Whonix is an operating system built for anonymity, made up of two virtual machines: the Gateway and the Workstation. The Gateway forces all traffic through the Tor network. The Workstation, where you actually work, can only reach the internet through the Gateway. The clever part: even if an application on the Workstation is compromised or misconfigured, it cannot reveal your real IP address — it only ever sees the Gateway. Whonix runs on a PC (Windows, macOS or Linux), not on your phone.
Requirements
- A PC running Windows, macOS or Linux
- VirtualBox (current version 7)
- At least 8 GB of RAM recommended and around 15 GB of free storage
Step 1 — Install VirtualBox
Download VirtualBox from the official site and install it. On Windows you also need the "Microsoft Visual C++ 2019 Redistributable".
Step 2 — Download Whonix (from the official source only!)
Download Whonix exclusively from whonix.org. Stay away from mirrors, torrents or third-party providers — tampered images with backdoors can circulate there. You'll get the Gateway and Workstation as .ova files.
Step 3 — Verify the download (strongly recommended)
Check the OpenPGP signature to make sure the file is genuine and unaltered:
- Import the Whonix signing key:
gpg --import whonix-signing-key.asc - Verify the signature:
gpg --verify Whonix-*.ova.asc Whonix-*.ova - The output must show "Good signature".
The note "not certified with a trusted signature" is normal here and not an error.
Step 4 — Import into VirtualBox
- Open VirtualBox → File → Import Appliance
- Select the
.ovafile - Change nothing — just click Import
- Accept the license and wait for the import to finish
- Repeat this process for the Gateway and the Workstation (both VMs)
Step 5 — Start Whonix (mind the order!)
Start the Whonix Gateway first and wait until it has established a connection to the Tor network. Then start the Whonix Workstation. This is the only way the Tor routing path is built correctly.
Step 6 — First steps
- Login: user
user(passwordless login). - Update first: bring both VMs up to date (via the Whonix updater or in the terminal with
sudo apt update && sudo apt full-upgrade). - For browsing, use the pre-installed Tor Browser in the Workstation.
Security rules — please follow them
- Never change the VMs' network settings — they are configured precisely to preserve your anonymity.
- Update the Gateway and Workstation regularly.
- In the Workstation, don't install software or use accounts that identify you (e.g. your real email or social media account) — that breaks your anonymity instantly.
- Keep your host system clean and up to date as well.
What about on the go?
Whonix is a desktop solution. On a smartphone you can get Tor routing through Orbot, for example; the most stable mobile foundation for it is a hardened, de-Googled system — see our SaferPhone models with GrapheneOS. For confidential communication, add VOID.
Conclusion
Whonix is one of the most powerful tools for anonymous browsing — provided it is installed cleanly and kept up to date. Stick to the order (Gateway first), verify the signature, and never change the network configuration. Then Whonix reliably routes everything through Tor.
Source: official Whonix documentation (whonix.org).