How to use Qubes OS: a computer split into safe compartments

Qubes OS is a free operating system for computers that is built around one idea: keep things apart. Instead of one system where every app can reach every file, Qubes runs your activities in separate compartments called qubes. If a bad attachment infects your "untrusted" qube, your banking, passwords and work files in other qubes are still safe.

Qubes is the system security experts often recommend for people at high risk. It is more demanding than Tails or a normal system, so take your time.

How Qubes is organised

• work, personal and untrusted qubes: everyday compartments. Windows have a coloured border that shows which qube they belong to.
• vault: a qube with no internet at all, for passwords (KeePassXC) and PGP keys.
• Disposable qubes: open a risky file or website in a fresh qube that is destroyed when you close it.
• sys-net and sys-firewall: the network and firewall run in their own qubes, so a hacked Wi-Fi driver cannot reach your files.
• Whonix qubes (optional): send a qube's traffic through Tor.

What you need

• A 64-bit Intel or AMD computer with hardware virtualisation (VT-x / AMD-V) and IOMMU (VT-d / AMD-Vi). Apple computers are not supported.
• 16 GB of memory or more is strongly recommended (it works with less, but slowly).
• An SSD with at least 128 GB.
• A USB stick of 8 GB or more for the installer.
• Check the Hardware Compatibility List and the Qubes-certified laptops on qubes-os.org before you buy. Laptops with Nvidia graphics can be harder to set up.

Step 1: Download and verify Qubes

1. Go to qubes-os.org and open Downloads. Download the installer (ISO).
2. Verify the download using the steps on the same page. This makes sure the file really comes from the Qubes project.

Step 2: Write the installer to a USB stick

• Windows: use Rufus and choose DD image mode when asked.
• Mac or Linux: use balenaEtcher, or the dd command if you are comfortable with it.

Step 3: Prepare the computer

1. Open the computer's firmware settings (usually F2, Del or F10 when it starts).
2. Turn on virtualisation (VT-x / AMD-V / SVM) and VT-d / IOMMU.
3. Back up anything on the computer: installing Qubes erases the disk.

Step 4: Install

1. Start from the USB stick (use the boot menu key, often F12).
2. Choose Install Qubes OS, then your language.
3. In Installation Destination, choose the disk and leave Encrypt my data on. Choose a strong disk password.
4. Create your user account and password, then click Begin Installation.
5. After the restart, the initial setup asks which qubes to create. The defaults are a good start. Tick Whonix if you want Tor qubes. Click Done and Finish configuration.

Step 5: Everyday use

• Open apps from the Q menu at the top-left. Apps are grouped by qube, so you choose both the app and where it runs.
• Copy and paste between qubes: copy as normal, press Ctrl+Shift+C, switch to the other window, press Ctrl+Shift+V, then paste as normal. Qubes asks before anything moves, so nothing crosses by accident.
• Move a file to another qube: right-click it in the file manager and choose Move to other qube.
• Open a risky file safely: right-click it and choose View in disposable qube or Edit in disposable qube.
• Update with the Qubes Update tool in the top bar whenever it shows updates.

A simple layout to start with

• vault: KeePassXC and PGP keys. No internet.
• personal: your everyday browser and email.
• work: work accounts only.
• untrusted: random websites and downloads.
• anon-whonix: anonymous browsing through Tor. Never log in to personal accounts here.

Good to know

• Qubes protects you best when you use the compartments: put each part of your life in its own qube and do not mix them.
• Graphics-heavy gaming and some hardware (fingerprint readers, some webcams) may not work well.
• The Qubes community forum is friendly and active if you get stuck.