I already downloaded Tails [[!inline pages="inc/stable_amd64_version" raw="yes" sort="age"]].
For your security,
always verify your download!
[[!toggle id="why-verify-supported" text="Why?"]]
With an unverified download, you might:
[[How does the extension work?|contribute/design/verification_extension]]
"""]]Our browser extension makes it quick and easy.
You seem to have JavaScript disabled. To use our browser extension, please allow all this page:
[[!img screenshots/allow_js.png link="no"]]Tails Verification extension installed!
Verifying $FILENAME…
Verification successful!
Verification failed!
[[!toggle id="why-failed" text="Why?"]]
Most likely, the verification failed because of an error or interruption during the download.
The verification also fails if you try to verify a different download than the latest version ([[!inline pages="inc/stable_amd64_version" raw="yes" sort="age"]]).
Less likely, the verification might have failed because of a malicious download from our download mirrors or due to a network attack in your country or local network.
Downloading again is usually enough to fix this problem.
[[How does the extension work?|contribute/design/verification_extension]]
"""]]Verification failed again!
[[!toggle id="why-failed-again" text="Why?"]]
The verification might have failed again because of:
Trying from a different place or a different computer might solve any of these issues.
"""]]Please try to download again from a different place or a different computer…
You are using $DETECTED-BROWSER.
Direct download is only available for:
Please update your browser to the latest version.
For your security,
always verify your download!
[[!toggle id="why-verify-unsupported" text="Why?"]]
With an unverified download, you might:
[[How does the extension work?|contribute/design/verification_extension]]
"""]]Our browser extension for Firefox, Chrome, and Tor Browser makes this quick and easy.
Copy and paste this link in Firefox, Chrome, or Tor Browser:
https://tails.boum.org/install/debian/usb-download/
https://tails.boum.org/install/win/usb-download/
https://tails.boum.org/install/linux/usb-download/
https://tails.boum.org/install/mac/usb-download/
https://tails.boum.org/install/mac/dvd-download/
https://tails.boum.org/upgrade/tails-download/
https://tails.boum.org/install/dvd-download/
https://tails.boum.org/install/vm-download/
https://tails.boum.org/install/download/
[[!toggle id="what-is-bittorrent" text="What is BitTorrent?"]]
BitTorrent is a peer-to-peer technology for file sharing that makes your download faster and easier to resume.
You need to install BitTorrent software on your computer, like Transmission (for Windows, macOS, and Linux).
BitTorrent doesn't work over Tor or in Tails.
"""]]Your BitTorrent client will automatically verify your download when it is complete.
Open and download the Torrent file with your BitTorrent client. It contains the Tails [[!inline pages="inc/stable_amd64_version" raw="yes" sort="age"]] ISO image that you will use in the next step.
If you know OpenPGP, you can also verify your download using an OpenPGP signature instead, or in addition to, our browser extension or BitTorrent.
Download the [[Tails signing key|tails-signing.key]].
Download the Tails [[!inline pages="inc/stable_amd64_version" raw="yes" sort="age"]] OpenPGP signature and save it to the same folder where you saved the ISO image.
Verifying using OpenPGP but without authenticating our signing key through the OpenPGP Web of Trust is equivalent in terms of security to verifying using our browser extension or BitTorrent because it relies on downloading a genuine signing key from our website.
[[!toggle id="basic-openpgp" text="See instructions for basic OpenPGP verification."]] [[!toggleable id="basic-openpgp" text=""" [[!toggle id="basic-openpgp" text=""]]This section provides simplified instructions:
See the [[Gpg4win documentation on verifying signatures|http://www.gpg4win.org/doc/en/gpg4win-compendium_24.html#id4]].
Verify the date of the signature to make sure that you downloaded the latest version.
If the following warning appears:
Not enough information to check the signature validity. Signed on ... by tails@boum.org (Key ID: 0x58ACD84F The validity of the signature cannot be verified.
Then the ISO image is still correct according to the signing key that you downloaded. To remove this warning you need to authenticate the signing key through the OpenPGP Web of Trust.
[[!img install/inc/screenshots/verifying_in_tails.png link="no"]]
[[!img install/inc/screenshots/notification_in_tails.png link="no"]]
Verify the date of the signature to make sure that you downloaded the latest version.
Execute:
[[!inline pages="inc/stable_amd64_gpg_verify" raw="yes" sort="age"]]
The output of this command should be the following:
[[!inline pages="inc/stable_amd64_gpg_signature_output" raw="yes" sort="age"]]
Verify the date of the signature to make sure that you downloaded the latest version.
If the output also includes:
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Then the ISO image is still correct according to the signing key that you downloaded. To remove this warning you need to authenticate the signing key through the OpenPGP Web of Trust.
Authenticating our signing key through the OpenPGP Web of Trust is the only verification technique that can protect you in case our website is compromised. It is also the most complicated technique and might not be possible for everyone to perform because it relies on trust relationships between individuals.
[[!toggle id="web-of-trust" text="Read more about authenticating the Tails signing key through the OpenPGP Web of Trust."]] [[!toggleable id="web-of-trust" text=""" [[!toggle id="web-of-trust" text=""]]The verification techniques presented until now (browser extension, BitTorrent, or OpenPGP verification) all rely on some information being securely downloaded using HTTPS from our website:
But, while doing so, you could download malicious information if our website is compromised or if you are a victim of a [[man-in-the-middle attack|doc/about/warning#man-in-the-middle]].
The OpenPGP verification is the only technique that allows you to verify the ISO image even better by also authenticating the Tails signing key through the OpenPGP Web of Trust. Relying on the OpenPGP Web of Trust is the only way to completely protect you from malicious downloads.
If you are verifying an ISO image from inside Tails already, for example to do a manual upgrade, then the Tails signing key is already included in Tails. You can trust this signing key as much as you are trusting your Tails installation already because you are not downloading it.
One of the inherent problems of standard HTTPS is that the trust we usually put in a website is defined by certificate authorities: a hierarchical and closed set of companies and governmental institutions approved by your web browser vendor. This model of trust has long been criticized and proved several times to be vulnerable to attacks [[as explained on our warning page|doc/about/warning#man-in-the-middle]].
We believe that, instead, users should be given the final say when trusting a website, and that designation of trust should be done on the basis of human interactions.
The OpenPGP [[!wikipedia Web_of_Trust]] is a decentralized trust model based on OpenPGP keys that can help solving this problem. Let's see this with an example:
In this scenario, Alice found a path to trust the Tails signing key without the need to rely on certificate authorities.
If you are on Debian, Ubuntu, or Linux Mint, you can install the
debian-keyring
package which contains the OpenPGP keys of
all Debian developers. Some Debian developers have certified the Tails
signing key and you can use these certifications to build a trust path.
This technique is explained in detail in our instructions on
[[installing Tails from Debian, Ubuntu, or Linux Mint using the command
line|install/expert/usb]].
Relying on the Web of Trust requires both caution and intelligent supervision by the users. The technical details are outside of the scope of this document.
Since the Web of Trust is actually based on human relationships and real-life interactions, the best is to get in touch with people knowledgeable about OpenPGP and build trust relationships in order to find your own trust path to the Tails signing key.
For example, you can start by contacting a local [[!wikipedia Linux_User_Group]], [[an organization offering Tails training|support/learn]], or other Tails enthusiasts near you and exchange about their OpenPGP practices.
After you build a trust path, you can certify the Tails signing key by signing it with your own key to get rid of some warnings during the verification process.