# What is Whonix: the Linux operating system that cannot leak your IP address URL: https://webvpn.org/anonymity/whonix/ Updated: 2026-09-11 What Whonix is and how it works: the Gateway and Workstation design, why the Whonix browser cannot leak your IP address, what Whonix is based on, and whether it is legal. Whonix is a free, Debian-based operating system designed for anonymity that runs as two virtual machines on your existing computer. The Whonix-Gateway connects to the Tor network; the Whonix-Workstation, where you actually work, can reach the internet only through the Gateway. Because the Workstation never has your real IP address and cannot connect anywhere except through Tor, software running inside it, including malware, cannot discover or leak who you are. That two-machine structure is what sets Whonix apart from Tails, from Tor Browser on an ordinary system, and from every setup that relies on a single machine routing itself correctly. This guide explains the design, what it protects against and what it does not, how the Whonix browser and applications fit in, what Whonix is based on and where it runs, how it compares with the alternatives, and the legality question that appears in searches. ## The two-machine design Ordinary Tor use relies on one system doing two jobs: running your applications and making sure all their traffic goes through Tor. If an application ignores the proxy settings, or an attacker exploits your browser and runs code that connects directly, the system's real IP address is exposed. Tails mitigates this with a firewall; Whonix removes the problem structurally. The Whonix-Gateway is a virtual machine whose only purpose is to run Tor. It has two network interfaces: one to the outside world, through your host computer's connection, and one to an internal virtual network that only Whonix machines can see. The Whonix-Workstation is a virtual machine where you run Tor Browser, email, documents and anything else. Its only network interface is on that internal virtual network, and the only thing on the other end is the Gateway. The Workstation has no knowledge of your real IP address; it does not even have a route to the outside world except through Tor on the Gateway. If the Workstation is completely compromised, the attacker controls a machine that knows nothing about you and can only talk through Tor. That is a categorically stronger guarantee than a firewall rule on the same machine. ## What Whonix protects against The design directly addresses several of the failures that identify Tor users in practice. - Application leaks. Software that bypasses proxy settings still cannot reach the internet except through the Gateway's Tor. - Browser exploits. An exploit in Tor Browser gives an attacker control of the Workstation, which does not know your IP address. - Misconfiguration. There is no per-application proxy setting to get wrong, because the network path is fixed by the virtual machine layout. - DNS leaks. The Workstation has no DNS resolver of its own that could reach outside Tor. - Time-based fingerprinting. Whonix includes tooling to keep the system clock from revealing information, a subtle but real identification vector. Whonix also applies extensive hardening to both machines, following Debian security practice plus its own additions, and ships with Tor Browser and a set of applications preconfigured for stream isolation, so that different applications use different Tor circuits. ## What Whonix does not protect against Whonix is honest about this, and so should you be. The host system is the foundation. Whonix runs inside your ordinary operating system or inside Qubes; if the host is compromised, an attacker can see the Workstation's screen, read its memory and see your real network. Whonix does not, and cannot, protect a compromised host. Running Whonix inside Qubes OS is the strongest option because Qubes hardens the host itself. Whonix is not amnesic. The virtual machines persist between sessions, and their files exist on the host's disk. Anyone examining the host can see that Whonix was used, and unless the host disk is encrypted, can read the Workstation's contents. Tails is the tool for leaving no trace. Whonix does not change how Tor works. Correlation of both ends of a connection, malicious exits reading plain HTTP, and the user's own behaviour remain the limits described in the Tor guides on this site. ## The Whonix browser and applications Whonix does not have a browser of its own. The Workstation ships with Tor Browser, the same one the Tor Project distributes, configured to send traffic to the Gateway rather than to a local Tor process. From the user's point of view it behaves exactly like Tor Browser anywhere, with the added property that even a compromised browser cannot find your address. The Workstation also includes other applications configured for Tor: an email client, messaging, office tools and a terminal. Applications you install yourself also go through the Gateway automatically, because there is no other route, though the project recommends caution about adding software that could fingerprint you or behave unexpectedly. ## What Whonix is based on and where it runs Whonix is built on Debian, the same Linux distribution underlying Tails and many others, chosen for its stability and security process. It is distributed as prebuilt virtual machine images and, for Qubes users, as templates. It runs in three environments: VirtualBox on Windows, macOS and Linux hosts, which is the most common starting point; KVM on Linux hosts, which the project considers more secure than VirtualBox; and Qubes OS, where Whonix is integrated as Qubes-Whonix and benefits from Qubes' host isolation. Whonix does not install directly onto hardware and is not intended to. The download guide on this site covers getting and running it in each environment. ## Whonix compared with Tails and Qubes Whonix and Tails are both Tor-centred anonymity systems that solve different problems. Tails leaves no trace and works on any computer; Whonix prevents IP leaks structurally and keeps your work between sessions. Qubes is a full compartmentalised operating system that can run Whonix inside it, combining Whonix's Gateway design with a hardened host. If you own a capable laptop and want the strongest setup, Qubes with Whonix is the usual recommendation; if you need portability and amnesia, Tails; if you want Whonix's protection on the computer you already have, Whonix in VirtualBox or KVM. The alternatives guide on this site walks through the decision. ## Is Whonix illegal? The question comes up because anonymity tools attract suspicion. Whonix is free software, developed openly, and is legal to download and use in most countries, exactly as Tor is. It is used by security researchers, journalists, lawyers, and people who value privacy. A small number of countries restrict or block anonymity software in general, and you should know your local law. Beyond that, the rule is the same for every tool on this site: using Whonix is legal, and doing illegal things through Whonix is not. ## What the project and security researchers say The description above follows the Whonix project's own documentation and independent assessments of the design. The Whonix project documents its threat model explicitly, describing the two-machine separation as its central protection, stating that it does not protect against a compromised host, and recommending KVM over VirtualBox and Qubes over both for users who can run them. The Qubes OS project integrates Whonix as its recommended Tor solution and explains in its documentation that the combination of Qubes' hypervisor isolation with Whonix's Gateway design addresses both host compromise and application leaks. Security researchers who have compared anonymity systems generally credit the Gateway and Workstation architecture as the most robust practical defence against IP leaks from compromised applications, while noting that it moves the critical trust to the hypervisor and host, which is precisely why Qubes is the preferred platform. ## When to choose Whonix If you want an anonymous working environment on your own computer that keeps your files between sessions and cannot leak your address even if the browser is exploited, Whonix is the tool. Read the download guide on this site, decide between VirtualBox, KVM and Qubes, and set it up. If instead you need to leave no trace on a machine you do not own, Tails is the right choice, and the two work well side by side in a careful person's toolkit. ## FAQ Q: What is Whonix in simple terms? A: Whonix is a free operating system for anonymity that runs as two virtual machines inside your existing computer. The Gateway machine connects to Tor. The Workstation machine, where you browse and work, can only reach the internet through the Gateway, so nothing running in it can discover or leak your real IP address. Q: What is Whonix Linux based on? A: Whonix is based on Debian, a widely used Linux distribution, with extensive security and anonymity hardening added. It runs in VirtualBox, KVM and Qubes OS, and does not install directly on hardware. Q: What is the Whonix browser? A: Whonix ships with Tor Browser in the Workstation, configured to use the Gateway's Tor connection. It is the same Tor Browser as elsewhere, with the added protection that the Workstation itself has no direct network access. Q: Is Whonix illegal? A: No. Whonix is legal to download and use in most countries, like Tor itself. It is used by researchers, journalists and privacy-conscious people. Some countries restrict anonymity tools generally, so check local law, and remember that a legal tool does not make illegal activity legal. Q: Is Whonix better than Tails? A: It is better at one thing: preventing IP leaks even if the Workstation is compromised, while keeping your files between sessions. Tails is better at leaving no trace and at working on any computer. The comparison guide on this site covers when each fits.