Tails boots from a USB stick, routes everything through Tor and forgets when you shut down. What it takes to set up and where its limits are.
nexusb2l7fmqnefwphyy7m5zjhlkytlbo7qbb5lu5dlczr3azgii2gyd.onionnexusma2iqgauqqvjcgds4ckv5xbf272tkfagq4epojjhsgleqpwxiqd.onionnexusabcd6tyfhdwilyitaqiri6tisj2v2hueyjuj6qkvd6azvi5tuqd.onionA whole operating system that lives on a USB stick, sends everything through Tor, and forgets the session the moment you power off. For this kind of use it is the strongest sensible option, and it takes about forty minutes to prepare once.
You boot from the stick rather than from the computer hard drive. The installed operating system is untouched and does not run. Everything the session does lives in memory, all network traffic goes through Tor whether the application asked for it or not, and when you shut down the memory is wiped. The machine you used has no record of the session.
Tails can keep an encrypted area on the stick for bookmarks and files across sessions. That is convenient and it is also the one thing that survives, so it is worth deciding deliberately. For most people a small persistent area holding nothing but the three addresses is a reasonable trade. Storing anything you would not want found is not.
Because the biggest practical risk on a desktop is not the network, it is the machine remembering. Tails removes that entire category of problem rather than managing it. That is a bigger improvement than any browser setting.
The full Windows route to a Nexus onion address, what the operating system keeps behind your back, and the settings worth changing before you start.
DesktopHow to get to a Nexus onion address on a Mac, the Gatekeeper prompts you will meet, and which macOS conveniences work against you here.
DesktopThe Linux route to a Nexus onion address, why the distribution package is usually the wrong choice, and what a sensible setup looks like.
Where to get Tor Browser, why the source matters more than the version, and the mistakes that put a modified copy on a machine.
The signature check that proves the file came from the Tor Project unmodified, why it is worth the ten minutes, and what a failure means.
Tor Browser ships on its most permissive setting. What the three levels change, why Safest is the right default here, and what breaks.