What the script changes

A practical privacy baseline for a new desktop.

PrivacyOS uses familiar Debian packages and documented configuration files. It is intentionally opinionated where a secure default matters, and optional where personal preference matters.

01 / Network

Encrypted DNS and a quiet firewall.

DNS-over-TLS is configured with Quad9 by default. UFW denies incoming connections and allows normal outbound desktop traffic.

  • • Quad9, OpenDNS, NextDNS, or no DNS override
  • • A background Tor proxy plus Tor Browser
  • • No services deliberately exposed to the network

02 / Browsing

Purposeful browser separation.

LibreWolf is the everyday default, hardened Firefox and Waterfox are available, Tor Browser remains isolated, and a bare Chromium is there for unavoidable compatibility use.

  • • Hardened preferences and sensible extensions
  • • URL cleaning and tracker blocking
  • • KeePassXC browser integration

03 / Daily use

Protection that survives the first day.

The install includes a maintained hosts blocklist, automatic security patches, a secure-delete action, and practical privacy utilities.

  • • StevenBlack hosts list, plus your own entries
  • • Security-only automatic updates
  • • KeePassXC, Wireshark, RiseupVPN, and more

04 / Maintenance

One update routine, no mystery state.

The included upgrade command updates packages, cleans old kernels, refreshes hosts blocking, and rebuilds browser hardening while preserving your personal overrides.

  • • Standard APT package management
  • • Local custom hosts and browser overrides preserved
  • • No proprietary updater or hosted dashboard

Important boundaries

PrivacyOS is not a promise of anonymity.

It improves a fresh Debian desktop's default privacy posture. It cannot protect an already-compromised device, undo data you share with websites, replace full-disk encryption, or guarantee safety against every threat.

Before you install

  1. 1. Start fresh. This script reconfigures software sources, browser profiles, and system settings.
  2. 2. Encrypt first. Enable full-disk encryption within the Debian installer; that choice must happen before PrivacyOS runs.
  3. 3. Read the script. Review the exact changes on GitHub and choose only the components you want.

Ready when you are

Make the choices once. Generate the command. Run it locally.

Build your install command →