Features and Advantages

From Whonix


Whonix ™ Features[edit]

Whonix ™ is an operating system focused on anonymity and security [archive]. It hides the user's IP address / location and uses the Tor network to anonymize data traffic. This means the contacted server, network eavesdroppers and operators of the Tor network cannot easily determine which sites are visited or the user's physical location. [1]

For a comprehensive comparison of Whonix ™ with other popular anonymity platforms, see here.

Software Overview[edit]

A number of applications are pre-installed and pre-configured with safe defaults to make them ready for use. Most popular applications are compatible with the Whonix ™ design:

The Whonix ™ design permits the "torification" of applications which are not capable of proxy support by themselves. Further, the user is not jeopardized by installing custom applications or personalizing the desktop.

Detailed documentation has been produced by developers and the Whonix ™ community. Various issues are explained in depth, including the Whonix ™ design, available software, the host of possible configurations, security and privacy considerations, and numerous advanced topics.

Feature List[edit]

Anonymous Browsing[edit]

Anonymous Communications, Hosting and Publishing[edit]

Platform Flexibility[edit]

Security and Anonymity Protection[edit]

Tor Network / Torification[edit]

Tunnel and Chaining Support[edit]

Tunnel Other Anonymizing Networks[edit]

Whonix ™ Advantages[edit]

Table: Primary Whonix ™ Advantages

Whonix ™ Feature Security and/or Anonymity Advantage
Best Possible Protocol Leak Protection and Fingerprinting Protection Java, JavaScript, [5] [6] Flash, browser plugins [7] and mis-configured applications cannot leak the user's real external IP address. [8]
Build Simplicity Building Whonix ™ from source is easy; see Build Documentation.
Combine Anonymizing Networks Other anonymizing networks like Freenet, GNUnet, I2P, JonDonym and ZeroNet can be used.
Fully Featured A host of Features are available.
Highly Configurable Numerous optional configurations, additional features and add-ons are available.
Open Source Only free software is used. [9]
Private Obfuscated Bridges Bridges can be added to the Tor configuration file.
Process Separation Tor [10] and Tor Browser [11] are not running inside the same virtual machine which means an exploit in the browser cannot affect the integrity of the Tor process. [12]
Protection Against IP Address / Location Discovery Exploits using malware [13] with root rights inside Whonix-Workstation ™ (anon-whonix) are foiled. However, users should avoid testing this protective feature. [14]
Protection Against De-anonymization Attacks No IP address or DNS leaks are possible. [15]
Safe Hosting of Onion Services Even if someone hacks the user's hidden server software (lighttpd, thttpd, apache, etc.), they cannot steal the onion service key. [16] [17]
Software Flexibility Installation of any software package is possible. [18] [19] [20] [21]
Tor Data Persistence A major Whonix ™ advantage over Live CDs is that Tor's data directory is still available after reboot due to persistent storage. Tor requires persistent storage to save its Entry Guards. [22]
Tor Enforcement All applications are automatically routed via Tor, including those which do not support proxy settings. [23] [24] [25] [26]
Torify Windows Whonix-Gateway ™ (sys-whonix) can also torify Windows. [27]
Tunnel Chaining It is possible to combine Whonix ™ with VPNs, SSH and other proxies. [28] Every permutation is possible; VPNs / SSH / other proxies can be combined and used pre- and/or post-Tor tunnels.

Whonix ™ Disadvantages[edit]

Tunnel Support[edit]

Various tunneling permutations are possible and functional in Whonix ™. Connections can be routed through a VPN, SSH, or proxy before Tor, after Tor, or both.

Table: Whonix ™ Tunnel Options

Tunnel Configuration Description
Tunnel Tor through a Proxy, VPN or SSH How to Connect to a VPN Before Tor: UserVPNTorInternet
How to Connect to a Proxy Before Tor: UserProxyTorInternet
How to Connect to SSH Before Tor: UserSSHTorInternet
Tunnel Proxy / Proxychains / SSH / VPN through Tor How to Connect to Tor Before a VPN: UserTorVPNInternet
How to Connect to Tor Before a Proxy: UserTorProxyInternet
How to Connect to Tor Before SSH: UserTorSSHInternet
Combine Pre- and Post-Tor Tunnels User Proxy / SSH / VPNTorProxy / SSH / VPNInternet
Combine Tor with other Protocols Tor can also be replaced with another anonymizing protocol. Note that only some combinations and networks will work in Whonix ™, such as I2P and JonDonym. [31]

For further reading on this topic, see:

Comparison of Whonix ™ with other Anonymity Platforms[edit]

See: Anonymity Operating System Comparison.


Gratitude is expressed to JonDos [archive] for permission [archive] to use material from their website. (w [archive]) (w [archive]) [32] The "Whonix ™ Features" section of this wiki page contains content sourced from the JonDonym documentation Features [archive] page.


  1. Without advanced, end-to-end, netflow correlation attacks which rely on statistical analysis of data volume and timing.
  2. Later Whonix ™ releases might not come with Thunderbird email client pre-installed; refer to this Whonix ™ Forum Thread [archive] for more details.
  3. 3.0 3.1 3.2 3.3 3.4 3.5 Via optional configuration.
  4. As well as related traffic analysis attacks.
  5. There is no functional JavaScript difference when it is enabled in Whonix ™ Tor Browser versus the standard Tor Browser Bundle (TBB).
  6. Of course, using JavaScript in the Whonix ™ Tor Browser protects against IP address leaks, but browser fingerprinting risks still apply. For more information, see Web-browser [archive]!
  7. Plugins are still not recommended, as they may decrease anonymity (for example, flash cookies) and they often have security vulnerabilities. Most popular plugins are closed source. Although deprecated, the browser plugins warnings section is still valid.
  8. See Security in the Real World.
  9. [archive]
  10. [archive]
  11. [archive]
  12. Vidalia is now deprecated; arm is installed as the alternative.
  13. [archive]
  14. If Whonix-Workstation ™ (anon-whonix) is rooted, the adversary cannot find out the user's real IP address / location. The reason is Whonix-Workstation ™ (anon-whonix) can only connect through the Whonix-Gateway ™ (sys-whonix). More skill is required to compromise Whonix ™, see Attack Comparison Matrix and Design.
  15. Whonix ™ does not automatically protect against other possible leaks like username, time zone and so on. Users should read the Documentation to learn how to mitigate these threats. Additionally, Whonix ™ Protocol-Leak-Protection and Fingerprinting-Protection mitigates many possible fingerprinting attacks by using common, non-identifying defaults. For example, the username is set to user, the timezone is set to UTC etc.
  16. The key is stored on the Whonix-Gateway ™ (sys-whonix). Once a clean Whonix-Workstation ™ (anon-whonix) is used, no one can impersonate the onion service anymore.
  17. The Whonix-Workstation ™ (anon-whonix) is where the browser, IRC client and other user applications are run. The Whonix-Gateway ™ (sys-whonix) is where Tor and the firewall are run.
  18. The program must be able to run on Debian GNU/Linux or Other Operating Systems which are used. See also Software installation on Whonix-Workstation ™ (anon-whonix) for further details.
  19. ICMP, ping, VoIP calls over UDP and so on.
  20. Skype works over TCP, but it is not recommended because it is proprietary, closed source software and there is no control over the encryption keys. Skype authorities can compromise a user at any moment. A secure encryption / authentication design looks different. For example GPG and OTR are secure, because the user has control over the keys, not the server. See VoIP Skype section for further details.
  21. Tunnel UDP over Tor
  22. [archive]
  23. For application warnings, see Documentation.
  24. UDP is not natively supported by Tor and will therefore also not work in Whonix ™ (unless a VPN is used).
  25. Services that need to listen on publicly reachable ports (open / forwarded ports) are also not supported. However, users may run Onion Services which are reachable via Tor or tor2web (care is required [archive]).
  26. UDP is not supported by Tor [archive]
  27. See Other Operating Systems.
  28. Users should read the Tor plus VPN/proxies Warning [archive] before proceeding.
  29. Particularly for Qubes R4 and later releases.
  30. Users need to maintain and update three OSs instead of one. Also, several passwords must be remembered, except for Qubes-Whonix ™ which has a password-less root feature [archive].
  31. This work is partially complete, but features will remain unfinished for the foreseeable future.
  32. Broken link: [archive]

Fosshost is sponsors Kicksecure ™ stage server Whonix old logo.png
Fosshost About Advertisements

Search engines: YaCy | Qwant | ecosia | MetaGer | peekier | Whonix ™ Wiki

Follow: 1024px-Telegram 2019 Logo.svg.png Iconfinder Apple Mail 2697658.png Twitter.png Facebook.png Rss.png Reddit.jpg 200px-Mastodon Logotype (Simple).svg.png

Support: Discourse logo.png

Donate: Donate Bank Wire Paypal Bitcoin accepted here Monero accepted here Contriute

Whonix donate bitcoin.png Monero donate Whonix.png United Federation of Planets 1000px.png

Twitter-share-button.png Facebook-share-button.png Telegram-share.png Iconfinder Apple Mail 2697658.png Reddit.jpg 200px-Mastodon Logotype (Simple).svg.png

Please help in testing new features and bug fixes in Whonix ™.

https link onion link Priority Support | Investors | Professional Support

Whonix | © ENCRYPTED SUPPORT LP | Heckert gnu.big.png Freedom Software / Osi standard logo 0.png Open Source (Why?)

The personal opinions of moderators or contributors to the Whonix ™ project do not represent the project as a whole.

By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent.