## Overview

This guide walks through flashing Superbacked OS to a USB drive and booting from dedicated hardware. Superbacked OS prevents data exfiltration and data persistence by running offline and persisting nothing to disk.

## Requirements

- Computer [compatible](https://ubuntu.com/download/desktop) with Ubuntu 24.04.3 LTS
- USB flash drive (used to run Superbacked OS, 16GB min, faster is better)
- [Brother HL-L2460DW](https://www.brother-usa.com/products/hll2460dw) or equivalent USB printer (used to print blocks)
- Plug-and-play or built-in webcam (1080p min)

## Recommendations (optional)

Physically removing internal disk(s) and wireless interface(s) if not soldered to motherboard or disabling interface(s) using BIOS if soldered is recommended to disable data persistence and network connectivity at the hardware level.

Running Superbacked OS on flash drive with signed firmware and write protection enabled such as [Kanguru FlashTrust™ Secure Firmware USB 3.0 Flash Drive (WP-KFT3-16G)](https://www.kanguru.com/products/kanguru-flashtrust-secure-firmware-usb-3-0-flash-drive) is recommended.

## Setup guide

### Step 1: install [Raspberry Pi Imager](https://www.raspberrypi.com/software/)

#### macOS or Windows

Go to https://www.raspberrypi.com/software/, download and install Raspberry Pi Imager.

#### Ubuntu

> Heads-up: depends on [Qt](https://www.qt.io/).

```console
$ sudo add-apt-repository --yes universe

$ sudo apt install --yes rpi-imager
```

### Step 2 (optional): opt out of Raspberry Pi Imager [telemetry](https://github.com/raspberrypi/rpi-imager#opting-out)

Select “App Options”, disable “Enable anonymous statistics (telemetry) collection” and click “Save”.

### Step 3: download Superbacked OS

> Heads-up: for additional security, [verify integrity of release](https://superbacked.com/guides/how-to-verify-integrity-of-release).

#### macOS or Ubuntu

```console
$ cd ~/Downloads

$ for number in $(seq 1 2); do curl --fail --location "https://github.com/superbacked/superbacked/releases/download/v${latestRelease}/superbacked-os-amd64-${latestRelease}.img.xz.part$number" || break; done | cat > superbacked-os-amd64-${latestRelease}.img.xz
```

#### Windows

> Heads-up: requires WSL to be [installed](https://learn.microsoft.com/en-us/windows/wsl/install) first using `wsl --install` (if applicable).

> Heads-up: replace `Sun Knudsen` with your username.

```console
$ wsl

$ cd /mnt/c/Users/Sun\ Knudsen/Downloads

$ for number in $(seq 1 2); do curl --fail --location "https://github.com/superbacked/superbacked/releases/download/v${latestRelease}/superbacked-os-amd64-${latestRelease}.img.xz.part$number" || break; done | cat > superbacked-os-amd64-${latestRelease}.img.xz
```

### Step 4: copy Superbacked OS to USB flash drive

Open “Raspberry Pi Imager”, click “OS”, then “Use custom”, select `superbacked-os-amd64-${latestRelease}.img.xz`, click “Storage”, select USB flash drive, click “NEXT”, then “WRITE” and, finally, click “I UNDERSTAND, ERASE AND WRITE”.

![Raspberry Pi Imager, release semver may differ](./assets/raspberry-pi-imager.png)

### Step 5 (optional): enable write protection

If using Kanguru FlashTrust™ Secure Firmware USB 3.0 Flash Drive or equivalent, enable write protection.

## Computer provisioning guide

### Step 1 (optional): physically remove internal disk(s) and wireless interface(s) if not soldered to motherboard or disable interface(s) using BIOS if soldered

![I/O Port Access, BIOS menu may differ](./assets/turn-off-i-o-port-access.jpg)

### Step 2 (if applicable): enable “Secure Boot” and disable “Boot Order Lock”

![Secure Boot, BIOS menu may differ](./assets/enable-secure-boot.jpg)

![Boot Order Lock, BIOS menu may differ](./assets/disable-boot-order-lock.jpg)

### Step 3: boot Superbacked OS

### Step 4: reboot

### Step 5 (if applicable): enable “Boot Order Lock”

![Boot Order Lock, BIOS menu may differ](./assets/enable-boot-order-lock.jpg)

## Usage guide

### Step 1 (if applicable): unplug Ethernet cable

### Step 2: boot Superbacked OS

> Heads-up: password is “superbacked”.

Boot Superbacked OS using “Advanced options for Ubuntu” and “Ubuntu, with Linux 6.14.0-37-generic” (required when using write-protected hardware).

If scanning blocks does not work, please try using a higher quality 1080p webcam such as the [Razer Kiyo X](https://www.razer.com/streaming-cameras/razer-kiyo-x).


## Overview

This guide walks through flashing Superbacked OS to a microSD card or USB drive and booting on Raspberry Pi. Superbacked OS prevents data exfiltration and data persistence by running offline and persisting nothing to disk.

## Requirements

- Raspberry Pi [4](https://www.raspberrypi.com/products/raspberry-pi-4-model-b/) or [5](https://www.raspberrypi.com/products/raspberry-pi-5/) (at least 4GB of RAM, 8GB or more recommended)
- Raspberry Pi [15W USB-C Power Supply](https://www.raspberrypi.com/products/type-c-power-supply/) (Pi 4) or [27W USB-C Power Supply](https://www.raspberrypi.com/products/27w-power-supply/) (Pi 5)
- Raspberry Pi [keyboard](https://www.raspberrypi.com/products/raspberry-pi-keyboard-and-hub/) and [mouse](https://www.raspberrypi.com/products/raspberry-pi-mouse/) (or equivalent)
- Raspberry Pi [Micro HDMI to Standard HDMI (A/M) Cable](https://www.raspberrypi.com/products/micro-hdmi-to-standard-hdmi-a-cable/) (or equivalent)
- HDMI display (1080p min)
- microSD card or USB flash drive (used to run Superbacked OS, 16GB min, faster is better)
- [Brother HL-L2460DW](https://www.brother-usa.com/products/hll2460dw) or equivalent USB printer (used to print blocks)
- Plug-and-play webcam with USB-A connector (1080p min)

## Recommendations (optional)

Running Superbacked OS on flash drive with signed firmware and write protection enabled such as [Kanguru FlashTrust™ Secure Firmware USB 3.0 Flash Drive (WP-KFT3-16G)](https://www.kanguru.com/products/kanguru-flashtrust-secure-firmware-usb-3-0-flash-drive) is recommended.

## Setup guide

### Step 1: install [Raspberry Pi Imager](https://www.raspberrypi.com/software/)

#### macOS or Windows

Go to https://www.raspberrypi.com/software/, download and install Raspberry Pi Imager.

#### Ubuntu

> Heads-up: depends on [Qt](https://www.qt.io/).

```console
$ sudo add-apt-repository --yes universe

$ sudo apt install --yes rpi-imager
```

### Step 2 (optional): opt out of Raspberry Pi Imager [telemetry](https://github.com/raspberrypi/rpi-imager#opting-out)

Select “App Options”, disable “Enable anonymous statistics (telemetry) collection” and click “Save”.

### Step 3: download Superbacked OS

> Heads-up: for additional security, [verify integrity of release](https://superbacked.com/guides/how-to-verify-integrity-of-release).

#### macOS or Ubuntu

```console
$ cd ~/Downloads

$ for number in $(seq 1 2); do curl --fail --location "https://github.com/superbacked/superbacked/releases/download/v${latestRelease}/superbacked-os-arm64-raspi-${latestRelease}.img.xz.part$number" || break; done | cat > superbacked-os-arm64-raspi-${latestRelease}.img.xz
```

#### Windows

> Heads-up: requires WSL to be [installed](https://learn.microsoft.com/en-us/windows/wsl/install) first using `wsl --install` (if applicable).

> Heads-up: replace `Sun Knudsen` with your username.

```console
$ wsl

$ cd /mnt/c/Users/Sun\ Knudsen/Downloads

$ for number in $(seq 1 2); do curl --fail --location "https://github.com/superbacked/superbacked/releases/download/v${latestRelease}/superbacked-os-arm64-raspi-${latestRelease}.img.xz.part$number" || break; done | cat > superbacked-os-arm64-raspi-${latestRelease}.img.xz
```

### Step 4: copy Superbacked OS to microSD or USB flash drive

Open “Raspberry Pi Imager”, click “OS”, then “Use custom”, select `superbacked-os-amd64-${latestRelease}.img.xz`, click “Storage”, select microSD or USB flash drive, click “NEXT”, then “WRITE” and, finally, click “I UNDERSTAND, ERASE AND WRITE”.

![Raspberry Pi Imager, release semver may differ](./assets/raspberry-pi-imager.png)

### Step 5 (optional): enable write protection

If using Kanguru FlashTrust™ Secure Firmware USB 3.0 Flash Drive or equivalent, enable write protection.

## Usage guide

### Step 1 (if applicable): unplug Ethernet cable

### Step 2: boot Superbacked OS

> Heads-up: password is “superbacked”.

If scanning blocks does not work, please try using a higher quality 1080p webcam such as the [Razer Kiyo X](https://www.razer.com/streaming-cameras/razer-kiyo-x).


## Overview

> Heads-up: factory resetting Mac erases all data. Back up anything important before proceeding.

> Heads-up: for high-stakes secrets, use [Superbacked OS](https://superbacked.com/superbacked-os) — a hardened operating system that runs offline and persists nothing to disk.

This guide walks through factory resetting an Apple silicon Mac, downloading Superbacked, going offline and factory resetting Mac again after use.

Disconnecting from the internet prevents data exfiltration and factory resetting after use prevents data persistence.

Guide below is for macOS Sequoia — exact steps may differ for Tahoe.

## Requirements

- Apple silicon MacBook Air or MacBook Pro (M1 or later) running macOS Sequoia or Tahoe
- Ethernet cable and USB-C to Ethernet adapter (preferred) or Wi-Fi network (used to download Superbacked, disconnected before using Superbacked)
- [Brother HL-L2460DW](https://www.brother-usa.com/products/hll2460dw) or equivalent USB printer (used to print blocks)

## Guide

### Step 1: factory reset Mac

Open “System Settings”, click “General”, click “Transfer or Reset” and click “Erase All Content and Settings”. Follow prompts to complete factory reset.

Mac will restart into Setup Assistant.

### Step 2: set up macOS

> Heads-up: if familiar with macOS hardening, connect to the internet, skip Apple ID, disable location services, analytics, Siri and Apple Intelligence, then continue to [step 3](#step-3-download-superbacked).

On “Activate Mac” connect Ethernet cable or connect to Wi-Fi network and click “Next” then “Restart”.

On “Language” select language and click right arrow.

On “Select Your Country or Region” select country.

On “Transfer Your Data to This Mac” select “Set up as new”.

On “Written and Spoken Languages” click “Continue”.

On “Accessibility” select “Not Now”.

On “Select Your Wi-Fi Network” connect Ethernet cable and click “Continue” or select Wi-Fi network, enter password and click “Continue”.

On “Data & Privacy” click “Continue”.

On “Create a Mac Account” enter full name and password, disable “Allow computer account password to be reset with your Apple Account” and click “Continue”.

On “Sign In to Your Apple Account” click “Set Up Later” then “Skip”.

On “Terms and Conditions” click “Agree” then “Agree” again.

On “Enable Location Services” disable “Enable Location Services on this Mac” and click “Don’t Use”.

On “Select Your Time Zone” type closest city and click “Continue”.

On “Analytics” disable “Share Mac Analytics with Apple” and “Share crash and usage data with app developers” and click “Continue”.

On “Screen Time” click “Set Up Later”.

On “Apple Intelligence” click “Set Up Later”.

On “Siri” disable “Enable Ask Siri” and click “Continue”.

On “Touch ID” click “Set Up Touch ID Later” then “Continue”.

On “Choose Your Look” select “Dark” and click “Continue”.

On “Update Mac Automatically” select “Only Download Automatically”.

On “Welcome to Mac” click “Continue”.

### Step 3: download Superbacked

Open Safari and download latest release from [superbacked.com/download](https://superbacked.com/download) and optionally [verify integrity of release](https://superbacked.com/guides/how-to-verify-integrity-of-release).

### Step 4: disconnect from the internet

If using Ethernet, unplug Ethernet cable.

If using Wi-Fi, open “System Settings”, click “Wi-Fi”, click ellipsis menu of connected network and click “Forget This Network”. Disable Wi-Fi using toggle.

Mac is now offline — secrets can be handled safely.

### Step 5: install and run Superbacked

> Heads-up: macOS may display a security prompt. Click “Open” to proceed — release is cryptographically signed and notarized by Apple.

Double-click downloaded `.dmg` file, drag “Superbacked” to “Applications” folder, open “Applications” folder and double-click “Superbacked”.

### Step 6: connect printer

Connect USB printer to Mac. macOS should detect printer automatically via AirPrint — no driver installation required.

### Step 7: use Superbacked

Create blocks, blocksets or standalone archives as needed. For detailed instructions, see [overview](https://superbacked.com/overview) and [use cases](https://superbacked.com/use-cases).

### Step 8: factory reset Mac

> Heads-up: do not skip this step. Even though Superbacked does not persist secrets to disk intentionally, macOS may cache data in CUPS print spool files, swap files or other system-managed locations.

Complete [step 1](#step-1-factory-reset-mac) again.


## Overview

> Heads-up: Tails has limited printing support. Printing blocks may not work as expected depending on printer configuration. Consider saving blocks as JPEG or PDF and printing from another computer. For high-stakes secrets, consider using [Superbacked OS](https://superbacked.com/superbacked-os) — a hardened operating system that runs offline, persists nothing to disk and has built-in printing support.

This guide walks through downloading and running Superbacked on Tails. Superbacked is distributed as AppImage binary — a portable format that runs on Tails with no installation.

## Guide

### Step 1: download Superbacked

Download latest release from [superbacked.com/download](https://superbacked.com/download) and optionally [verify integrity of release](https://superbacked.com/guides/how-to-verify-integrity-of-release).

### Step 2: run AppImage

Right-click `.AppImage` file and select “Run”.


## Overview

This guide walks through installing dependencies and running Superbacked on Ubuntu Desktop. Superbacked is distributed as AppImage binary — a portable format that requires two dependencies and AppArmor may need to be configured.

## Setup guide

### Step 1: install dependencies

```console
$ sudo apt install --yes libfuse2 zlib1g-dev
```

### Step 2: download Superbacked

Download latest release from [superbacked.com/download](https://superbacked.com/download) and optionally [verify integrity of release](https://superbacked.com/guides/how-to-verify-integrity-of-release).

## Usage guide

> Heads-up: Ubuntu Desktop 24.04+ ships with AppArmor enabled by default which may prevent Superbacked from launching. If Superbacked does not start, run from terminal with `--no-sandbox` flag. This disables Chromium sandbox used by Electron — AppArmor already provides equivalent process isolation at OS level so this does not reduce security.

Right-click `.AppImage` file and select “Run as a program”.


## Overview

This guide walks through verifying that Superbacked OS persists nothing to disk by comparing partition checksums before and after use.

## Guide

### macOS

#### Step 1 (if computing checksum of Superbacked OS for Raspberry Pi): disable automatic mounting of `/Volumes/system-boot`

```console
$ volume_path="/Volumes/system-boot"

$ volume_uuid=$(diskutil info "$volume_path" | awk '/Volume UUID:/ { print $3 }')

$ echo "UUID=$volume_uuid none auto ro,noauto" | sudo tee -a /etc/fstab
UUID=C6651C15-1754-301D-B9DB-76371B6FE869 none auto ro,noauto
```

#### Step 2: compute disk checksum

> Heads-up: replace `rdisk4` with disk found using `diskutil list`.

```console
$ diskutil list
…

/dev/disk4 (external, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:     FDisk_partition_scheme                        *15.5 GB    disk4
   1:                       0xEF                         536.9 MB   disk4s1
   2:                      Linux                         10.7 GB    disk4s2
                    (free space)                         4.2 GB     -

$ sudo diskutil unmountDisk /dev/disk4
Password:
Unmount of all volumes on disk4 was successful

$ sudo sha256sum /dev/rdisk4s1 /dev/rdisk4s2
4bdf74fabaeb4bdbd493b99159f743702c1f2eb11975d44c186d513522cb68be  /dev/rdisk4s1
bc9c0448061b7449a31fb25e001871166c53e0514872ba16e8139c1a60f0984d  /dev/rdisk4s2

$ cat superbacked-os-amd64-1.10.0.img.sha256sums
Boot partition: 4bdf74fabaeb4bdbd493b99159f743702c1f2eb11975d44c186d513522cb68be
Root partition: bc9c0448061b7449a31fb25e001871166c53e0514872ba16e8139c1a60f0984d
```

### Ubuntu

> Heads-up: replace `sdb` with disk found using `sudo fdisk --list`.

```console
$ sudo fdisk --list
…
Disk /dev/sdb: 14.44 GiB, 15502147584 bytes, 30277632 sectors
Disk model: FlashTrust
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0xefc52f4f

Device     Boot   Start      End  Sectors  Size Id Type
/dev/sdb1  *       2048  1050623  1048576  512M ef EFI (FAT-12/16/32)
/dev/sdb2       1050624 22022143 20971520   10G 83 Linux

$ sudo umount /dev/sdb*
umount: /dev/sdb: not mounted.
umount: /dev/sdb1: not mounted.
umount: /dev/sdb2: not mounted.

$ sudo sha256sum /dev/sdb1 /dev/sdb2
4bdf74fabaeb4bdbd493b99159f743702c1f2eb11975d44c186d513522cb68be  /dev/sdb1
bc9c0448061b7449a31fb25e001871166c53e0514872ba16e8139c1a60f0984d  /dev/sdb2

$ cat superbacked-os-amd64-1.10.0.img.sha256sums
Boot partition: 4bdf74fabaeb4bdbd493b99159f743702c1f2eb11975d44c186d513522cb68be
Root partition: bc9c0448061b7449a31fb25e001871166c53e0514872ba16e8139c1a60f0984d
```


## Overview

This guide walks through verifying that a downloaded Superbacked release has not been tampered with using SHA256 checksums and PGP signatures.

## Guide

### Step 1: download release’s `SHA256SUMS` and `SHA256SUMS.asc`

Download `SHA256SUMS` and `SHA256SUMS.asc` from the [release page](https://github.com/superbacked/superbacked/releases) to the same folder as the app.

```console
$ ls
SHA256SUMS
SHA256SUMS.asc
superbacked-arm64-1.9.0.dmg
```

### Step 2 (optional): verify integrity of `SHA256SUMS` using GnuPG

> Heads-up: integrity of Sun’s PGP public key can be confirmed using fingerprint published on [sunknudsen.com/contact](https://sunknudsen.com/contact), [GitHub](https://github.com/sunknudsen/pgp-public-key), [Twitter](https://twitter.com/sunknudsen) and [YouTube](https://www.youtube.com/sunknudsen/about).

> Heads-up: “1 signature not checked due to a missing key” warning can be ignored as it refers to Sun’s [legacy](https://github.com/sunknudsen/pgp-public-key/tree/master/legacy) PGP public key.

Import Sun’s PGP public key and verify the signature.

```console
$ curl https://sunknudsen.com/sunknudsen.asc | gpg --import
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  2070  100  2070    0     0   6044      0 --:--:-- --:--:-- --:--:--  6160
gpg: key 0x8C9CA674C47CA060: 1 signature not checked due to a missing key
gpg: key 0x8C9CA674C47CA060: public key "Sun Knudsen <hello@sunknudsen.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: no ultimately trusted keys found

$ gpg --verify SHA256SUMS.asc
gpg: assuming signed data in 'SHA256SUMS'
gpg: Signature made Thu 18 Dec 06:40:08 2025 EST
gpg:                using EDDSA key 9C7887E1B5FCBCE2DFED0E1C02C43AD072D57783
gpg: Good signature from "Sun Knudsen <hello@sunknudsen.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: E786 274B C92B 47C2 3C1C  F44B 8C9C A674 C47C A060
     Subkey fingerprint: 9C78 87E1 B5FC BCE2 DFED  0E1C 02C4 3AD0 72D5 7783
```

Verify the output shows `Good signature from "Sun Knudsen <hello@sunknudsen.com>"` and the primary key fingerprint matches `E786 274B C92B 47C2 3C1C F44B 8C9C A674 C47C A060`.

### Step 3: verify integrity of release

```console
$ shasum --algorithm 256 --check --ignore-missing SHA256SUMS
./superbacked-arm64-1.9.0.dmg: OK
```

Verify the output shows `OK` for the downloaded release.


Master Superbacked