Impossible to leak IP address

Connections are forced through Tor®. DNS leaks are impossible, and even malware with root privileges cannot discover the user's real IP address. Leak tested through corridor (Tor® traffic whitelisting gateway) and other leak tests.

Live Mode

Booting into VM Live Mode is a simple as choosing Live Mode in the boot menu. Alternatively Debian, Kicksecure and perhaps other Debian based hosts can boot their existing host operating system into Host Live Mode.

Based on Kicksecure ™

Whonix ™ is based on Kicksecure ™ which is a a security-hardened Linux distribution.

Based on Tor®

Whonix utilizes Tor®, which provides an open and distributed relay network to defend against network surveillance.

Keystroke Anonymization

Keystrokes can be used to track users. To prevent this, Whonix comes with kloak installed by default.

Time Attack Defenses

Time attacks are defeated by Boot Clock Randomization and secure network time synchronization through sdwdate (Secure Distributed Web Date).

Protect against guard discovery and related traffic analysis attacks

vanguards

TCP ISN CPU Information Leak Protection

Prevent de-anonymization of Tor onion services through Tirdad kernel module for random ISN generation.

Entropy Enhancements

Better encryption thanks to preinstalled random number generators.

Stream Isolation

Distinct applications are routed through different paths in the Tor® network.

AppArmor

AppArmor profiles restrict the capabilities of commonly used, high-risk applications.

Kernel Self Protection Settings

Whonix uses Kernel Hardening Settings as recommended by the Kernel Self Protection Project (KSPP).

Protect Linux user accounts against brute force attacks

By using pam tally2.

Strong Linux User Account Separation

security-misc

Anonymity, privacy and security settings pre-configuration

anon-apps-config

Extensive Documentation

The more you know, the safer you can be.

Android Support

Run Android applications using Anbox (outdated) or Whonix-Custom-Workstation using Android x86.

Virus Protection

Additional security hardening measures and user education through Whonix provide better protection from viruses.

Console Lockdown

Console Lockdown disables legacy login methods for improved security hardening.

Advanced Firewall

Configured for anonymous Tor® use.

Tor® Browser

Visit any destination including modern websites such as YouTube.

swap-file-creator

Running low on RAM isn't a security problem. swap-file-creator will create an encrypted swap file.

Hosting Location Hidden Servers

Whonix is the safest way to Host Location Hidden Services / Onion Services.

Vibrant Community

Forums
Newsletter
Contributors
RSS

History

An eight year history of protecting our users against Real World Attacks.

Fully auditable

You don’t have to trust our word that it respects and protects you. It is independently verifiable by security experts and software developers around the world. This improves security and privacy for everyone.

Complete respect for privacy

Your data always belongs to you, and only you. We don’t make advertising deals or collect sensitive personal data. We’re funded directly by our users paying what they want. And that’s how it should be.

Warrant Canary

A canary confirms that no warrants have been served on the Whonix project.

Based on Debian

In oversimplified terms, Whonix is just a collection of configuration files and scripts. Whonix is not a stripped down version of Debian; anything possible in "vanilla" Debian GNU/Linux can be replicated in Whonix. About Whonix

Complete user freedom

There are no artificial restrictions on how users can reconfigure the system.

Digitally signed releases

Downloads are signed so you can verify they are genuine Whonix releases.

Freedom Software

Whonix is Freedom Software and contains software developed by the Free Software Foundation and the GNU Project.

Open Source

All of Whonix source code is licensed under OSI Approved Licenses. We respect the rights of our users. All of Whonix is available for review, scrutiny, modification, and redistribution by anyone. This improves security and privacy for everyone.

Research and Implementation Project

Be wary of those confidently calling themselves all-knowing, all-perfect. Whonix is an actively maintained research project making constant improvements -- no shortcomings are ever hidden from users.

Linux Kernel Runtime Guard (LKRG)

Hardened Malloc is a hardened memory allocator which can be used with many applications to increase security. A fork by Kicksecure will be enabled by default.

sandbox-app-launcher is an application launcher that can start each app inside its own restrictive sandbox. It runs each app as its own user, in a bubblewrap sandbox and confined by AppArmor.

Full system Mandatory Access Control (MAC) policy - "AppArmor for everything"

Untrusted Root User

enforce kernel module software signature verification

deactivate malware after reboot from non-root compromise

Hardened Linux Kernel

post-quantum cryptography resistant signing of releases

Mount Options Hardening

SUID Disabler and Permission Hardener

multiple boot modes for better security (user, live, secureadmin, superadmin)

Help welcome!