🐧 Tails OS Guide

Download Tails only from tails.net, and actually use the built-in verification step the site walks you through rather than skipping straight to writing the image — an operating system you boot into is a far more sensitive download than almost anything else on this list, since a tampered image compromises everything you do inside it from the first second. You'll need a USB drive of at least 8GB, and the Tails Installer (or Etcher, if you're starting from a non-Tails system) writes the verified image to it. That process is destructive: it overwrites the entire drive, not just adds a partition, so pull anything off that USB you still need before you start, because there's no undo once the image is written.

The Welcome Screen on boot lets you set language, keyboard layout, and an optional administration password. That admin password only exists to let you install software or make system changes during the current session — leave it blank unless you specifically need that, since a blank admin password means anyone who somehow gets code execution on your session still can't escalate to root. Persistent Storage (Applications → Tails → Persistent Storage) is where you configure anything that should survive a reboot — set it up before you need it, not mid-session when you realize you're about to lose something. Network connection is automatic from there: plug into Wi-Fi or ethernet and Tails establishes its Tor connection on its own, no manual proxy configuration required.

Tails erases everything by default on shutdown — that's the entire point of the OS, and it's also why anything you need across sessions, like a KeePassXC database or a PGP keypair, needs Persistent Storage explicitly turned on for it (Applications → Tails → Configure Persistent Volume). The passphrase you set here encrypts the persistent partition, so treat it with the same seriousness as a wallet password — it's the only thing standing between the persistent data and anyone who gets hold of the USB drive. Enable persistence only for the specific data categories you actually need (GnuPG keys, Wi-Fi connections, browser bookmarks are common ones) rather than everything available; every category you persist is a category of data that survives if the drive is ever seized, and transaction-level details in particular have no good reason to live there.

The strongest OS configuration doesn't help if physical security is an afterthought — don't mention that you use Tails to anyone who doesn't need to know, since that single fact narrows down what an investigation or a curious housemate is looking for. On shutdown, Tails deliberately overwrites RAM specifically to defeat cold-boot attacks, where an attacker with brief physical access to a still-powered machine can sometimes pull encryption keys straight out of memory. If you ever need to kill a session immediately, the emergency shutdown (pulling the USB while running) does exactly that, faster than a normal shutdown sequence. Never boot Tails on a machine you don't trust — a hardware keylogger or a compromised BIOS defeats the entire OS regardless of how correctly you've configured it afterward, since it's watching before Tails even starts.