# Whonix download and first run: importing the Gateway and Workstation VMs URL: https://webvpn.org/anonymity/whonix-download/ Updated: 2026-09-08 Where to download Whonix, why there is no Whonix ISO, how to import the Gateway and Workstation virtual machines into VirtualBox or KVM, first start and verification. Download Whonix only from the Whonix project's website, which provides virtual machine images for VirtualBox on Windows, macOS and Linux, separate images for KVM on Linux, and installation instructions for Qubes OS. There is no Whonix ISO because Whonix is not a bootable system; it runs as two virtual machines, the Gateway and the Workstation, which you import into your virtualiser and start in that order. The download and import are not hard, but the process differs from installing an ordinary operating system in ways that confuse newcomers: there is no installer, the two machines come together or separately depending on the platform, and the order in which you start them matters. This guide covers choosing the right download, verifying it, importing into VirtualBox and KVM, the Qubes route, the first start, and the settings worth checking before you rely on the system. ## Choose your platform first Whonix runs in three environments, and the download depends on which you use. - VirtualBox on Windows, macOS or Linux. The easiest starting point and the most common. Whonix provides a single file containing both virtual machines. - KVM on Linux. The project regards KVM as more secure than VirtualBox. Whonix provides separate Gateway and Workstation images with configuration files. - Qubes OS. Whonix is integrated as Qubes-Whonix templates installed from within Qubes. The Qubes guide on this site covers that system. If you are new to virtualisation, start with VirtualBox. You can move to KVM or Qubes later once you understand how the two machines interact. ## Why there is no Whonix ISO An ISO is a disc image for booting a computer or a virtual machine into an installer. Whonix does not have one because it does not install: the project ships the finished, configured machines. That design means every Whonix user runs an identical, tested system and there is no installation step to get wrong. It also means any file described as a Whonix ISO on a third-party site is not from the project and should not be run. If your virtualiser asks for an ISO, you are using the wrong import method; look for the option to import an appliance or an existing disk image. ## Download and verify Go to the Whonix project's website and follow the download link for your platform. Download the image and the accompanying signature file. The project publishes its signing key and detailed verification instructions using GnuPG; follow them and confirm a good signature before importing. A Whonix image is an entire operating system that you will trust with your anonymity, and verification is the only way to know it is the one the project built. Downloads are several gigabytes. Use the project's official mirrors or its torrent, which is signed, rather than any other source. ## Import into VirtualBox: six steps - Install VirtualBox from its official website, matching the version the Whonix project currently recommends; recent Whonix releases document tested VirtualBox versions. - In VirtualBox, choose File, then Import Appliance, and select the downloaded Whonix file. Both the Gateway and the Workstation appear in the import dialog. - Leave the machine settings at the defaults the project has chosen unless you have a reason and understand the consequences; the network configuration in particular must not be changed, because it is what isolates the Workstation. - Complete the import. Two machines appear in your VirtualBox list. - Start the Whonix-Gateway. On first start it runs a setup wizard that asks whether to connect to Tor directly or through a bridge. Answer according to your network, then let it connect. It will offer to check for updates. - When the Gateway reports that Tor is connected, start the Whonix-Workstation. It runs its own short setup, then presents a desktop with Tor Browser and the other applications. Keep both running while you work. Shut down the Workstation first and the Gateway last. ## Import into KVM On a Linux host with KVM and libvirt installed, download the Gateway and Workstation images and their XML definitions from the project. The project's KVM instructions walk through creating the isolated internal network that connects the two machines, defining each machine from its XML file, and attaching the disk images. This route requires more command-line work than VirtualBox and rewards it with a virtualiser the project considers stronger. Follow the project's current instructions exactly, because the network definitions are what enforce the Workstation's isolation, and an error there defeats the design. ## Whonix in Qubes OS If you run Qubes, you do not download Whonix images at all. Qubes offers Whonix during installation or afterwards through its template installer, which fetches the Gateway and Workstation templates. You then create a Gateway qube and one or more Workstation qubes based on them, and Qubes handles the networking. This is the setup both projects recommend for people who can run Qubes, because it combines Whonix's Gateway design with Qubes' host isolation. The Qubes guide on this site explains the requirements. ## First start and the checks to make Once both machines are running, spend ten minutes on these checks before doing anything sensitive. - In the Gateway, confirm Tor is connected using the status tools it provides. - In the Workstation, open Tor Browser and load the Tor Project's connection check page to confirm traffic is going through Tor. - Update both machines using the updater the project provides. Whonix releases security updates regularly, and a freshly downloaded image may be weeks old. - Do not install VirtualBox Guest Additions or similar host integration tools in the Workstation unless the project's documentation says the current version is acceptable; such tools can create channels between Workstation and host. - Do not change the network adapter settings of either machine. - Consider whether the host disk is encrypted. The Whonix machines persist on it, and if the host is not encrypted, everything in the Workstation is readable by anyone with the disk. ## Common problems The Gateway fails to connect: your network may block Tor. Rerun the Gateway's connection wizard and configure a bridge; the bridges guide on this site explains how to obtain one. The Workstation has no network: the Gateway is not running or not connected, or the internal network setting was altered. Poor performance: allocate more RAM to the Workstation, or close host applications. VirtualBox refuses to start machines on Windows: another hypervisor feature may be enabled; the VirtualBox and Whonix documentation both cover this. ## What the project recommends The steps here follow the Whonix project's installation documentation, which is thorough and should be read alongside this guide. The Whonix project recommends verifying every download, states clearly that it does not provide an ISO and that files claiming to be one are not from the project, and advises starting the Gateway before the Workstation and updating both immediately after import. The project ranks its supported platforms by security, recommending Qubes-Whonix where possible, KVM as the next choice on Linux, and VirtualBox as the accessible option for most people, with the caveat that VirtualBox's own security record is weaker. Users who have documented their setups report that most first-run problems stem from altered network settings or from a Gateway that has not finished connecting before the Workstation starts, both of which are avoided by following the order above. ## Get it running today Download the image for your virtualiser from the Whonix project, verify it, import it, and start the Gateway and then the Workstation. Check Tor is working, update both machines, and you have an anonymous working environment that cannot leak your address even if its browser is compromised. The Whonix overview on this site explains why that guarantee holds, and the alternatives guide explains when Tails or Qubes fits better. ## FAQ Q: Where do I download Whonix? A: From the Whonix project's own website, which offers images for VirtualBox on Windows, macOS and Linux, images for KVM on Linux, and instructions for installing Whonix templates in Qubes OS. Do not download Whonix from third-party sites. Q: Is there a Whonix ISO? A: No. Whonix is not a bootable system, so there is no ISO to burn or boot. It ships as virtual machine images that you import into VirtualBox or KVM, or as templates inside Qubes OS. Searching for a Whonix ISO leads to unofficial files that should not be trusted. Q: Do I need to download the Gateway and Workstation separately? A: For VirtualBox, the project provides a single file that imports both machines together. For KVM, the Gateway and Workstation images are separate downloads with an XML definition for each. In Qubes, both templates are installed with one command. Q: Which should I start first, Gateway or Workstation? A: Always the Gateway. It connects to Tor and provides the Workstation's only network path. Start the Workstation after the Gateway reports that Tor is connected. Both should stay running while you work. Q: How much RAM does Whonix need? A: The Gateway runs comfortably on a small allocation and the Workstation needs more for a browser and applications. Plan for a host with at least 8 GB of RAM to run both alongside your normal system without strain; the project's documentation gives current defaults.