Kicksecure - Secure by Default Operating System

Kicksecure ™

Download

On Computer USB Installation Intel / AMD64 ARM64 Raspberry Pi PPC64 Windows (VM) Mac Linux (VM) VirtualBox (VM) Qubes (VM) KVM (VM) Debian morph to Kicksecure More options Source Code

About

Overview Features Why Open Source? Project Activities Contributors Mission & Vision

Docs

Documentation FAQ Troubleshooting

Community

Forums Forum Best Practices Contribute

Support

Self Support First Policy Search Engines, Docs and AI Support (Limited) Reporting Bugs Contact (Restricted)

Tools Upload file Special pages Recent changes Print Version Page meta What links here Related changes Page information

Page Read Edit History Move Protection Unwatch Watch Delete Purge

User Preferences Watchlist Contributions Logout Create account Login

Donate

A secure by default operating system with the latest security research in place.

Security-Focused Operating System

Reasonably Secure ● Stable by Design ● Hardened Debian Linux

Download Now

Learn What Is Kicksecure?

FREE Download

Hardware

Hardware On Computer

Hardware On USB

Virtual Machine

VM Windows

VM MacOS

VM VirtualBox Linux installer

VM VirtualBox

VM Qubes

VM KVM

Other

Special Debian+

Special chroot

Special Source Code

ARM64

Raspberry Pi (RPi)

ppc64el (POWER9/10)

RISCV64

Wiki

FAQ

Features

Forum

News

Donate

Pre-installed applications are reviewed and configured for security

Thunderbird KeePassXC VLC Terminal Electrum Bitcoin Monero

Fully Featured with Advanced Security Components

Protection from Targeted Malicious Updates

Kicksecure update servers know neither the identity nor IP address of the user because all upgrades are downloaded over Tor.

Kicksecure update servers know neither the identity nor IP address of the user because all upgrades are downloaded over Tor by default.

Kernel Self Protection Settings

Kicksecure uses strong Kernel Hardening Settings as recommended by the Kernel Self Protection Project (KSPP).

Kicksecure uses strong Kernel Hardening Settings as recommended by the Kernel Self Protection Project (KSPP).

Time Attack Protection

Kicksecure protects its users from time attacks by implementing Boot Clock Randomization and secure network time synchronization using sdwdate.

Time attacks on Kicksecure users are defeated by Boot Clock Randomization and secure network time synchronization through sdwdate (Secure Distributed Web Date).

No Open Ports by Default

Kicksecure provides a much lower attack surface since there are no open server ports by default unlike in some other Linux distributions.

Kicksecure provides a much lower attack surface since there are no open server ports by default unlike other Linux distributions. All unsolicited incoming connections are rejected.

CPU Information Leak Protection (TCP ISN Randomization)

Without TCP ISN randomization, sensitive information about a system’s CPU activity can leak through outgoing traffic, exposing the system to side-channel attacks. Tirdad protects against this vulnerability.

Without TCP ISN randomization, patterns in outgoing traffic can reveal unique characteristics of a system’s CPU, compromising user security. TCP ISN randomization helps preserve security by masking these signals.

Available for many virtualizers

With support for multiple virtualization options, trying out Kicksecure is easy. VMs also help contain and prevent the spread of malware.

You can easily try Kicksecure by using various virtualizers , which enables security compartmentalization by running a Kicksecure VM on top of a Kicksecure host to isolate malware and testing inside the VM.

15 more amazing features →

Brute Force Defense

Kicksecure protects Linux user accounts against brute force attacks by using pam faillock.

Kicksecure protects Linux user accounts against brute force attacks by using pam faillock.

Entropy Enhancements

Strong entropy is required for computer security to ensure the unpredictability and randomness of cryptographic keys and other security-related processes. Kicksecure makes encryption more secure thanks to preinstalled random number generators.

Strong entropy is required for computer security to ensure the unpredictability and randomness of cryptographic keys and other security-related processes. Kicksecure makes encryption more secure thanks to preinstalled random number generators.

Live Mode

Booting into Live Mode is as simple as choosing Live Mode in the boot menu. After the session, all data will be gone.

Booting a VM into Live Mode is as simple as choosing Live Mode in the boot menu. After the session, all data will be gone.

Based on Linux

Linux is highly reliable, secure, free and Open Source. That's why Kicksecure is based on Linux.

Linux is highly reliable and secure. It is Open Source and freedom paradigm sets it apart from other OS. That's why Kicksecure is based on Linux.

Onion Website for Enhanced Connection Security

Our website offers an alternative onion service version. This offers a higher connection security between the user and the server.

Our website offers an alternative onion version which offers a higher connection security between the user and the server. This is because connections over onions are providing an alternative end-to-end encryption which is independent from flawed TLS certificate authorities and the mainstream Domain Name System (DNS).

Risk Minimization

AppArmor profiles restrict the capabilities of commonly used, high-risk applications.

AppArmor profiles restrict the capabilities of commonly used, high-risk applications such as Tor Browser.

Strong Linux User Account Separation

Linux User Account Separation is not always a given on Linux systems. In Kicksecure it is.

Learn more about our Linux User Account Separation .

Safer System Maintenance through User-Sysmaint-Split

Kicksecure boosts security by separating everyday use from system admin tasks. Two accounts are used by default—one for daily work, one for maintenance—limiting what harm malware could do.

Kicksecure increases safety by using separate accounts for daily use and admin tasks. This is called user-sysmaint-split. It prevents routine software—like a hacked browser—from gaining full system access or installing rootkits.

Safer Temporary Files with libpam-tmpdir

Kicksecure includes libpam-tmpdir to improve system security by isolating temporary files per user and tightening file permissions, reducing the risk of /tmp-based and symlink attacks.

To prevent /tmp-based attacks, Kicksecure uses libpam-tmpdir, which creates secure, per-user temporary folders and sets strict permissions. This blocks common threats like symlink exploits.

Hardening with Securing Debian Manual

Kicksecure applies key system hardening techniques from the Securing Debian Manual by default, and adds original research to boost the baseline security.

Kicksecure integrates many of the system hardening practices from the Securing Debian Manual to improve its security posture. Although Debian's manual is older, Kicksecure supplements it with its own research and publishes updated security guidance in its wiki, ensuring users benefit from both foundational and current best practices.

Comprehensive Security Documentation

Knowledge is a defense: Kicksecure offers extensive documentation to empower users with critical security information and best practices.

Knowledge is a defense: Explore Kicksecure's comprehensive documentation to strengthen your security posture and reduce vulnerabilities.

Virus Protection

Kicksecure provides additional security hardening measures and user education for better protection from virus attacks.

Kicksecure provides additional security hardening measures and user education to provide better protection from viruses / malware.

Console Lockdown

Legacy login methods can be a security risk. Console Lockdown disables them for improved security hardening.

Console Lockdown disables legacy login methods and thereby improves security hardening.

Home Folder Permission Lockdown

Kicksecure locks down user home folders by default, preventing one user from viewing another's files. This adds an extra layer of privacy and security.

Kicksecure enforces strict file permission settings in /home, automatically removing read, write, and execute access for others during setup or account creation. This prevents users from accessing each other's files and corrects unsafe permissions that may exist from earlier configurations. The approach aligns with hardening principles from the Securing Debian Manual.

Umask Hardening for Safer File Permissions

Kicksecure improves file security by setting a stricter default umask for non-root accounts, so new files aren’t readable by others unless explicitly allowed.

To reduce the risk of unintended file exposure, Kicksecure sets a stricter default umask for non-root accounts so that new files are inaccessible to other accounts by default. This enhances security beyond the /home folder, especially in shared areas like folder /var.

Based on Debian

Kicksecure is based on Debian, one of the most reliable Linux distributions.

In oversimplified terms, Kicksecure is just a collection of configuration files and scripts. Kicksecure is not a stripped down version of Debian; anything possible in "vanilla" Debian GNU/Linux can be replicated in Kicksecure. About Kicksecure

Digitally signed releases

Downloads are signed so genuine Kicksecure releases can be verified.

Downloads are signed so genuine Kicksecure releases can be verified.

Warrant Canary

A canary confirms that no warrants have ever been served on the Kicksecure project.

A canary confirms that no warrants have ever been served on the Kicksecure project.

Swap File Creator

Running low on RAM isn't a security problem with swap-file-creator. It will create an encrypted swap file.

Running low on RAM isn't a security problem. swap-file-creator will create an encrypted swap file.

SUID Disabler and Permission Hardener

SUID Disabler and Permission Hardener enhances system security by strengthening the isolation of Linux user accounts and more.

The purpose of SUID Disabler and Permission Hardener is to enhance system security. It does this by strengthening the isolation of Linux user accounts, implementing stricter file permission settings, and decreasing potential security vulnerabilities by turning off SUID-enabled binaries.

Digital Signature Policy

Signed git commits, tags, and images are required. Unsigned code is strictly prohibited in builds and deployments. Documentation encourages digital signature verification.

Checking digital signatures helps protect users from harmful software (malware or viruses). It proves the software is real, hasn't been tampered with, and keeps users safer. The Kicksecure Digital Signature Policy requires signed git commits, tags, and images. Unsigned code is strictly prohibited in builds and deployments. Documentation encourages digital signature verification.

Freedom Values

Open Source

We respect user rights to review, scrutinize, modify, and redistribute Kicksecure. This improves security and privacy for everyone.

All the Kicksecure source code is licensed under OSI Approved Licenses. We respect user rights to review, scrutinize, modify, and redistribute Kicksecure. This improves security and privacy for everyone.

Freedom Software

Kicksecure is Freedom Software and contains software developed by the Free Software Foundation and the GNU Project.

Kicksecure is Freedom Software and contains software developed by the Free Software Foundation and the GNU Project.

Research and Implementation Project

Kicksecure is an actively maintained research project making constant improvements; no shortcomings are ever hidden from users.

Research and Implementation Project: Kicksecure makes modest claims and is wary of overconfidence. Kicksecure is an actively maintained research project making constant improvements; no shortcomings are ever hidden from users.

Fully Auditable

Kicksecure is independently verifiable by security experts and software developers around the world. This improves security and privacy for everyone.

Kicksecure is independently verifiable by security experts and software developers around the world; you don’t have to trust developer claims. This improves security and privacy for everyone.

Complete respect for privacy and user freedom

Kicksecure respects data privacy principles. We don’t make advertising deals or collect sensitive personal data.

Kicksecure respects data privacy principles. We don’t make advertising deals or collect sensitive personal data. There are no artificial restrictions imposed on possible system configurations .

Upcoming Security Enhancements

Ram Wipe

ram-wipe is a software project designed to protect against RAM extraction attacks by erasing the contents of a computer's random access memory (RAM) when the system is shut down or restarted.

TODO modal text

Ram Wipe

USBGuard attempts to mitigate a limited subset of USB hardware attacks by rejecting most USB devices that are plugged in after bootup.

TODO modal text

Sandbox App Launcher

sandbox-app-launcher is an application launcher that can start each application inside its own restrictive sandbox. Each application runs as its own user, in a bubblewrap sandbox and confined by AppArmor.

TODO modal text

8 more Enhancements →

Apparmor.d

apparmor.d - Full system Mandatory Access Control (MAC) policy - "AppArmor for everything"

TODO modal text

Deactivate malware after reboot

Deactivate malware after reboot from non-root compromise

TODO modal text

Hardened Linux Kernel

Hardened Linux Kernel

TODO modal text

Limit Kernel Information Leaks

Limit Kernel Information Leaks

TODO modal text

Hide Other Users' Processes

Hide Other Users' Processes for Better Isolation

TODO modal text

Enhanced Security via Mount Options (noexec)

Enhanced Security via Mount Options (noexec)

TODO modal text

Limit Compiler and Interpreter Access

Limit Compiler and Interpreter Access

TODO modal text

Post-quantum cryptography resistant signing of releases

Post-quantum cryptography resistant signing of releases

TODO modal text

Join the team!

Your help is very welcome! As a patron, as a multiplier or even as a contributor!

Kicksecure A secure by default operating system with the latest security research in place.

Dark mode

Follow us on social media

Supported by Power Up Privacy

Kicksecure is proudly supported until 2026 by Power Up Privacy, a privacy advocacy group that seeks to supercharge privacy projects with resources so they can complete their mission of making our world a better place. (Strictly subject to our sponsorship policy.)

At Kicksecure we value freedom and trust, supporting Open Source and Freedom Software

By using this website, you acknowledge you have read, understood, and agree to be bound by these agreements: Terms of Service, Privacy Policy, Cookie Policy, E-Sign Consent, DMCA, Imprint 2012- 2025 ENCRYPTED SUPPORT LLC

Your support makes
all the difference!

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 13 year success story and maybe DONATE!