Open source · GPLv3 · Reproducible builds

Take a Tails image. Shape it. Prove it stayed honest.

DTails takes a base Debian Live image, lets you add or remove carefully curated tools, and builds a new image you can independently verify — no hidden network calls, no opaque steps, just explicit scripts and logs.

Download

View on GitHub

⚠ Highly recommended: verify the file signature before using the image — see how.

Only Open Source software Bit-for-bit reproducible Live USB DTailsOS · a Tails fork

Terminal

cat DTails-amd64-7.10.1.img.manifest.txt

DTails-amd64-7.10.1 build manifest
  base image : tails-amd64-7.10.1.img
  base sha256: b0a5f45e79221abe2c34f6e03f0cbf6b15af5e1df7c2e60cbf5c9af7586beb6f
  output     : DTails-amd64-7.10.1.img  (2258.0 MiB)
  sha256     : f37c4ae7765844031d1f28475a4391975e145b9ac25a540bbef56a2a6efaf375
  flashed to : /dev/sda
  build epoch: 1231006505 (SOURCE_DATE_EPOCH — reproducible)

  Installed (13):
    + BIP39 (iancoleman) offline  v0.5.4
    + Bitcoin Core  v31.1
    + Border Wallets (offline)  v1.0.5
    + Hodl Hodl (web launcher)  v1.0
    + Iris.to (web launcher)  v1.0
    + Liana Wallet  v14.0
    + Mempool.space (web launcher)  v1.0
    + Rana (Nostr pubkeys mining)  v0.5.5
    + RoboSats (web launcher)  v1.0
    + Seedtool (offline)  v2.2.0
    + Snort (web launcher)  v1.0
    + Sparrow Wallet  v2.5.2
    + Specter Desktop  v2.1.10
  Removed (2):
    - GIMP
    - Thunderbird

  Reproducible: the same base image + same selection rebuilds to the
  same SHA256. Share this manifest so others can verify the hash.

License: Open Source - GPLv3
Base: Debian Live / Tails
Trust: You can always verify each internal file and compare hashes
Persistent Storage: No persistent storage is required to run

Curated software, organized by category

Pick what goes into your image — nothing is bundled unless you choose it, and every entry has a pinned version.

Bitcoin

Bitcoin Core & Bitcoin Knots
Sparrow Wallet, Specter Desktop
Bisq, Liana Wallet
Hodl Hodl, RoboSats (web launchers)
BIP39, Seedtool, Border Wallets (offline)

Nostr

Rana — Nostr pubkey mining
Snort (web launcher)
Iris.to (web launcher)

Monero

Feather Wallet
Cake Wallet

Communication

Briar (desktop)
SimpleX Chat (desktop)

Reproducibility

DTails aims for bit-for-bit reproducible images: the same base image and the same software selection should produce the same output hash on any machine.

Verifying a build

Build the same image twice and compare the hash — the two runs must match.

sha256sum DTails.img # or DTails.iso

The build manifest

Every build also writes a DTails.img.manifest.txt alongside the image — share it so others can confirm they get the same hash from the same selection.

File-level comparison

The Compare Images dialog in the GUI mounts two inputs, unsquashes them, and reports any differing or missing files — useful when you want to know exactly what changed, not just whether the hash matches.

Verifying a flashed device

Compare Images also accepts a device directly (e.g. /dev/sdb), mounted read-only so verification never alters it. For a raw byte check of a dd-flashed device against the source image:

sz=$(stat -c%s DTails.img)
sudo cmp -n "$sz" DTails.img /dev/sdX && echo "device matches image"

Get started

Four steps from a base image to a verified, flashed device.

Package requirements

sudo apt install rsync squashfs-tools xorriso genisoimage syslinux-utils dosfstools mtools parted gdisk build-essential python3-pyqt5 gpg

Clone & run

git clone https://github.com/DesobedienteTecnologico/dtails
cd dtails
python3 dtails.py

Select the image file

Point DTails at your base Tails/Debian Live image or download directly from the GUI.

Select a storage device

Optional — skip it to just build an image file on disk.

Add or remove packages

Versions can be edited by hand if you want something newer or older.

Monitor the live log

You'll be asked for your sudo password in the terminal during the build. No hidden calls.

Verify releases

Check anything signed by the project against this key before you trust it.

Check your download in the browser

Pick the .img file you downloaded. Your browser hashes it locally with SHA-256 and compares it to the hash published for this release — the file never leaves your computer or gets uploaded anywhere. This only proves the file wasn't corrupted or tampered with in transit; it does not prove it came from us. For that, verify the GPG signature below.

Choose .img file…

Verifying release signatures

Each release ships a detached GPG signature. Import the project's public key below, then verify the image and its manifest against their .asc files:

gpg --import dtails-pubkey.asc
gpg --verify DTails-amd64-[version].img.asc DTails-amd64-[version].img
gpg --verify DTails-amd64-[version].img.manifest.txt.asc DTails-amd64-[version].img.manifest.txt

Fingerprint

86E32C4CE645DE81DD0F31E24559764E14109E7F

64-bit

4559 764E 1410 9E7F

View the signed key announcement on Nostr ↗