← Privacy Guides

Devices & OS

Tails: a computer that forgets

Start a computer from a USB stick running Tails: everything goes through Tor, and nothing is kept when you shut down unless you choose to save it.

  • High threat
  • Time 1 hour
  • Difficulty Moderate
  • Last verified against Tails 7.14

What this protects, and what it doesn't

Protects

  • Against leaving traces on the computer: Tails runs from the USB stick and erases its working memory at shutdown.
  • Against websites and your network linking your activity to your location: all traffic goes through the Tor network.
  • Against a lost USB stick exposing your saved files: the optional Persistent Storage is encrypted with a passphrase.
  • Against malware already installed on the computer's usual operating system, which does not run while Tails is started.

Does not protect

  • Hardware keyloggers and other physical devices added to the computer: no operating system can detect them.
  • Compromised BIOS or firmware: Tails depends on it to boot, and cannot check it.
  • Your own behaviour: signing into your usual accounts, or mixing several identities or tasks in one session, can reveal who you are.
  • Traffic without HTTPS after the last Tor relay: the exit node can read or alter it.
  • Hiding that you use Tor: your internet provider can see Tor connections, websites can recognise Tor exit nodes, and some networks block Tor.
  • An adversary who can watch both ends of a Tor connection, who may correlate the traffic.

Prerequisites

  • A USB stick of at least 8 GB that you can erase completely.
  • A 64-bit x86 computer (Intel or AMD) with about 3 GB of RAM. Tails does not run on Macs with Apple processors (M1, M2 and later), on ARM devices, phones or tablets.
  • A computer you trust for the download and installation.

Step by step

  1. Download Tails from tails.net only

    Start at the official install page and pick the guide for the computer you are using now (Windows, macOS, Linux, or the command line on Debian or Ubuntu). Do the download and installation on a computer you trust: a compromised computer can corrupt the stick.

  2. Verify the download

    On the download page, use the Select your download to verify button: it checks the file in your browser and reports whether verification succeeded. If JavaScript is off, compare the file's checksum with the one Tails publishes. An OpenPGP signature is also available, but Tails no longer gives step-by-step OpenPGP instructions.

    Do not install a file that fails verification. Download it again.

  3. Install it on the USB stick and start from it

    Follow the install guide for your system. It overwrites everything on the stick. Then restart the computer and start it from the USB stick; the guide explains the boot-menu key for your computer.

    At the Welcome Screen, choose your language and keyboard. Then connect to Tor.

  4. Decide what, if anything, to keep

    By default, nothing survives a shutdown. If you need to keep files or settings, create the Persistent Storage: an encrypted partition (LUKS) on the rest of the stick, protected by a passphrase. Use 5 to 7 random words for it.

    Turn on only the features you need, in Apps ▸ Tails ▸ Persistent Storage. Options include the Persistent Folder (your documents), Welcome Screen settings, Network Connections (Wi-Fi passwords), Tor Bridge, Tor Browser Bookmarks, GnuPG and SSH keys, Thunderbird, Additional Software and Dotfiles. You choose at each start whether to unlock it.

    The Persistent Storage is not hidden. Anyone with the stick can see that it exists, and you could be forced to reveal the passphrase.

  5. Pick a Tor Browser security level

    Tor Browser has three security levels:

    • Standard (default): everything works.
    • Safer: JavaScript is off on sites without HTTPS, some fonts and math symbols are disabled, and audio and video are click-to-play.
    • Safest: JavaScript is off on all sites, and some fonts, icons, images and media are disabled. Many sites break, but far less code can run.

    Choose Safer or Safest when your threat model includes targeted attacks. See the Tor Project's explanation.

  6. Use one session for one purpose

    Restart Tails between unrelated tasks, or use separate USB sticks for separate identities. In one session, websites can link everything you do. Never sign into your everyday accounts in the same session as anonymous work.

    Before sharing files, remove their metadata. Tails includes Metadata Cleaner for this.

  7. Keep Tails up to date

    After you connect to Tor, Tails Upgrader checks for upgrades and offers to upgrade the USB stick; the download is small, verified and goes through Tor. You can also check from Apps ▸ Tails ▸ About Tails. If an automatic upgrade is not possible, Tails points you to a manual upgrade with Tails Cloner. Upgrade promptly: an outdated Tails or Tor Browser has known security holes.

Common mistakes

  • Installing Tails from a computer you suspect is infected.
  • Skipping download verification.
  • Logging into a personal account in the same session as anonymous research.
  • Using a short or reused passphrase for the Persistent Storage.
  • Assuming Tails hides that you use Tor, or protects traffic that is not encrypted with HTTPS.
  • Using a borrowed computer that could have a hardware keylogger.

Going further

Read the official warnings and limitations page in full; it is short and honest. If Tor is blocked where you are, Tails can connect through Tor bridges. Pair Tails with a written threat model so you know which tasks belong in it and which do not.