Tor Browser vs Tails vs Whonix

What Tor Browser, Tails and Whonix each isolate

Tor Browser, Tails and Whonix answer different questions, so ranking them against each other gives you nothing you can act on. Tor Browser isolates a browser profile. Tails isolates a whole session on a computer booted from a USB stick, and forgets that session at shutdown. Whonix isolates the machine you work on from the network itself, by running Tor in a second virtual machine so that machine never learns its own IP (internet protocol) address. Choose by what you need isolated, and by what you will give up in daily convenience to get it.

All three carry traffic over Tor (The Onion Router), a network of volunteer-run relays that passes traffic through several hops, so no single relay knows both who you are and what you are reading. That part is the same in each one. What changes is the size of the boundary drawn around Tor: one window, one session, or one virtual machine with no other route out.

Start with the threat model, not with the tool

A threat model is two plain questions. Who could want to know what you are doing, and what can that party already see? "The cafe Wi-Fi and whoever runs it" leads somewhere very different from "the company that owns this laptop and installed software on it". Then ask what happens if the protection fails, because that answer decides how much inconvenience is worth accepting.

This ordering matters because each tool closes one specific gap and leaves the others open. The heaviest option does not help if your real problem is that you signed into your own email during the session. A reader who picks by threat model ends up with something they keep using, which is worth more than the strongest option abandoned after a week.

A worked example, two ways

You want to read a health forum without your internet provider or your household seeing it, on your own laptop. The adversary sees the network, not the machine. Tor Browser is enough here, because the traffic is the thing that needs hiding and you control the computer.

Change one detail. The laptop belongs to your employer and has monitoring software installed. Now the adversary sits on the machine, above the browser. Tor Browser changes nothing, because software that records your screen and your keystrokes sits between you and the browser. The answer is different hardware, or a Tails session on a machine you own.

Tor Browser: one profile, and nothing else on the computer

Tor Browser is a modified Firefox ESR (extended support release) that ships with its own Tor client. Traffic from that window goes over Tor. Traffic from every other program on the computer does not, so the mail client, the package manager and the chat app keep using the normal connection. That boundary is the whole product, and most mistakes come from forgetting exactly where it sits.

Inside the boundary it does more than proxy traffic. It uses a separate Tor circuit per site, so two tabs open on two different sites do not leave the network through the same exit relay. It also works to make every user's browser look identical, because a browser reporting an unusual font set, a rare window size and two extensions is recognisable across sites even from a fresh address. That is why installing extensions or maximising the window is bad advice: both make you more distinctive, which is the opposite of what the browser is trying to do.

The security level control has three settings. Standard leaves all features on. Safer disables website features that are often dangerous, which includes turning off JavaScript on any site not served over HTTPS (HTTP with transport layer security). Safest allows only what static pages need, and disables JavaScript everywhere. Higher levels break more sites. That is the trade you are making, and it is a fair one.

Install it from the Tor Project's own download page, and verify the signature using the instructions published beside the download. Modified copies of Tor Browser have been distributed through lookalike sites and unofficial mirrors before, and a modified browser quietly defeats everything else you do.

The failure mode worth memorising is the file you open outside the browser. Download a document, open it in your usual office suite, and if that document references a remote image or a tracking URL, your normal network stack fetches it. The request leaves from your real address with no warning, because the office suite was never inside the boundary. Tails and Whonix both close this hole, by different means.

Tails: an amnesic session that forgets at shutdown

Tails is a live operating system made by the Tor Project. You write it to a USB stick, boot a computer from that stick, and the running system lives in memory. At shutdown the memory is cleared and the session is gone. The computer's internal disk is not written to, so a borrowed machine keeps no record of the session in its filesystem.

Two mechanisms carry the weight. The first is amnesia: nothing survives a reboot unless you deliberately made it survive. The second is the network policy. Tails permits outbound traffic from the Tor client and blocks everything else, so an application that ignores proxy settings and opens a direct connection does not leak your address. It simply fails to connect. Tails also changes the network card's hardware address by default, so the local network does not log the same identifier every time you appear.

Persistent Storage is the escape hatch: an encrypted area on the same USB stick that can hold Wi-Fi passwords, bookmarks, an email account and keys. It is useful, and it is a trade. Every item you make persistent is one more thing that links Tuesday's session to Friday's.

The costs are real. You reboot to use it, which means you are doing nothing else on that computer at the same time. Hardware support is uneven, and a laptop with an unusual Wi-Fi chip or a locked boot configuration may not cooperate. Your normal files and applications are not there, on purpose.

Tails is clear about its limits. Its warnings page states that "no operating system can protect against a firmware attack", and that no operating system can protect against hardware alterations such as a physical keylogger. It also warns that "if you use Tails sessions for more than one purpose at a time, an adversary could link your different activities together", because two accounts used in one session share a circuit and a pattern of behaviour.

Whonix: a two VM split where the workstation cannot learn its IP

Whonix is two virtual machines that run together. Whonix-Gateway runs the Tor processes and holds the only route to the internet. Whonix-Workstation runs your applications on an isolated internal network whose single exit is the Gateway. The Workstation has no interface attached to the real network, so there is no public address on it to read.

Whonix's documentation states the goal directly:

Whonix-Workstation is unaware of its real external IP address, which means the user's real external IP address is always protected and leaks are impossible.

The mechanism behind that claim is worth stating plainly, because it is what makes the design different in kind. A program can only report an address the operating system knows. On a normal desktop, malware asks the kernel for the machine's addresses and gets the real one, whatever the browser was configured to do. In the Whonix Workstation the kernel holds a private address on a virtual network, so the same malware running with root privileges reports an address that identifies nobody. The protection does not depend on every application behaving correctly.

Whonix runs on VirtualBox, on KVM (kernel-based virtual machine), and inside Qubes OS as Qubes-Whonix, where the separation is enforced by a Type 1 hypervisor instead of by software running on your ordinary desktop. It offers a Live Mode as well as a permanent mode, so you can decide per boot whether the Workstation remembers anything.

The costs: two virtual machines need the memory and the disk for two, and you now maintain and update two systems. Permanent mode keeps state by default, which is the reason to choose Whonix and also its main risk. The host underneath is still yours to protect, because a compromised host sits below both machines and sees everything they do.

What none of these three protects against

Nothing here protects you from what you type. Sign into an account carrying your name, reuse a phrase you have used elsewhere, or mention a detail only a few people could know, and the network layer stops mattering. This is the most common way anonymity is lost, and no amount of isolation touches it.

Files carry their own history. Tails puts it plainly: "many files contain hidden data, or metadata", including location data inside photographs and author names inside documents. A file created under your real identity stays connected to that identity after you move it through Tor.

A party who can watch both ends of the network is outside what Tor claims to stop. Tails warns that "a powerful adversary, who could analyze the timing and shape of the traffic entering and exiting the Tor network, might be able to deanonymize Tor users". Neither Tails nor Whonix adds a defence here, because neither one changes the traffic pattern your session produces.

The exit relay sees whatever was not encrypted before it left. That relay is where your traffic rejoins the ordinary internet, so it "can observe your traffic" on plain HTTP and can impersonate the destination server. Confirm the connection is HTTPS, or use an onion address, where traffic never leaves the Tor network at all.

The use of Tor is itself visible. Your provider and your local network can see that you connect to the Tor network, even though they cannot see which sites you visit, because the relays you connect to are publicly listed. When the connection to Tor is blocked, or the use of Tor is the thing you need to conceal, that is the job of bridges and pluggable transports, which are unlisted entry points that can also disguise the shape of the traffic.

Is this normal software to run?

Yes. Tor is ordinary privacy software, and it is legal to use in most countries. It grew out of onion routing research at the US Naval Research Laboratory in the 1990s, and the history of Tor as a public network is a research project that became public infrastructure. The people using it on any given day are unremarkable: someone reading the news on hotel Wi-Fi, a researcher opening a site that would otherwise log them, a person who does not want a health search sold to an advertising broker, a support worker helping someone leave an abusive household.

Two practical notes, which are not legal ones. Some websites refuse connections from Tor exit relays, so parts of the web will show you a challenge page or nothing at all. And some workplace or school networks block Tor as a matter of their own policy. A commercial VPN (virtual private network) is a different trust model rather than a lighter version of this one: it moves your trust to a single company that can see everything you do. Tor and a VPN compared side by side covers when each is the right answer.

Pick this if

• Pick Tor Browser if the thing that needs separating is your browsing, on a computer you own and trust.
• Pick Tails if the session must leave nothing behind on the computer, or the computer is not yours.
• Pick Whonix if programs other than a browser must run over Tor, you want files kept between sessions, and you want an address leak to be structurally impossible instead of merely unlikely.
• Pick more than one if your needs change by task. Tor Browser on your own laptop most days, plus a Tails stick for sessions that must leave no trace, is a normal combination.

If you want to run Tor infrastructure instead of browsing

Running a relay adds capacity for other people. It does nothing for the privacy of your own browsing, so keep the two goals separate, and keep them on separate machines where you can.

• A middle relay passes traffic between other relays and never contacts the destination, which makes running a Tor relay on a VPS the low-friction way to contribute.
• An exit relay carries traffic out to the ordinary internet under your provider's name, so running a Tor exit node means abuse complaints and a host who agreed to it in advance.
• An onion service publishes something reachable only inside the network, whether that is an onion site hosted on a VPS or an onion service in front of SSH, so an admin port never faces the public internet.
• A bridge gives an unlisted way in to people whose network blocks Tor, which is the same bridge and pluggable transport setup a censored reader needs on the client side.

FAQ

Should I use Tails or Whonix?

Use Tails when nothing may remain on the computer after shutdown, especially when the computer is borrowed or shared. Use Whonix when you need files to survive between sessions and want applications other than a browser to run over Tor, accepting that the virtual machines sit on a disk that keeps state. Tails is stronger at leaving no trace. Whonix is stronger at preventing an address leak, because Whonix-Workstation has no interface on the real network to read an address from.

Do Tor Browser, Tails or Whonix hide from my internet provider that I use Tor?

No. Your provider and your local network can see that you connect to the Tor network, though they cannot see which sites you visit. Tor relays are publicly listed, so a connection to one is recognisable. If you need to hide the use of Tor, or your network blocks it, use a bridge with a pluggable transport. A bridge is an entry point that is not in the public list, and a pluggable transport changes how the traffic looks on the wire.

Can malware inside Whonix-Workstation find my real IP address?

Not through the network stack, and that is the point of the split design. The Workstation has no interface on the real network, so its kernel holds only a private address on the internal virtual network between the two machines. Malware running as root can only report what the machine knows. It can still identify you in other ways, by reading files you stored in the Workstation or by recording what you type, and a compromise of the host running both machines defeats the design entirely.

Is using Tor Browser, Tails or Whonix legal?

In most countries, yes. These are standard privacy tools used every day by ordinary people. A small number of states restrict or block anonymity networks, so check local law if that is a live question where you are. Separately from the law, some workplaces and schools forbid Tor on their networks by policy, and some websites refuse connections coming from Tor exit relays.

Will Tails leave traces on a computer that is not mine?

Tails runs in memory and does not write to the computer's internal disk, so it leaves nothing in the filesystem and clears memory at shutdown. Two things stay outside its control. The local network can see that the machine connected to the Tor network, and any compromise at the firmware or hardware level sits below the operating system, which Tails itself says no operating system can defend against.