Superbacked OS is a hardened operating system built on Ubuntu Desktop that runs air-gapped by default and entirely from memory, persisting nothing to disk.
Air-gapped by default, nothing kept on disk and hardened layer upon layer — no single safeguard is relied on alone.
Networking is removed at the root, firewall blocks all traffic and apps that handle secrets are denied network access on their own. Every app is allowed only what it needs, nothing updates itself or phones home and administrator rights are disabled. When a safe path is unavailable, Superbacked OS fails closed.
Superbacked OS is copied to memory at boot, so USB flash drive can be unplugged as soon as login screen appears. Internal disks stay hidden, so nothing can be saved to them by accident. At shutdown, everything from the session is gone — documents and print files included — and memory is wiped as soon as it is released.
How each layer works — and its limits — is spelled out in the Superbacked OS security model.
Some tasks — such as backing up TOTP secrets — need a browser. Hardened browser mode is chosen deliberately when device starts and can never be switched on mid-session.
Firefox is the only app allowed online. It runs under its own restricted account on its own display and cannot reach your files, camera, microphone or the apps that handle secrets. Security keys are the one device it can access, so signing in with one works while a YubiKey’s other interfaces stay out of reach.
Settings are locked by policy and cannot be changed from inside browser: always-private browsing, strict tracking protection, HTTPS only, encrypted DNS, everything cleared on shutdown, WebRTC off and no telemetry, accounts, password saving or autofill — camera and microphone are locked out at the browser level as well.
No exotic hardware required — a spare laptop can serve as a dedicated device. Flash a USB flash drive, boot and start creating blocks.
64-bit Intel or AMD desktop or laptop with 4 GB of memory or more — 8 GB to run entirely from memory and unplug USB flash drive. Boots from USB flash drive with Secure Boot left on.
See guide →Brother HL-L2460DW or equivalent USB printer — works out of box, no driver installation required.
Built-in or plug-and-play webcam, 1080p minimum — used to scan blocks.
Superbacked OS bundles hand-picked apps and command-line utilities for managing signing devices and security keys.
Command-line tool for managing Trezor signing devices — initialize, recover and manage wallets, with guided trezor-setup and trezor-recover helpers.
See trezorctl on GitHub →App for managing YubiKey TOTP secrets, passkeys, certificates and slots — two-factor codes are read straight off key over USB, fully offline.
See Yubico Authenticator on GitHub →Command-line tool for managing YubiKey applications and slots — configure FIDO, PIV, OpenPGP and OTP, with smart card readers supported.
See ykman on GitHub →Command-line tool for generating PGP master keys and provisioning subkeys to YubiKeys — guided step by step, with only subkeys ending up on the YubiKey.
See yubikey-prov on GitHub →Superbacked’s own command-line interface is ready in terminal too — encrypt files, provision YubiKeys and derive passwords and Bitcoin wallets without leaving the air gap.
Copyright (c) Superbacked, Inc.