Tails OS Explained: A Live USB That Forgets

From a 2009 Experiment to a Journalist Standard

Tails grew out of two older live systems, amnesia and Incognito, which merged and released the result under the name The Amnesic Incognito Live System in 2009. The name was soon shortened, and the project has shipped regular releases built on Debian ever since. Its reputation rests on real deployments rather than marketing. Snowden's leaked documents in 2013 showed the NSA describing Tails as a serious obstacle, calling it a catastrophe for their own surveillance work in an internal presentation. Reporters at major outlets later standardized on Tails workstations for handling source material, and the SecureDrop whistleblowing platform recommends it for the machines journalists use to read submissions. That history matters because it explains the design. Tails was built for people whose adversaries include state agencies, so its defaults assume the computer might be inspected later and the network is hostile. Every choice, from routing traffic through Tor to erasing RAM at shutdown, follows from that starting assumption.

Why a Whole Operating System Instead of Just a Browser

Tor Browser protects one application. Tails protects the session around it, and the difference shows up the moment an app misbehaves. On an ordinary system, a chat client, a PDF reader or a plugin can open its own connection outside Tor and give the game away. Tails answers that by forcing all outbound traffic through Tor at the firewall level: applications that try to connect directly simply fail. Booting from USB also keeps the host machine's disk out of play. Tails never mounts internal drives unless you do it by hand, so nothing leaks into the laptop's filesystem, swap partition or crash logs. For someone working on a borrowed or shared computer, that separation is the entire point. The tradeoff is weight. A live system restarts clean every time, drivers are whatever the image ships, and installing extra software per session is awkward. People comparing a browser to a live OS should ask which boundary they need: privacy inside one app, or a temporary machine that leaves nothing behind.

How to Install Tails OS on a USB Stick

You need a stick of at least 8 GB and about half an hour. The download is an image file of roughly 1.5 GB, and the project offers separate guides for Windows, macOS and Linux that all end at the same place: verifying the image and writing it to the drive. Verification is not decorative. Tails signs its releases with an OpenPGP key, and the site walks through checking the signature before you trust the file. A tampered image would defeat every protection that follows, so the few minutes spent verifying are the cheapest security in the whole process. Writing the image is handled by tools the project names, such as balenaEtcher on Windows and macOS or the built-in disk utility on Linux. Anything already on the stick is destroyed in the process. Once written, you reboot the computer, open its boot menu, often with F12, Esc or F8 depending on the maker, and pick the USB entry. Anyone planning to run Tails OS on USB for the first time should keep the project's hardware notes open, since a machine that refuses to boot usually has a documented cause.

What Amnesia Looks Like in Daily Use

Once the desktop appears, Tails behaves like a stripped-down Debian machine: a browser, an email client, an office suite, an image editor and a few privacy tools such as the KeePassXC password manager. What it does not have is a past. Every session starts identical to the last one. The amnesia is literal. Work lives in RAM, and Tails never writes to the computer's storage on its own. Close a document without moving it to external media and it is gone. Shut down and Tails overwrites the memory it was using, so a later examiner of the RAM finds noise rather than your files. That behavior flips the normal rules. On a regular PC, forgetting a file in a folder is harmless; on Tails it is fatal to the file. Users learn quickly to treat the live session as scratch space and to decide, before producing anything valuable, where the result is allowed to live. The discipline feels strange for a day, then becomes the main reason people trust the system.

Persistent Storage, the Optional Exception

Amnesia is the default, not the law. Tails can carve an encrypted volume called Persistent Storage out of the free space on the same stick, protected by a passphrase of your choosing. Inside it you pick what survives: WiFi credentials, browser bookmarks, GPG keys, email accounts or simply a folder of files. The choices are deliberately granular because everything you keep weakens the amnesic property by exactly that much. Someone who seizes the stick sees an encrypted volume but not its contents, so the passphrase carries the whole load. A short dictionary word is a real weakness here, not a theoretical one. Two habits make persistence safer. First, store only what repeated sessions genuinely need; a password database and a working directory are usually enough. Second, keep a separate encrypted backup somewhere else, because a USB stick is easy to lose and the LUKS encryption underneath does not forgive a forgotten passphrase. Persistence answers a usability problem, and used carelessly it quietly rebuilds the very trail Tails exists to erase.

The Threats Tails Walks Past

The project's own warning page is unusually honest, and worth reading before trusting the system with anything serious. Tails cannot fix compromised hardware: a keylogger, rigged firmware or a trojan already on the machine can watch everything regardless of which OS is running. It also inherits Tor's limits, so an adversary watching both your connection and a destination's can correlate timing and volume. Identity slips past the design too. Signing into a personal email account from Tails still signs in as you; the network path is hidden but the username is not. The same applies to documents carrying your name, reuse of a pseudonym, or habits like always connecting from one room. There is also a declared hole called the Unsafe Browser, which Tails shows only when a captive portal demands a clearnet login for WiFi. Traffic from it bypasses Tor entirely and the interface says so in red letters. Learning how to use Tails OS well mostly means respecting this list rather than testing it.

A Sensible First Evening with the System

The first run should be unambitious. Boot the stick on a spare laptop, confirm the WiFi connects, and let the browser reach a few ordinary pages. Expect everything to feel slower than your normal connection, since each request crosses three relays before it reaches the site. Then rehearse the loop that matters: open a document, decide it is worth keeping, move it into Persistent Storage and reboot to prove it survived. Try the reverse too, leaving a file in the session and confirming it is gone after shutdown. These two drills teach more than any feature list. Spend the rest of the session on the welcome screen's options. An administration password is off by default and rarely needed for ordinary work; keyboard layout, language and timezone are worth setting correctly the first time. If something fails to connect, the project's own documentation describes when bridges help and how to request them inside the connection wizard. A calm hour of poking at an empty system beats discovering the mechanics in the middle of sensitive work.

Sources and official tools

• Tails: what the amnesic live system does
• Tails: the Welcome Screen and startup options
• Tor Project: using Tor Browser safely
• Tor Browser: official download
• Tails: warnings and limitations

Official references checked when this guide was written. Product links contain no affiliate tracking.