🔷 Qubes OS Guide

Qubes OS is the option one tier above Whonix for people who genuinely need it, not a default recommendation — the setup and hardware requirements are real, and most users get more practical benefit from Tails or Whonix. Download it from qubes-os.org and verify the ISO signature with GPG before writing it anywhere; the same "OS image is the most sensitive download you'll make" logic from the Tails guide applies here too, arguably more so given Qubes' higher trust load. Hardware requirements are non-negotiable: VT-x/VT-d virtualization support, 16GB RAM as a practical floor, and a fast SSD, since Qubes is running multiple full virtual machines simultaneously, not one. Write the verified ISO to a USB with Rufus (Windows) or dd (Linux) and follow the installer. Under the hood, Qubes uses the Xen hypervisor to enforce isolation between qubes at the hardware virtualization level — a fundamentally stronger boundary than application sandboxing, which is still just software running inside one shared kernel.

Everything in Qubes lives in a security domain (a "qube") with its own trust level, and the default install ships several system qubes already split apart: dom0 (the administrative domain, deliberately never connected to any network, so compromising anything else on the system still doesn't hand over dom0), sys-net (the only qube touching physical network hardware), sys-firewall, and sys-whonix (the Tor gateway). Everyday work happens in AppVMs layered on top of those. The practical move is a dedicated qube exclusively for darknet activity, routed through sys-whonix and never reused for anything else — mixing an anonymous qube with your everyday browsing qube defeats the entire point of having separate qubes. Qubes color-codes each one by trust level specifically so a glance at the window border tells you which environment you're in; use that consistently rather than treating it as decoration.

Qubes ships Whonix integration built in through the sys-whonix gateway qube, so you get the same Gateway/Workstation split covered in the Whonix guide without installing Whonix separately inside VMs of your own. Any AppVM you connect to sys-whonix gets its traffic transparently routed through Tor with zero configuration inside the AppVM itself — the routing is enforced at the qube-networking level, not by anything the applications inside are aware of. Create a dedicated AppVM (naming it something generic like "anon-work" rather than anything that hints at its purpose is a small habit worth keeping) based on the whonix-ws template and connect it to sys-whonix. From that point, IP leaks from that qube aren't a matter of careful configuration — they're physically impossible regardless of what any application inside does, the same hardware-enforced guarantee Whonix provides, with Qubes' additional isolation between qubes layered on top.