Tails OS Explained: The Amnesic Operating System That Forgets You (2026)

Every operating system on a hard drive keeps a growing record of what you did. It logs who you talked to and which sites you visited. Browser history, swap files, DNS caches, prefetch logs - they pile up in silence. Tails OS flips this model. It runs from a USB stick and holds everything in RAM. When the session ends, it forgets you were ever there.

That design is not an accident. It is the core idea of a project that has run since 2009. As of late 2024, it sits under the Tor Project - the nonprofit behind the anonymity network that Tails relies on.

Because Tails routes everything through Tor, it is worth understanding whether Tor is safe to rely on and where its limits lie.

What Is Tails OS?

Tails stands for The Amnesic Incognito Live System. It is a Debian-based Linux build. You boot it straight from external media - a USB drive or, in the past, a DVD. It never touches the host machine’s hard disk. The current release as of June 2026 is Tails 7.8.1.

The name captures its two core properties:

• Amnesic: by default, nothing is written to persistent storage. RAM is wiped on shutdown. The next user of that computer finds no trace of your session.
• Incognito: every network connection is forced through the Tor network. This hides your IP address from the sites you visit and from your internet provider.

Tails is free software. It is funded mostly by donations and grants. The donors include the Freedom of the Press Foundation, the Mozilla Foundation, and the Tor Project itself. Outside security researchers have audited it on several occasions.

Why Tails Matters: The Threat Model It Addresses

Most privacy tools cut surveillance at the margins. Tails takes on one high-stakes threat: a physically compromised machine in a hostile place. Here are some of its use cases:

• A journalist receiving documents from a source in an authoritarian country
• A human rights worker operating in a region where device seizure is a realistic risk
• A lawyer accessing case files from a shared or untrusted computer
• A source communicating with a newsroom without leaving device-level evidence

Edward Snowden used Tails in 2013. He used it to talk to journalists Glenn Greenwald and Laura Poitras. Poitras has said in public that it was vital to the security of that reporting. The Freedom of the Press Foundation recommends Tails in its training for journalists and sources.

Tails is not a tool for casual daily computing. That point matters before you weigh whether it fits your situation.

How Tails Works Under the Hood

Boot Process

Tails runs fully from the USB drive. When you insert it and boot, the machine’s BIOS or UEFI firmware loads the Tails bootloader from the USB. The system never mounts the internal hard drive. Say the computer has a working disk with another OS on it. Tails ignores it - the session runs on its own.

So any malware on the host OS cannot reach your Tails session. The attack surface shrinks to the firmware layer and to whatever you do during the session.

RAM-Only Operation

All session data lives in RAM - open files, browser history, typed text. The moment you shut down, or the power is cut, that memory is released. Tails also tries to overwrite RAM contents at shutdown. This blocks cold-boot attacks, where an attacker tries to freeze and pull out memory chips before they discharge.

Forced Tor Routing

Tails sets the system firewall to block any traffic that does not go through Tor. There is no opt-out switch at the app level. If an app tries to reach the internet directly - around Tor - the packet is dropped. This stops stray clearnet leaks from badly set-up software.

The Tor Browser is the default browser. It ships with safe security settings. Other apps come ready to work within the Tor network too - the Thunderbird email client, the OnionShare file-sharing tool, and the KeePassXC password manager.

Persistent Storage (Optional, LUKS-Encrypted)

Tails is amnesic by design. So saving anything across sessions takes a few set-up steps. Tails offers an optional Persistent Storage feature. It is an encrypted partition on the same USB stick. A passphrase guards it, and LUKS (Linux Unified Key Setup) encrypts it. You pick what to keep - bookmarks, documents, SSH keys, custom app settings. The rest of the session stays temporary.

If an attacker grabs your USB drive, the Persistent Storage is encrypted. They cannot open it without the passphrase. For a deeper look at how full-disk encryption guards data at rest, see our guide on full-disk encryption.

How to Evaluate Tails (and What to Check)

Run Tails from real hardware, not a virtual machine. Its amnesia promise rests on how RAM is cleared at shutdown. A VM host can, in theory, watch guest RAM. The Tails project warns that running inside a VM partly breaks the security model. So use a VM only to explore the interface - not as a secure setup.

What’s worth verifying

Say you are sizing up Tails for your own threat model. These are the points that matter, plus how to check each one yourself:

What the docs and design show: Tor routing works by design. No bundled app can send clearnet traffic in normal use. Persistent Storage uses LUKS encryption (AES-256-XTS with PBKDF2 key derivation, in line with Debian defaults). MAC randomization runs at each boot by default. You can confirm this from the network settings inside Tails. Going from scratch to a first booted session takes a few minutes on a typical USB 3.0 drive. That includes the signature check. The official Tails docs cover these behaviours, and you can verify them on your own machine.

For a detailed walkthrough of the USB installation and first-boot Persistent Storage setup, see our step-by-step Tails USB install guide.

Official Technical Specifications

These figures come from the official Tails documentation and release notes. They are current as of Tails 7.8.1:

Tails does not publish download counts or user numbers. But the project’s funding records are public. They show grants from the Freedom of the Press Foundation, Mozilla, and the European Commission, among others.

Installing Tails: Overview

What You Need

• A USB drive of at least 8 GB (this becomes your Tails drive)
• An internet connection to download the image
• Optionally, a second USB drive or another device to run the Tails installer

The Verification Step

Download the Tails image from tails.net. Before you write it, check the cryptographic signature. Tails gives you an OpenPGP signature and a browser extension that runs this check for you. Skipping the check is the most common beginner mistake. A tampered image would break every security property Tails offers.

Writing the Image

On Windows, the Tails website points you to Tails Installer. This built-for-the-job tool handles the write and can set up Persistent Storage too. On Linux and macOS, dd with the right block size works well. It shows no progress bar, though, and you must be careful with the target device path.

Tails used to need two USB drives for the install - one to run the installer, one to receive Tails. Recent versions drop this need on Windows. You can install straight from the downloaded image with Tails Installer.

First Boot

Enter the BIOS/UEFI on your machine. Set the USB drive as the first boot device, or use the one-time boot menu. That menu is usually F12, F11, or Escape at startup, depending on the maker. On modern machines with Secure Boot on, you may need to turn it off. Tails does not support Secure Boot right now.

What Tails Protects - and What It Does Not

Tor Exit Nodes

Tor encrypts traffic between your machine and the exit node. But the exit node talks to the destination in cleartext, unless that destination uses HTTPS. A bad exit node can watch unencrypted traffic. This is a trait of Tor, not a flaw unique to Tails. Always check for HTTPS when you use Tails for sensitive messages.

Firmware Attacks

Tails cannot guard against malware buried in the computer’s firmware - the BIOS, UEFI, or hardware controllers. These attacks are rare and costly to pull off, but they exist. Say you face a nation-state foe with physical access to your hardware. Then Tails alone is not enough.

MAC Address Spoofing

Tails randomizes the MAC address of your network card at each boot. This stops the local network - a hotel Wi-Fi router, say - from linking your sessions by hardware ID. It is on by default. It is one of several guards Tails applies with no setup on your part.

Tails vs. Other Privacy Operating Systems

Tails fills a specific niche. It is built for short, high-risk sessions where leaving no trace matters more than ease of use.

Whonix takes a different path. It runs inside a virtual machine on your regular operating system. It splits the workstation from the Tor gateway across two separate VMs. This suits longer-term pseudonymous work, where you need persistence and the option to install software. But it needs a reliable host OS, and it leaves traces on the host machine’s disk. Our Whonix guide covers when that trade-off makes sense.

Qubes OS comes from the same community that helped shape Tails. It uses hardware virtualization to wall off different activities into separate compartments. It is the hardest of the three to run. It is meant for users who need persistent, walled-off identities, not amnesic sessions.

Tails and the Secure Desktops Community

Tails has deep roots in the wider secure desktop movement. The Tails developers co-founded the Secure Desktops mailing list in 2015. They did so alongside people from the Subgraph and Qubes OS projects. That forum laid early groundwork for isolation-based privacy operating systems. The history section of this site records that heritage.

Practical Recommendations

Use Tails when:

• You are accessing sensitive sources or documents and need plausible deniability at the device level
• You are working from an untrusted machine (hotel, library, borrowed computer)
• You need a clean, known-good environment with no locally installed malware

Do not rely solely on Tails when:

• You need persistent identities or accounts across sessions
• You are managing long-running projects that require complex installed tooling
• You want to protect data at rest on your primary machine (use full-disk encryption instead)

Operational habits that matter:

• Always boot from the same Tails USB to avoid version fragmentation
• Set a strong passphrase on Persistent Storage - LUKS is only as strong as the key
• Keep your Tails installation updated; the project issues security releases regularly
• Do not stretch sessions unnecessarily; log out when the task is done
• Be aware that Tor usage is detectable by your ISP even if the content is not - in some environments, using Tor itself is a signal

For broader context on anonymous browsing and layered identity protection, the Tor Project’s support documentation offers practical operational guidance that complements what Tails provides at the OS level.

Frequently Asked Questions

Is Tails OS truly anonymous?

Tails makes it much harder to link your activity to your identity or location. But “truly anonymous” is a claim no tool can honestly make. Tails routes all traffic through Tor, which guards against most forms of network surveillance. Your ISP sees only an encrypted Tor connection. The sites you visit see only a Tor exit node IP. Even so, anonymity can still break down. It breaks through behavioral patterns, such as logging into a personal account while on Tails. It also breaks through exit-node surveillance of unencrypted traffic. And it breaks through browser fingerprinting if you change the Tor Browser’s default settings. Tails does not stop firmware-level attacks. Nor does it stop someone who watches your physical screen. Used right - without logging into personal accounts and without changing the Tor Browser - Tails gives a strong, practically verified anonymity layer. Used wrong, it gives a false sense of safety.

Is Qubes OS better than Tails?

They handle different threat models and do not compare head to head. Tails is tuned for sessions where leaving no trace is key. You boot, work, shut down, and the machine forgets you. Qubes OS is tuned for ongoing walled-off work on a machine that persists. Different activities run in isolated virtual environments. But the OS stays across reboots and builds up data. Qubes is harder to use. It also needs much stronger hardware (<16 GB RAM, a modern CPU with IOMMU). Tails runs on almost any x86-64 machine with 2 GB of RAM. The right pick depends on your use case. Short, sensitive work with no persistence points to Tails. Long-term walled-off work points to Qubes. Our full comparison in Qubes vs Tails vs Whonix walks through the threat-model matrix.

Does Tails protect against a VPN - do I need one alongside Tails?

A VPN and Tails handle different threats and do not stack cleanly. Tails routes all traffic through Tor. Tor already masks your IP through a multi-hop circuit. Adding a VPN before Tor (a “VPN over Tor” setup) is possible but complex. It also adds new trust links. You now trust the VPN provider on top of the Tor network. Tails’ own docs do not advise this for most users. A VPN is truly useful on your everyday operating system, where Tor is not in play. It hides browsing from your ISP and cuts exposure on untrusted networks. But within a Tails session, Tor is the privacy tool. A VPN adds complexity with no clear security gain for most threat models.

Verdict

Tails OS is one of the most carefully built privacy tools open to the public. Its amnesic design, forced Tor routing, and LUKS-encrypted optional storage meet a clear threat model with focus and discipline. For journalists, activists, sources, and anyone working in truly hostile conditions, it stays the reference model of the “leave no trace” operating system.

Its limits are just as clear. It is not an everyday OS. It does not stop firmware-level attacks. And Tor exit nodes add risk for unencrypted traffic. Used right - for specific, bounded sessions where amnesia is an asset - it does what it promises.

The project joined the Tor Project in 2024. This gives more organizational stability to what has always been a vital piece of civil liberties infrastructure. Tails 7.x is still actively maintained, with security releases on a steady cadence.

Say your threat model calls for a session-based, no-trace environment routed through Tor. Then nothing in the open-source world does it better.