Whonix compared with Tails, Qubes OS and VPN services| Whonix | Tails | Qubes OS | VPN services (typical) |
|---|
| Isolation architecture: Two virtual machines: a Gateway that runs Tor and a Workstation that can reach the network only through it. A compromised Workstation therefore cannot read the real IP address. | Isolation architecture: A single live system on one machine. The Tor client runs on the same system as the applications, so there is no separate gateway. | Isolation architecture: A Xen hypervisor runs isolated virtual machines called qubes, with networking confined to a separate net qube and the firewall in its own domain. It is general compartmentalization, not an anonymity gateway by itself. | Isolation architecture: Typically a client on the device or router that tunnels traffic to the provider. There is no isolation between applications and the network layer. |
| Persistence and amnesia: The Workstation keeps its data between sessions, like a normal installed system. The comparison on the Whonix site lists full persistence. | Persistence and amnesia: Runs from RAM and by default writes nothing to the internal drive. An encrypted Persistent Storage is optional, and most used RAM is overwritten at shutdown. | Persistence and amnesia: Installed on disk with full persistence, and each qube keeps its own data. Whonix is available as a community-supported template. | Persistence and amnesia: Not applicable, since a VPN is a network service and not an operating system. |
| Platform and hardware: Installs as virtual machines on an existing host such as Windows or macOS. The Whonix site lists x86-compatible hardware plus ARM64, PPC64 and Raspberry Pi downloads. | Platform and hardware: Needs a 64-bit x86-64 PC booted from a USB stick or DVD. Running it in a virtual machine is described as potentially insecure. | Platform and hardware: Needs a 64-bit CPU with VT-x/EPT and VT-d (Intel) or AMD-V/RVI and AMD-Vi (AMD), about 6 GB of RAM and 32 GB of disk. UEFI Secure Boot is not supported out of the box. | Platform and hardware: Typically apps for desktop and smartphone operating systems, plus manual setup with protocols such as IPsec, OpenVPN or WireGuard. |
| Lizenz und Offenheit: GNU GPLv3. The project is open source but includes non-free firmware blobs. | Lizenz und Offenheit: Free software, mainly under GPL v2, with some proprietary blobs. | Lizenz und Offenheit: Typically a paid service with its own private network. Whether the source code is public depends on the provider. |
| Trust model and limits: All traffic is forced through the Tor network by the Gateway. This prevents IP and DNS leaks at system level, even if the Workstation is compromised by malware with administrative privileges. | Trust model and limits: All connections are sent through Tor. The Tor Project completed a merger with The Tails Project on 26 September 2024, and Tails is listed as active. | Trust model and limits: Isolation protects against compromise spreading between qubes. It does not by itself hide the network identity. | Trust model and limits: The provider can still see user activity. VPNs hide traffic from the local network and ISP but do not guarantee anonymity. |
