Tails Operating System Features are built around one goal: letting you use almost any computer for a sensitive session while leaving as little trace as possible. Tails, short for The Amnesic Incognito Live System, is a Debian-based Linux system that starts from a USB stick instead of the computer’s internal drive.
This article walks through the features you meet from the moment Tails boots to the moment it shuts down. It explains what each one does, why it exists and where its protection ends, so you can decide which options to enable and how to fit Tails into a careful routine.
What Happens When Tails Starts
Tails runs entirely from removable media and loads into the computer’s memory, often called RAM. By default it does not touch the internal hard drive, so the operating system already installed on that computer is neither used nor modified during your session.
Because the system lives in memory, anything you create is temporary unless you choose to save it. Closing Tails clears that memory, and the next start presents the same clean system as before. This amnesic behavior is the foundation that most other Tails features are built on top of.
Starting from USB also means you can carry the same trusted environment between machines. A hypothetical researcher could use a library computer, a borrowed laptop and a home desktop while working inside one consistent, known system each time. The host computer’s firmware and hardware still matter, however, because Tails cannot inspect or repair them.
That limit is worth remembering on unfamiliar machines. A hardware keylogger, a small device plugged between keyboard and computer, can record typing no matter which system boots. Glance at the ports and cables before you start a sensitive session on a shared computer.
The Welcome Screen and Startup Choices
Before the desktop appears, Tails shows a Welcome Screen. Here you pick a language and keyboard layout, open Persistent Storage if you created one, and open additional settings that change how the session behaves.
Additional settings are off unless you enable them, which keeps the default session conservative. Common options include setting an administration password for tasks that require elevated rights, adjusting the MAC address behavior, enabling the Unsafe Browser for captive portals, and choosing an offline mode with networking disabled.
The administration password deserves attention. It is disabled by default.
Without it, installed software cannot make system-level changes during a normal session. You set a temporary password only when a task requires it, and that password is forgotten when Tails shuts down, so it never becomes a long-term weak point. Leaving it unset for routine work keeps the system closer to its intended design.
How Tails Connects to the Internet
Networking is where Tails differs most from an ordinary desktop. Instead of letting each program choose its own route, the system forces connections through Tor or blocks them entirely.
Tor by Default
Tor is a network of volunteer-run relays that wraps your traffic in several layers of encryption and passes it through multiple servers.
Each relay knows only the previous and next hop, so the website you visit sees a Tor exit address instead of your own. In Tails, a firewall rejects connections from applications that try to reach the internet without going through Tor, which prevents accidental leaks from misbehaving programs.
The Tor Connection Assistant
When Tails joins a network, a connection assistant helps you reach Tor.
You can connect automatically or use bridges, which are unlisted entry relays that make Tor use harder to detect or block on a local network. Bridges help where Tor is censored, but they do not hide your activity from a network that is watching closely for unusual traffic patterns.
The Unsafe Browser
Hotels and airports often show a captive portal, a sign-in page that must be accepted before internet access works. Because Tor cannot pass through that page, Tails offers an optional Unsafe Browser that connects directly, without Tor. It is disabled by default and should only be used for captive portals, never for real browsing.
Tor Browser and Its Protections
Tor Browser is the main browser in Tails. It is based on Firefox and adds protections designed to make users look alike, so that individual visitors are harder to single out from the crowd of other Tor users.
One key protection is resistance to browser fingerprinting, the technique of identifying someone from the unique combination of their screen size, fonts, settings and similar details. Tor Browser standardizes many of these values. It also isolates sites from one another, so cookies and connections created by one website are kept apart from those of another.
Tor Browser offers security levels that disable features such as JavaScript on some or all sites. Higher levels reduce attack surface but break more pages. A hypothetical reporter reading leaked documents might choose the strictest level for that session, accepting broken layouts in exchange for fewer opportunities for malicious code to run.
Tor Browser in Tails also starts in private browsing mode by design, so history, cookies and cached pages disappear when the browser closes. Bookmarks are kept only if you enable that option in Persistent Storage, which keeps the default session clean.
Persistent Storage, Used Deliberately
Tails can create an encrypted Persistent Storage area on the same USB stick. It uses LUKS, the standard Linux disk encryption format, and must be opened with a passphrase at the Welcome Screen before it becomes available.
You decide which kinds of data are saved. The persistent storage settings let you keep items selectively instead of saving the entire system. Typical choices include:
- Personal documents a folder that survives restarts while the rest of the system stays amnesic.
- Network connections saved Wi-Fi details so you do not retype them every session.
- Encryption and mail keys OpenPGP keys and email client settings.
- Additional Software extra packages that Tails reinstalls automatically at each start.
- Browser bookmarks saved addresses in Tor Browser.
Every item you save becomes something that could be recovered if the USB stick and its passphrase are both exposed. Keep the list short, choose a strong passphrase, and store only what you would truly struggle to recreate later.
Hardware Address Protection
Every network card carries a MAC address, a hardware identifier visible to the local network. Without protection, a café or campus network can recognize the same laptop across visits, even when all traffic is encrypted and routed through Tor.
Tails changes the MAC address of network interfaces by default, presenting a random value instead of the real one. This helps prevent a local network operator from linking separate sessions to the same physical machine, which is especially useful on shared or public networks visited repeatedly.
Some networks only accept known devices, or the randomized address may cause connection trouble with particular adapters. In those cases you can switch the feature off at the Welcome Screen, understanding that the local network will then see the real hardware address. That decision should be made per session, with the trade-off in mind.
Bundled Tools for Privacy-Conscious Work
Tails includes a curated set of applications so you can complete common tasks without installing anything. The selection focuses on documents, communication and encryption rather than on entertainment or general-purpose utilities.
The bundle typically covers a handful of everyday needs:
- Office work an office suite for documents, spreadsheets and presentations.
- Email an email client with OpenPGP encryption support.
- Credentials a password manager that stores logins in an encrypted database.
- File cleanup a tool that strips metadata from documents and images.
Metadata is hidden information such as author names, device models or location tags that documents and photos may carry.
Removing metadata matters when sharing files. A hypothetical whistleblower could otherwise send a photo whose embedded details reveal the camera model or where it was taken. Because the exact set of applications changes between releases, check the current Tails documentation to see which tools are included today.
Shutdown, Memory Wiping and Emergency Exit
When Tails shuts down, it overwrites most of the memory it used. This reduces the risk of a cold boot attack, where someone with physical access tries to read leftover data from RAM shortly after the computer is turned off.
Tails also supports an emergency shutdown. Removing the USB stick while the system is running triggers an immediate shutdown, which can be useful if you must leave a computer suddenly. Any unsaved work in memory is lost, so treat this as a last resort rather than a routine way to close a session.
Neither feature protects data you deliberately saved to Persistent Storage or to external drives. Those stay encrypted only as long as their passphrases remain private. Memory wiping is about the temporary session, not about everything you created while using it.
Physical security still matters during a session. Locking the screen when you step away helps, and Tails includes a screen locker that asks for a password set for that session. An unattended session left open gives a passerby full access to whatever is open.
Updates and Verifying Your Download
Tails is only as trustworthy as the copy you run. The project publishes official images and provides ways to verify them, so you can confirm that the file you downloaded has not been altered by a compromised mirror or network. Verification is worth repeating for every fresh installation.
Once installed, Tails checks for updates when it connects to the internet. Automatic upgrades handle many releases from within a running session, while some major releases require a manual upgrade from a fresh image. Each release usually updates Tor Browser and patches security issues found in included software.
Running an outdated Tails defeats much of its purpose, because attackers target known vulnerabilities. A hypothetical traveler who keeps an old USB stick in a drawer should update it before relying on it, ideally on a trusted network and with time to finish the upgrade carefully.
Fitting Tails Into Your Routine
Tails works best for focused, sensitive sessions rather than as a full replacement for your everyday computer. Plan which tasks belong in Tails, which accounts you will log into there, and which you will keep entirely separate to avoid linking identities.
Keep a short personal checklist: verify the image, update before use, decide which Persistent Storage features you need, and avoid logging into personal accounts during sessions meant to stay unlinked. Remember that Tor hides your location from websites, not your identity from accounts you sign into.
Read the official Tails documentation regularly. Features, defaults and supported hardware change over time, and the project publishes clear warnings about known limitations. Treat those warnings as part of the system, because understanding where Tails stops is what lets you rely on it where it truly helps.