech, leaked documents, or reporting that a government finds inconvenient rather than illegal. A blockchain-based name never touches that registry at all, which is precisely why it appeals to publishers who have already watched a domain disappear once and do not want to rebuild their audience from zero a second time.
Taken together, these tools describe a spectrum rather than a single product. A publisher might use IPFS purely to distribute files efficiently, use Arweave specifically because permanence is the point, or use an ENS name only to make an IPFS-hosted site reachable through a memorable address instead of a long cryptographic string. What unites them, and what separates this approach from a conventional website, is the absence of a single company or government body that can unilaterally make the content disappear by revoking a single piece of infrastructure. The sections that follow examine how these systems actually function, and how real organizations have put them to use.
The Technology Making Websites Unstoppable
Understanding why decentralized hosting resists takedowns requires looking past the marketing language and into the mechanics of how a file actually moves from a storage network to a reader’s screen. The general architecture looks the same across most of these systems: a piece of content is broken into pieces or stored as a whole, distributed across many independent computers, and made retrievable through a reference that does not depend on any one of those computers staying online. But retrievability is not the same as guaranteed permanence, and the details of how each system handles that distinction explain both their strengths and their most common criticisms.
A reader rarely interacts with a peer-to-peer storage network directly. Most people still reach this content through an ordinary web browser, using what is called a gateway: a conventional web server that translates a normal web request into the specialized protocol the storage network uses, fetches the content, and hands it back as a regular webpage. Gateways are a practical necessity, since most internet users do not run specialized software, but they also reintroduce a version of the chokepoint problem, because a single gateway can be blocked or pressured even if the underlying content is still safely distributed across the network. Redundancy is the answer that these systems rely on: because many independent gateways and nodes exist, blocking one rarely blocks all of them, and technically capable users can bypass gateways altogether by running the underlying software themselves.
Some publishers try to reduce their dependence on any single gateway by pointing several different gateway addresses at the same underlying content, or by encouraging readers to install a browser extension, such as IPFS Companion, that lets the browser talk to the peer-to-peer network directly rather than routing every request through one intermediary server. This layered approach mirrors the logic of the storage layer itself: just as pinning the same file across many independent nodes prevents any one node’s disappearance from taking the file offline, spreading access across many independent gateways prevents any one gateway’s disappearance, or blocking, from cutting readers off entirely.
From Location Addressing to Content Addressing: How IPFS Works
IPFS is the most widely used peer-to-peer storage protocol behind censorship-resistant publishing, and its core innovation is the switch from location addressing to content addressing described earlier. When a file is added to IPFS, the network runs it through a cryptographic hashing function that produces a unique string of characters derived entirely from the file’s contents. This string, called a content identifier or CID, becomes the file’s permanent reference. Change a single character in the file and the hash changes completely, which means the CID also functions as a built-in integrity check: if a file matching a given CID can be retrieved at all, it is guaranteed to be identical to the original, since any tampering would produce a different hash.
Once a file has a CID, any computer running IPFS software can request it, and any computer that holds a copy, referred to as a node, can respond, regardless of where either party is physically located or which company operates their internet connection. This is fundamentally similar to how BitTorrent distributes files, and in fact IPFS borrows heavily from that lineage. The network does not automatically keep every file forever, however. A file only remains available as long as at least one node continues to “pin” it, meaning deliberately keep and serve a copy. Publishers who want assurance that their content survives typically use a pinning service, a company or nonprofit that is paid or otherwise motivated to keep a permanent copy online, or they rely on many independent parties choosing to mirror content they consider valuable, exactly as happened when volunteers mirrored blocked Wikipedia content onto IPFS after Turkey blocked access to Wikipedia between 2017 and 2020, a widely documented early example of the model being used to route around a government block rather than a corporate one.
The practical censorship resistance IPFS offers, then, comes from combining content addressing with distributed pinning. A government or company can order a specific gateway blocked, or can pressure a specific pinning service to stop hosting particular content, but as long as even one other node somewhere in the world keeps a pinned copy, the content remains retrievable by its CID through any gateway or any node that will serve it. This is a meaningfully different failure mode than a conventional website, where removing the one server or blocking the one domain name ends access entirely. It is also, as later sections will show, not an unconditional guarantee, since a file with no motivated party willing to pin it can quietly disappear from the network even though its CID is technically still valid.
Permanent Storage and the Rise of the Permaweb
IPFS solves the problem of distributing files without a single point of control, but it deliberately does not solve the separate problem of guaranteeing that a file stays available forever, since nothing forces any node to keep pinning content indefinitely. A newer generation of storage networks was built specifically to close that gap, and the most prominent of these is Arweave, a protocol whose backers describe its goal as building what they call the “permaweb,” a version of the web designed to be genuinely permanent rather than merely distributed.
Arweave’s approach rests on an economic model rather than a purely technical one. Instead of asking a publisher to pay an ongoing hosting bill or hope that volunteers keep pinning their files, Arweave charges a single upfront fee when data is uploaded. That fee is placed into an endowment structured to fund the cost of storing the data for a very long time, with the network’s miners compensated for continuing to hold and serve copies of the data across a large, geographically distributed set of hard drives. Filecoin operates on a related but distinct model: rather than a single endowment, it runs an open storage marketplace in which people needing storage strike ongoing deals with independent storage providers who are paid in the network’s own token and whose performance is continuously verified through cryptographic proofs that they are, in fact, still storing the data they were paid to store. Where IPFS answers the question of how to retrieve a file without relying on one server, Arweave and Filecoin answer the harder question of how to make sure someone is actually still storing that file years or decades from now, and in practice, the two approaches are frequently combined, with IPFS-style addressing used to reference content that is durably stored on Filecoin’s network.
The verification piece of Filecoin’s design deserves particular attention, because it addresses a problem that is easy to overlook: simply paying someone to store data is not the same as confirming they are actually still doing it. Filecoin’s network periodically requires storage providers to generate cryptographic proofs demonstrating that they still physically hold the exact data they agreed to store, without needing to transmit the entire dataset back across the network to prove it. Providers who fail these checks lose the collateral they staked when they took on the storage contract, which gives them a direct financial incentive to keep their word rather than quietly deleting data and hoping no one notices. This ongoing verification is part of why institutions handling sensitive archival material have been willing to treat Filecoin as more than a speculative experiment.
The stakes of that durability question became concrete within weeks of Russia’s full-scale invasion of Ukraine in February 2022, when volunteers and archivists began using Arweave to preserve a rapidly growing body of wartime documentation, including press releases, social media posts, photographs, and video, that was at risk of being deleted, taken offline, or lost amid the chaos of the conflict. By late February 2022, outlets including Bloomberg reported that the Arweave community had archived several million individual documents and pieces of media related to the invasion, with later community tallies citing more than five million items preserved on the network specifically because a permanent, tamper-resistant record was considered essential to countering disinformation and later enabling accountability efforts. That episode illustrates the practical difference permanence makes: a conventional web archive still depends on the archiving organization continuing to pay its hosting bills and continuing to exist, while data committed to Arweave’s endowment model is intended to persist independent of any single archivist’s continued involvement.
That archival effort has continued well beyond its first weeks. Later community tallies cited by researchers tracking the project put the total volume of Ukraine-related material preserved on Arweave at more than six million individual pieces of data, spanning press releases, official statements, photographs, and video, with volunteers and organizers emphasizing that the point of the effort was not simply to collect material but to ensure it existed in a form that could later support fact-checking and, potentially, formal accountability processes that might depend on evidence being demonstrably unaltered since the moment it was captured.
This distinction between distribution and permanence is easy to overlook but matters enormously for anyone deciding how to preserve material they cannot afford to lose. A file pinned only on IPFS by a single enthusiastic volunteer is genuinely at risk if that volunteer loses interest, runs out of storage space, or simply forgets to renew a server. A file stored on Arweave, so long as the network itself continues to operate and its economic model continues to hold, carries a structurally different and stronger durability guarantee, which is precisely why archival and journalism projects concerned with long-term evidentiary integrity have gravitated toward it, and why Filecoin has attracted similar interest from institutions seeking verifiable, ongoing proof that their data has not quietly disappeared.
Real-World Case Studies: Journalism and Records That Survived the Takedown
The theory behind censorship-resistant publishing is only as convincing as its track record, and several organizations working in journalism, human rights documentation, and public records have now published verifiable, dated accounts of putting this infrastructure to real use rather than merely experimenting with it in private. Three examples in particular illustrate how differently this technology gets applied depending on what is actually at stake.
The Freedom of the Press Foundation, a nonprofit focused on defending journalists, published a detailed account on May 19, 2022, describing how it began making the underlying database of its U.S. Press Freedom Tracker available on IPFS as a proof of concept. The Tracker is a database documenting press freedom violations across the United States, including journalists arrested, assaulted, or having their equipment confiscated, and by 2022 it held roughly five years of accumulated incident records. The foundation’s technologist published the dataset under a persistent IPNS address, a kind of stable pointer that always resolves to the latest IPFS-hosted version of the file even as the file itself changes, and configured the system to republish an updated snapshot roughly every hour along with a changelog documenting every prior version and when it was published. The foundation was explicit about its reasoning: because files shared on IPFS are mirrored across many nodes rather than sitting on one server, the protocol is, in the organization’s own words, particularly resistant to censorship or deletion, an important property for a database that exists specifically to document attacks on the press and that a hostile actor might otherwise have strong incentive to alter or erase.
A second, larger-scale example comes from MuckRock, the public records journalism organization, and its document-hosting platform DocumentCloud, working with support from the Filecoin Foundation for the Decentralized Web. Since 2022, the two organizations have been building infrastructure to protect the more than eleven million public interest documents MuckRock has helped obtain and host, an archive that includes court filings, government reports, and declassified material that is often obtained only after lengthy public records fights and that can be difficult or impossible to re-obtain if it is later deleted or restricted. By 2024, more than 750,000 of DocumentCloud’s verified documents, drawn from a collection exceeding eight million documents overall, had been stored on the Filecoin network, including a portion of the CIA’s CREST database of declassified intelligence records, one of the more heavily used archives by researchers and journalists. The organizations framed the effort explicitly around resilience: government agencies periodically restrict, paywall, or remove access to records that were previously public, and a copy verifiably stored on a decentralized network is not vulnerable to a single agency’s later decision to make that same material harder to find.
The choice of the CIA’s CREST database as an early priority for this preservation effort is itself instructive. CREST, short for the CIA Records Search Tool, holds millions of pages of declassified records that the agency only made available online after years of public pressure and litigation, and researchers who have relied on it in the past have seen firsthand how a database like this can become harder to access, whether through technical changes, funding decisions, or shifting agency priorities, even without any formal decision to reclassify the underlying material. By storing a redundant copy on a network that does not depend on the CIA’s own servers staying configured exactly as they are today, MuckRock and DocumentCloud aimed to ensure that years of hard-won public access could not quietly erode simply because the original source became less convenient to maintain.
A third example shows the technology applied to a single, high-stakes investigative project rather than an ongoing database. In 2023, the nonprofit research lab Starling Lab, working with Rolling Stone and the VII Foundation, published “The DJ and the War Crimes,” an eleven-month investigation built around photographer Ron Haviv’s original 35mm film documenting the 1992 Bijeljina massacre committed by the Serbian paramilitary group known as Arkan’s Tigers during the Bosnian war. To ensure the authenticity of the photographs and supporting documents, including previously unreleased Serbian state security payroll records, could never be credibly disputed or quietly altered, the project team cryptographically hashed each file and registered those hashes across three independent, tamper-resistant ledgers, including the Numbers Protocol and Avalanche blockchains, with the underlying files themselves stored on the Filecoin network with support from genocide scholars at the USC Shoah Foundation and engineers at Stanford University. The result is an archive in which any future attempt to alter or discredit the evidence can be checked against a permanent, independently verifiable record of exactly what was published and when.
What made this project distinct from a conventional investigative archive was the layering of authentication on top of storage. Simply storing a file on a decentralized network preserves it, but it does not, by itself, prove that the file has not been swapped or altered since it was first uploaded. By generating a cryptographic hash of each original photograph and document, tying that hash to the moment of capture, and then anchoring the hash across multiple independent ledgers rather than just one, the Starling Lab team built a record that tens of thousands of independent computers across those networks now hold a copy of, meaning any future attempt to dispute the authenticity of Haviv’s photographs would have to somehow compromise a majority of a globally distributed set of independent record-keepers rather than a single archive or a single institution’s word.
These three cases sit at different points on the same spectrum. The Press Freedom Tracker shows a relatively lightweight, ongoing use of IPFS to protect a living database. The MuckRock and DocumentCloud partnership shows the technology applied at genuine institutional scale, across millions of documents built up over years of public records work. The Starling Lab project shows the most demanding application, where the goal is not simply keeping a file online but creating a permanent, cryptographically verifiable chain of custody for evidence that may eventually be used in accountability proceedings. What unites all three is that each organization chose this infrastructure not out of novelty but because a conventional server, however well run, could not offer the same structural guarantee against a single point of failure or a single actor’s decision to make the record disappear.
The Free Expression Case for Decentralized Publishing
The clearest argument in favor of censorship-resistant publishing comes from looking at who actually needs it most, and the answer is rarely a hypothetical dissident in a hypothetical authoritarian state. It is journalists, archivists, and ordinary information sources operating in documented, current circumstances where conventional publishing has already failed them.
Independent Russian media offers one of the starkest recent illustrations. Within days of Russia’s full-scale invasion of Ukraine in February 2022, the Russian government moved to block or shut down nearly every remaining independent news outlet in the country, including Meduza, TV Rain, Novaya Gazeta, and the radio station Ekho Moskvy, cutting off domestic audiences from non-state-approved reporting on the war. Meduza was blocked inside Russia in March 2022 and became one of the earliest beneficiaries of Reporters Without Borders’ long-running Operation Collateral Freedom, which creates exact mirror copies of blocked news sites and hosts them on the servers of major content delivery networks that also carry huge volumes of unrelated, commercially important traffic, making the mirrors far costlier and riskier for a government to block outright than the original site. This mirroring approach is a close conceptual cousin of decentralized hosting rather than the same technology, since it still relies on centralized cloud infrastructure rather than a peer-to-peer network, but it demonstrates the same underlying principle: multiplying the number of places a piece of content lives multiplies the cost and difficulty of suppressing it. As of recent reporting, Operation Collateral Freedom has grown to support more than 170 blocked media outlets and press freedom websites across dozens of countries, with Meduza continuing to face sustained cyberattacks against its mirrors even years after the initial block, including large-scale disruption attempts reported in early 2024 that involved blocking Meduza’s mirror addresses on a rolling basis every ten to twenty minutes in an apparent attempt to outpace the mirroring system itself.
The persistence of that cat-and-mouse dynamic is itself a useful lesson about the limits and the value of resilience-based strategies. Reporters Without Borders has not made Meduza’s mirrors literally unblockable, and the organization’s own reporting acknowledges the Kremlin has continued adapting its blocking techniques in response. What the mirroring strategy has done is force the state to spend continuous effort and resources chasing a moving target, rather than achieving a permanent win with a single blocking order, buying the outlet’s journalists time and reach they would not have had if the fight had ended the moment the original domain went dark.
Archivists and public-interest researchers form a second group with a direct stake in this technology, and their concern is often less about active government censorship than about the slower, quieter risk of institutional forgetting. Public records can be reclassified, agency websites get redesigned in ways that break old links, budget cuts can end a digitization project midstream, and court rulings can retroactively seal documents that were once public. The MuckRock and DocumentCloud effort described earlier exists precisely because this kind of loss happens routinely and rarely makes headlines, and because a copy of a document that is verifiably stored on a decentralized network is not vulnerable to any single custodian’s later decision to restrict it.
A third group benefiting from censorship-resistant publishing consists of people and organizations targeted less by governments than by other private actors, including platforms themselves. A creator or small publisher who depends entirely on a single social media account or a single web host is exposed to that company’s own moderation decisions, its changing terms of service, and its vulnerability to coordinated complaint campaigns designed to trigger a takedown regardless of whether the underlying content actually violates any rule. Publishing content in a way that does not depend entirely on one platform’s continued goodwill gives a publisher a form of leverage that a purely centralized presence does not, even if, as later sections discuss, that same publisher typically still relies on conventional platforms for discovery and audience reach in practice. This dynamic has become more visible as more publishers of all sizes have experienced sudden account suspensions or policy-driven removals with little advance warning and limited recourse, prompting a broader conversation across the journalism and creator economy about how much of a publication’s survival should depend on decisions made unilaterally inside a single company.
Across all three groups, the benefit is best understood as resilience rather than invisibility. None of these tools make a publisher’s identity or activity untraceable, and none of them guarantee an audience will actually find the content. What they change is the number of decision points an outside party would need to control in order to make information disappear entirely, shifting the balance from a single vulnerable chokepoint toward a distributed system that is considerably more expensive and more difficult to suppress in full.
The Moderation Problem: When Nothing Can Be Taken Down
The same architectural properties that protect a war crimes archive or a press freedom database from deletion apply with equal force to content that virtually everyone agrees should be removable. This is not a hypothetical concern raised by critics unfamiliar with the technology; it is a problem the developer communities behind IPFS and similar protocols have openly grappled with, because content addressing and distributed pinning do not distinguish between a courageous piece of independent journalism and material that exploits real victims, incites violence, or spreads deliberate falsehoods designed to cause real-world harm.
The core difficulty is structural rather than incidental. On a conventional platform, a single company can identify a piece of harmful content and remove it from its servers, and in most cases that single act of removal genuinely ends public access to that specific copy, even though determined actors can and do re-upload it elsewhere. On a network built around distributed, content-addressed storage, removing a piece of content requires convincing or compelling every node that holds a pinned copy to stop serving it, and on a permanence-focused network like Arweave, the entire design goal is to make that kind of removal effectively impossible once the data has been committed to the network and its storage fee paid. A system engineered specifically to resist a government’s attempt to erase evidence of a war crime is, by the same token, engineered to resist a victim’s attempt to have non-consensual or exploitative material about themselves removed, and reconciling those two outcomes has no clean technical solution.
In practice, the burden of moderation does not disappear under this model; it relocates. Gateway operators, the companies and volunteers running the servers that translate ordinary web requests into IPFS or Arweave queries, have increasingly become de facto moderators by choosing which content their own gateways will serve, even though the underlying data remains technically retrievable through other gateways or through direct peer-to-peer software. Pinning services face similar pressure, since refusing to pin or actively unpinning certain content is one of the few levers they have, even though it does not remove copies that other, unaffiliated nodes have already chosen to keep. This creates a strange middle ground in which the most objectionable material is rarely made fully inaccessible, but is pushed toward less convenient corners of the network that require more technical effort to reach, a partial mitigation rather than a solution.
Law enforcement and legal takedown processes, which are built around the assumption that a single company can be served with an order and be expected to comply by removing content from servers it controls, translate poorly onto this architecture. A court order directed at a hosting company has no equivalent target when the content in question is distributed across thousands of independent nodes in dozens of jurisdictions, many of which may have no legal relationship to the original publisher and no practical way to be identified or compelled at all. This does not mean illegal content on these networks is beyond the reach of law enforcement entirely, since investigators can still pursue the individuals who uploaded or requested the content, and gateway or pinning-service operators within a given country’s jurisdiction can still face legal pressure, but it does mean the fast, centralized removal that conventional platforms can offer is often simply unavailable.
Developers working on IPFS itself have discussed this tension openly rather than treating it as a public relations problem to be managed. Conversations among the protocol’s own engineers, visible in the project’s public issue trackers, have wrestled with questions such as how a network explicitly designed to resist censorship in places like China should respond when the content in question is not political speech but something with no defensible purpose at all, and no consensus position has fully resolved the disagreement, because any technical fix strong enough to reliably filter one category of content would also weaken the guarantees that make the network valuable for the other. That unresolved status is not a sign of negligence; it reflects a real conflict between two values, durability and accountability, that the underlying architecture cannot fully satisfy at the same time.
None of this is an argument that censorship-resistant publishing is a net negative, any more than the existence of arson is an argument against matches, but it is a genuine and unresolved tension at the center of the technology rather than a peripheral edge case. The organizations profiled earlier in this article chose this infrastructure specifically because they wanted their material to be effectively impossible to erase, and any honest account of that choice has to acknowledge that the same durability is available, without discrimination, to material with no redeeming purpose at all.
Legal, Technical, and Practical Limits of Censorship Resistance
Despite the strong claims often made about this technology, none of the tools discussed in this article make a website or a piece of content truly unblockable, and treating the label “censorship-resistant” as synonymous with “unstoppable” misunderstands how these systems actually fail in practice. The resistance these networks offer is real, but it operates at a specific layer of the internet’s infrastructure, and there are several other layers where conventional forms of pressure still work.
The most direct limitation is that most people still reach decentralized content through ordinary internet connections and ordinary web browsers, which means the gateways and internet service providers sitting between a reader and the storage network remain a viable target for blocking. GreatFire, an organization that monitors internet censorship in China, has documented that the majority of standard access points to IPFS-hosted Wikipedia content are blocked within mainland China, using the same combination of IP blocking, DNS interference, and traffic filtering the country’s so-called Great Firewall applies to thousands of other sites. This demonstrates that content being technically retrievable from a peer-to-peer network is not the same as content being practically reachable by an ordinary user inside a jurisdiction determined to prevent it, since a government controlling the national internet backbone can still filter the traffic needed to reach almost any gateway, leaving only more technically demanding circumvention methods available to a small fraction of determined users. The blocking documented by GreatFire is also a reminder that decentralized systems tend to fail unevenly rather than completely, since some gateway addresses associated with the same underlying content have remained accessible even as most others were filtered, meaning the practical experience of censorship resistance can vary enormously depending on which specific access point a user happens to try.
A second limitation involves the parts of this ecosystem that still rely on conventional infrastructure even when the core storage does not. A human-readable domain name pointing to decentralized content, unless it uses a blockchain-based system like ENS, is still typically leased through an ordinary registrar and remains just as seizable as any other domain, meaning a publisher who wants both memorability and true resistance to domain seizure has to deliberately choose blockchain-based naming and accept that most readers will find it less familiar and harder to type or remember. Even blockchain-based names are not immune from all pressure, since the software wallets, browser extensions, and app store listings that make them convenient for ordinary users to access can themselves be removed from centralized app marketplaces, and the exchanges or services many people use to register and manage them can still be subject to regulatory action in the country where they operate.
A third limitation is legal rather than technical. Publishing something on a network designed to resist deletion does not remove the legal liability of the person who published it, and defamation, intellectual property, and other legal claims can still be pursued against an identifiable publisher regardless of how durably their content is stored, with courts increasingly willing to treat the act of uploading to a persistent network as itself the legally relevant act, separate from whether the resulting file can later be deleted. Financial and infrastructure pressure also remains available even when direct content removal does not: a payment processor can decline to serve an organization, a cloud company hosting a gateway can be lobbied to change its policies, and the operators of a specific service, even a decentralized one, are still people or companies who can be subject to conventional legal process in whatever country they happen to reside in.
Finally, there is a quieter but equally significant limitation around discoverability. Being technically impossible to delete is of limited practical value if almost no one can find the content in the first place, and most decentralized publishing still depends heavily on conventional search engines, social media platforms, and news aggregators to reach an audience, all of which retain full discretion over what they choose to index, recommend, or allow to be shared. A file preserved forever on Arweave that no search engine indexes and no major platform will let users link to still achieves the narrow goal of preservation, but it falls well short of the broader goal most publishers actually care about, which is being read.
Final Thoughts
Censorship-resistant publishing represents a genuine structural shift in how information can survive pressure, not a marginal improvement on the conventional website. By replacing a single company’s server with a content-addressed reference that any of thousands of independent nodes can answer, and by replacing an ongoing hosting bill with an endowment or marketplace built to fund storage for decades, these systems remove the single points of control that have made takedowns so effective for so long. That shift matters most for the people this article has focused on: journalists documenting press freedom violations, archivists racing to preserve records before they vanish, and investigators building evidentiary archives meant to outlast the individuals and institutions that would prefer certain facts stay buried.
That transformative potential does not arrive free of cost, and the same feature driving it, permanence without a removal mechanism, is precisely what makes this technology so difficult to reconcile with legitimate demands for accountability. A tool built so that a government cannot quietly erase evidence of an atrocity is, without any additional engineering, also a tool that a harasser can use to make sure their target’s private information can never fully be scrubbed from the internet. Societies have spent decades building legal and institutional processes for weighing exactly this kind of conflict between preservation and removal, and those processes assume a removable target exists somewhere for a court order or regulator to act against. Decentralized publishing does not eliminate that need for judgment; it just moves the decision earlier, to the moment of upload, and distributes responsibility across a wider and less accountable set of participants, including gateway operators and pinning services who never asked to become moderators but increasingly function as one anyway.
The organizations profiled throughout this article did not adopt this infrastructure because it was fashionable. The Freedom of the Press Foundation, MuckRock and DocumentCloud, and Starling Lab each made a deliberate judgment that the specific material they were protecting, records of violations against journalists, millions of public interest documents, and evidence tied to a documented massacre, carried enough public value and enough risk of deliberate erasure that the tradeoffs of permanent, distributed storage were worth accepting. That is a useful frame for thinking about where this technology belongs going forward: not as a wholesale replacement for the conventional web, which most publishers and most readers will keep using because it is faster, more discoverable, and easier to moderate, but as a deliberately chosen layer of protection for the specific category of information whose loss would be genuinely irreversible.
The trajectory ahead depends less on any single technical breakthrough than on whether the institutions building on this infrastructure, and the broader public that benefits from a more resilient historical and journalistic record, can develop workable norms for the moderation questions this article has raised, without abandoning the core property that made the technology valuable in the first place. Financial inclusion advocates, press freedom organizations, and human rights investigators are already demonstrating what responsible, purpose-driven use of this infrastructure looks like in practice. The harder work, still underway, is building the surrounding social and legal scaffolding sturdy enough to match the durability of the storage itself.
FAQs
- What does it actually mean for a website to be “censorship-resistant”?
It means the website’s content is stored and distributed in a way that does not depend on a single company or government-controlled chokepoint, such as one hosting provider or one domain registrar, so that removing or blocking one access point does not make the content disappear entirely. - Is IPFS the same thing as a cryptocurrency?
No. IPFS, the InterPlanetary File System, is a peer-to-peer protocol for storing and retrieving files by content rather than location. It has no built-in currency of its own, though it is often used alongside blockchain-based systems like Filecoin that do involve tokens. - How is Arweave different from IPFS?
IPFS focuses on distributing files across a network without guaranteeing they stay online forever, since files depend on someone continuing to “pin” them. Arweave is designed specifically for permanence, using a one-time payment intended to fund storage for a very long time through an endowment model. - Can decentralized hosting really never be taken down?
No system offers absolute immunity. Governments can block the gateways most people use to reach the content, and legal pressure can still target the individuals or services involved. Decentralized hosting raises the cost and difficulty of a full takedown; it does not eliminate every point of leverage. - Who is actually using this technology for journalism right now?
Documented users include the Freedom of the Press Foundation, which has published its U.S. Press Freedom Tracker database on IPFS since 2022, and MuckRock and DocumentCloud, which have stored more than 750,000 public interest documents on the Filecoin network with support from the Filecoin Foundation for the Decentralized Web. - Doesn’t permanent storage also protect harmful or illegal content?
Yes, and this is one of the technology’s most serious unresolved tensions. The same durability that protects war crimes evidence or press freedom records also makes it far harder to remove disinformation, extremist material, or content that exploits real victims once it has been distributed across a network. - What is a content identifier, or CID, and why does it matter?
A CID is a unique digital fingerprint generated from a file’s actual contents using cryptographic hashing. It lets a network retrieve the exact file requested from any node that holds a copy, and it also verifies the file has not been altered, since changing the content changes the fingerprint. - Do I need special software to visit a decentralized website?
Not necessarily. Most people reach IPFS or Arweave-hosted content through ordinary web browsers using a gateway, a conventional server that translates the request into the specialized protocol. Gateways can be blocked individually, however, so people facing determined censorship sometimes need dedicated software instead. - What is ENS and how does it relate to censorship resistance?
The Ethereum Name Service, or ENS, lets publishers register human-readable names recorded on a blockchain rather than through a conventional domain registrar, making the name itself far more difficult for a single registrar or court order to seize or suspend compared to a standard web address. - Why did Starling Lab and Rolling Stone use this technology for a war crimes investigation?
Their 2023 project on the Bijeljina massacre needed an archive that could never be credibly altered or disputed. By cryptographically hashing the evidence and storing it across multiple independent ledgers and the Filecoin network, they created a permanent, verifiable record with support from Stanford engineers and USC Shoah Foundation scholars.