rdarkTails OS: What It Forgets, and When to Use Whonix
Tails OS is a portable system you boot from a USB stick. It sends everything through Tor, runs in memory, and is built to forget the session when you shut it down. The name spells the idea out: The Amnesic Incognito Live System. Most people do not need it. Tor Browser already hides the connection, and a second operating system only earns its place when someone can take the computer itself. Whonix is the other answer to that problem, and it solves a different slice of it.
Which system matches the risk
Pick from what happens to the computer, not from which logo looks more serious. Tor Browser is a program on the system you already use. Tails replaces that session with one that is meant to leave nothing behind. Whonix leaves a system installed and splits it in two, so the half you work in never learns your real address. If nobody is going to take the machine, the first row is the one you want.
| Tor Browser | Tails | Whonix | |
|---|---|---|---|
| Where it runs | On your ordinary system | From a USB stick, in memory | As two virtual machines on a host system |
| After you shut it down | The browser closes. The rest of the disk is still yours. | The session is gone, unless you unlocked Persistent Storage. | The machines can be off. The host disk is still there. |
| Computer taken while off | Your normal files are on the disk. | The stick can be taken. An encrypted store on it is visible, not hidden. | The host disk, including the virtual machines, can be copied. |
| Computer taken while on | The open session is there to read. | The session is in memory. | The workstation is running, on a host that still knows its own address. |
| Who it is for | Almost everyone on this site. | Someone who can reboot from a stick, and who expects the hardware to be taken. | Someone who keeps a computer set up, and wants a compromise of the apps to miss their real IP. |
The guide to reaching the dark web sorts readers by who they are hiding from. A curious reader or a researcher hiding from ordinary tracking is in the first column. A source who expects a seized laptop is in the second or the third. Bridges, a VPN, and phones are still that guide's subject. They do not change this table.
What Tails forgets
Tails forgets by not writing the session down. You boot the stick, the system runs in the computer's memory, and every connection is forced through Tor. Shut it down and the memory is cleared. Tails' own manual puts the result in a sentence: everything you do disappears automatically when you shut down Tails. A downloaded file you opened inside that session, a password you typed, a document you did not deliberately save, goes with it.
That is the hole Tor Browser cannot close. The browser can fetch a file without revealing your address. If you then open the file in a normal program on your normal system, the file can call home over your ordinary connection. On Tails there is no ordinary connection waiting outside the session, and unless you saved the file into Persistent Storage, there is no file after shutdown either. The guide to how Tor works draws the same line from the network's side: the path hides the route, and a file you open outside the path is outside the path.
The computer you borrowed, or your own computer, keeps its hard disk. Tails is not supposed to use it. The risk that remains is the stick in your pocket, and whatever you chose to store on it. The system is Debian underneath, with Tor already arranged, which is why the install is "write this image to a stick" rather than "tune a browser you already have." The writing of the stick is on the Tails site. This page is the decision, not a second installer.
The storage that does not forget
Persistent Storage is the exception, and it is the part people add because forgetting is inconvenient. It is an encrypted partition on the USB stick. You unlock it with a passphrase when Tails starts, and only the features you turned on are kept: a folder of documents, some network settings, extra software. Everything else still disappears. Tails says the partition uses LUKS, the usual Linux disk encryption, and that a forgotten passphrase cannot be recovered.
The Persistent Storage is not hidden. An attacker in possession of your USB stick can know that there is a Persistent Storage. Take into consideration that you could be forced or tricked to give out its passphrase.
Read that twice. Encryption stops someone who finds the stick and does not know the passphrase. It does not stop someone who has you, the stick, and a demand for the passphrase. It also does not look like a blank stick. The partition announces itself. A Tails stick with Persistent Storage full of the documents you were trying not to possess is a Tails stick that remembered the one thing that mattered. Keep it for a key or a small set of files you have already decided you can explain, or do not turn it on.
Whonix, the house with a gatehouse
Tails is a hotel room that is stripped when you leave. Whonix is a house you keep, with a gatehouse that is the only door to the road. You live in the house. The gatehouse is the only part that talks to the network, and the house is not told your real address. A break-in at the house does not hand the burglar the address on the gate.
Whonix's own description is plainer than the picture. The project says it consists of two virtual machines. The gateway runs Tor and acts as the gate. The workstation runs your programs on an isolated network.
Whonix consists of two VMs: the Whonix-Gateway and the Whonix-Workstation. The former runs Tor processes and acts as a gateway, while the latter runs user applications on a completely isolated network.
The workstation, Whonix says, is unaware of your real external IP address. That is the property Tails does not bother with, because Tails has no long-lived house. It is also the property Tor Browser does not have: a compromised program on your normal system can see the normal system. Whonix does not wipe the host. The computer you installed it on still has a disk, an account, and the virtual-machine files. Seizing that computer while it is off is a different problem from compromising the browser, and Whonix answers the second one.
You run those two machines under a host system, often with VirtualBox or KVM, or inside Qubes. The host is now something else you have to trust. A host that is already full of your ordinary life is a host that remembers you, whatever the machines on top of it forget. Whonix is the right tool when you want a standing setup and a hard separation between "the programs" and "the address." It is the wrong tool if what you needed was a session that leaves no trace.
Why Tails now sits with Tor
On 26 September 2024 the Tor Project and Tails merged their operations. Tails had asked, in late 2023, because the project had outgrown the paperwork of running itself. The software did not stop being its own system. The Tor Project's announcement says the Tails team would keep maintaining Tails OS, inside Tor's organisation rather than beside it.
Today the Tor Project, a global non-profit developing tools for online privacy and anonymity, and Tails, a portable operating system that uses Tor to protect users from digital surveillance, have joined forces and merged operations.
The same post says Tails' first release was announced on a Tor mailing list fifteen years earlier, and that the two projects had been working together since 2015. The practical consequence is boring and useful: the stick and the browser are maintained by one organisation, and a careful reader still treats them as two tools. The browser is the daily one. The stick is the one you reach for when the computer is the thing at risk.
Where to get them
Tails is downloaded from tails.net. Whonix is downloaded from whonix.org. Both pages tell you how to check the file you received. A stick or a virtual machine from anywhere else is the same class of mistake as a Tor Browser from a search ad, which is why the setup guide starts with the signature. Use that habit here. Do not follow a "Tails download" that is not the project's own site.
If the table's first column is you, stop at Tor Browser and spend the effort on the habits that actually deanonymise people: the account you log into, the file you open later, the address you did not check. Those are the access guide and the PGP verification guide. A second operating system will not repair any of them.
Common questions about Tails and Whonix
Is Tor Browser enough, or do I need Tails?
For most people, Tor Browser is enough. It hides the connection. It does not wipe the computer underneath it. Tails is for the case where someone might take that computer and you can reboot from a USB stick. If you only need to read a page without being profiled, adding a second operating system is extra machinery, not extra safety.
Does Tails leave anything on the computer?
Not from the session, if you shut it down. Tails runs from a USB stick in memory and is built so the work disappears at shutdown. The computer's own hard disk is not what Tails writes to. The stick itself can still hold an encrypted Persistent Storage, and that partition is not hidden: someone who has the stick can see that it exists.
Can I save files on Tails?
Yes, in the Persistent Storage, an encrypted partition on the USB stick that you unlock with a passphrase when Tails starts. Tails' own documentation says everything otherwise disappears at shutdown, and that the storage is not hidden. A forgotten passphrase cannot be recovered. Every file you choose to keep is a file that can be found if the stick is taken and the passphrase is given up.
Should I use Tails or Whonix if the computer might be seized?
If the machine might be taken while you are away from it, Tails is the one that forgets, provided you did not unlock a Persistent Storage full of the very files you wanted gone. Whonix is for a computer you keep using: two virtual machines, one of them the only door to the network, so a program in the other never learns your real address. Whonix does not make the host computer amnesic. The host disk is still there.