Older guides, including the previous version of this one, tell you to install Tor Browser on Ubuntu with the Flatpak ID com.github.nickvergessen.TorBrowser. That app no longer exists on Flathub, so the command stops with “Nothing matches”. Three methods do work on Ubuntu, Debian and Linux Mint: the Tor Project’s launcher from Flathub, the official tarball checked against its GPG signature, and the torbrowser-launcher package from your distro’s own repository.
You’ll get each method with the output it printed, plus the ARM64 build, the redesigned settings and the one service the apt package quietly starts. Mint 22 pulls its packages from the Ubuntu 24.04 archive, so its results also apply to 24.04 desktops. Every command below was run across Ubuntu 26.04, Debian 13 and Linux Mint 22.3 VMs in October 2026 against Tor Browser 16.0.
Pick an install method
All three methods end with the same browser, because the launcher downloads the same signed tarball you would fetch by hand. What differs is who checks the signature, where the files live and whether anything else lands on the system. On every x86_64 VM, all three methods fetched the current release, and the table shows the launcher version each one used:
| Method | Ubuntu 26.04 | Debian 13 | Mint 22.3 (24.04 base) | ARM64 |
|---|---|---|---|---|
| Flathub launcher | 0.3.9 | 0.3.9 | 0.3.9 (needs sudo) | No, x86_64 only |
| Official tarball + GPG | Works | Works | Works | Yes, aarch64 tarball (untested here) |
apt torbrowser-launcher | 0.3.9-1build1 (universe) | 0.3.7-3 (contrib) | 0.3.7-1ubuntu1 (universe) | No, not packaged for arm64 |
Use the tarball if you want to see the signature check yourself or you’re on an ARM64 machine, because it is the only method with an aarch64 build. Pick the Flatpak if you already run Flathub apps and want the browser sandboxed away from your home directory (the Snap vs Flatpak vs AppImage comparison covers what that sandbox does and doesn’t isolate). The apt package is the quickest, but with default settings it also installed and started a system tor daemon that Tor Browser never uses, so the launcher section installs it with --no-install-recommends.
Install Tor Browser with Flatpak
The Flathub app is org.torproject.torbrowser-launcher, published by the Tor Project and verified on Flathub. It is the launcher, not the browser: on first run it downloads Tor Browser into the sandbox and checks the signature for you. Ubuntu and Debian need Flatpak and the Flathub remote first, while Linux Mint ships both already. If Flatpak is new to you, the Flatpak management guide covers remotes, updates and permissions in more depth.
sudo apt update
sudo apt install -y flatpak
sudo flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepoInstall the launcher system-wide. The sudo matters on Mint: run without it over SSH, or anywhere with no password prompt, and Flatpak refuses with “system operation Deploy not allowed for user” (the troubleshooting section has the full error).
sudo flatpak install -y flathub org.torproject.torbrowser-launcherOn our Ubuntu 26.04 VM the download took 82 seconds, because it pulls the KDE runtime alongside the app and lands at about 294 MB installed. Confirm what landed.
flatpak list --app --columns=application,version,branch,installationOne app, launcher version 0.3.9, from the stable branch in the system installation:
org.torproject.torbrowser-launcher 0.3.9 stable systemStart it from the application menu (it shows up as Tor Browser) or from a terminal. If you installed Flatpak itself just now, the menu entry may only appear after you log out and back in, since the Flatpak paths are added at login. The first run is the real install, so watch the log to see which version it picks:
flatpak run org.torproject.torbrowser-launcherIn the log you can follow each step: the launcher asks the Tor Project’s update server for the latest version, downloads the tarball and its .asc, then fetches the signing key and verifies before it extracts anything.
Tor Browser Launcher
By Micah Lee & Tor Project, licensed under MIT
version 0.3.9
https://gitlab.torproject.org/tpo/applications/torbrowser-launcher/
Downloading Tor Browser for the first time.
Downloading https://aus1.torproject.org/torbrowser/update_3/release/Linux_x86_64-gcc3/x/ALL
Latest version: 16.0
Downloading https://dist.torproject.org/torbrowser/16.0/tor-browser-linux-x86_64-16.0.tar.xz.asc
Downloading https://dist.torproject.org/torbrowser/16.0/tor-browser-linux-x86_64-16.0.tar.xz
Verifying Signature
Downloading latest Tor Browser signing key...
Key imported successfully
Extracting tor-browser-linux-x86_64-16.0.tar.xz
Running /home/josphat/.var/app/org.torproject.torbrowser-launcher/data/torbrowser/tbb/x86_64/tor-browser/start-tor-browser.desktopEverything stays under ~/.var/app/org.torproject.torbrowser-launcher, which held 536 MB after the first run. Debian 13 printed the same “Latest version” line from the same Flathub build, so the launcher’s age (its last release dates from 2025) does not hold back the browser it installs.
Install Tor Browser from the tarball and verify the signature
The Tor Project’s own download is a tarball that runs from any directory you can write to, with no root needed after the prerequisites. Doing it by hand means you check the signature yourself instead of trusting a launcher to do it. Install the three tools the steps use (Mint already had them, the Ubuntu cloud image did not):
sudo apt install -y curl gpg xz-utilsInstead of hardcoding a version that goes stale with the next release, ask the update server. It publishes one small JSON file per platform, and uname -m already prints the platform name the Tor Project uses (x86_64 or aarch64):
ARCH=$(uname -m)
TOR_VERSION=$(curl -s "https://aus1.torproject.org/torbrowser/update_3/release/download-linux-${ARCH}.json" | grep -oP '"version"\s*:\s*"\K[^"]+')
echo "$ARCH $TOR_VERSION"Both values must be filled in before you go further. An empty version turns the download URLs below into 404s:
x86_64 16.0Download the tarball and its detached signature into your home directory. The archive was 143 MB and took 15 seconds on the lab link:
cd ~
curl -fLO "https://dist.torproject.org/torbrowser/${TOR_VERSION}/tor-browser-linux-${ARCH}-${TOR_VERSION}.tar.xz"
curl -fLO "https://dist.torproject.org/torbrowser/${TOR_VERSION}/tor-browser-linux-${ARCH}-${TOR_VERSION}.tar.xz.asc"Fetch the Tor Browser Developers signing key over WKD, the method the Tor Project’s verification guide recommends:
gpg --auto-key-locate nodefault,wkd --locate-keys [email protected]The primary fingerprint has to read EF6E 286D DA85 EA2A 4BA7 DE68 4E2C 6E87 9329 8290. Note the signing subkey dated 2026-08-11: the current builds are signed with it, so a keyring imported before August needs a gpg --refresh-keys before verification passes.
gpg: key 4E2C6E8793298290: public key "Tor Browser Developers (signing key) <[email protected]>" imported
gpg: Total number processed: 1
gpg: imported: 1
pub rsa4096 2014-12-15 [C] [expires: 2030-11-18]
EF6E286DDA85EA2A4BA7DE684E2C6E8793298290
uid [ unknown] Tor Browser Developers (signing key) <[email protected]>
sub rsa4096 2026-08-11 [S] [expires: 2028-11-28]Now verify the tarball against the signature. Don’t extract anything until this passes, because a bad archive is only caught here.
gpg --verify "tor-browser-linux-${ARCH}-${TOR_VERSION}.tar.xz.asc" "tor-browser-linux-${ARCH}-${TOR_VERSION}.tar.xz"“Good signature” is the line that counts. The trust warning under it only means you have not personally signed the Tor Project’s key, which is normal:
gpg: Signature made Thu Oct 29 11:57:52 2026 UTC
gpg: using RSA key 022DA248432D2A0E0F54E65E316C1FACD62D07D9
gpg: Good signature from "Tor Browser Developers (signing key) <[email protected]>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: EF6E 286D DA85 EA2A 4BA7 DE68 4E2C 6E87 9329 8290
Subkey fingerprint: 022D A248 432D 2A0E 0F54 E65E 316C 1FAC D62D 07D9To be sure the check actually bites, we appended a single byte to a copy of the archive and verified it again. GPG answered BAD signature from "Tor Browser Developers (signing key)" and exited with status 1, so a tampered or truncated download cannot pass for a good one. If you ever see that line, delete both files and download again.
Extract the archive and register the desktop entry so Tor Browser shows up in the application menu:
tar -xf "tor-browser-linux-${ARCH}-${TOR_VERSION}.tar.xz"
cd ~/tor-browser
./start-tor-browser.desktop --register-appYour menu entry lands in ~/.local/share/applications/. On minimal installs the script also prints update-desktop-database: command not found, which is harmless because the entry is still written.
Launching './Browser/start-tor-browser --detach --register-app'...
Tor Browser has been registered as a desktop app for this user in ~/.local/share/applications/Leave the directory in your home folder rather than moving it to /opt with sudo, as the old version of this guide did. Tor Browser updates itself by rewriting files inside tor-browser/, so the user who runs it needs write access to that directory. The extracted copy takes 357 MB, and its version file tells you exactly what you installed:
cat ~/tor-browser/Browser/tbb_version.jsonWe found the same file in the launcher’s directory too, which makes it the quickest version check for every method.
{"version":"16.0","architecture":"linux-x86_64","channel":"release"}Start the browser from the menu, or run ./start-tor-browser.desktop from inside ~/tor-browser. You can delete the downloaded .tar.xz and .asc now, since the extracted copy updates itself.
Install torbrowser-launcher from the distro repository
Ubuntu and Mint carry torbrowser-launcher in universe, which both enable by default. Debian files it under contrib, the section for packages that need software from outside the archive, and a default Debian 13 install only enables main. Which file you edit depends on how Debian was installed, so check first:
ls /etc/apt/sources.list /etc/apt/sources.list.d/Cloud images ship the newer deb822 file /etc/apt/sources.list.d/debian.sources. Installs from the netinst or DVD ISO write the classic one-line /etc/apt/sources.list instead. If you have debian.sources, append contrib to its Components: lines:
sudo sed -i '/^Components:/{/contrib/!s/$/ contrib/}' /etc/apt/sources.list.d/debian.sourcesIf you only have sources.list, this variant adds contrib after main on every Debian line. We tested it on an ISO-style file whose lines read main non-free-firmware:
sudo sed -i -E '/^deb(-src)? .*debian/{/ contrib/!s/ main/ main contrib/}' /etc/apt/sources.list
grep -v '^$' /etc/apt/sources.listBoth commands skip lines that already list contrib, so running them twice changes nothing. The one-line file came out like this:
deb http://deb.debian.org/debian/ trixie main contrib non-free-firmware
deb-src http://deb.debian.org/debian/ trixie main contrib non-free-firmware
deb http://security.debian.org/debian-security trixie-security main contrib non-free-firmware
deb-src http://security.debian.org/debian-security trixie-security main contrib non-free-firmware
deb http://deb.debian.org/debian/ trixie-updates main contrib non-free-firmware
deb-src http://deb.debian.org/debian/ trixie-updates main contrib non-free-firmwareWe skipped apt modernize-sources for this job. On the same test file it wrote a moved-from-main.sources whose Signed-By: fields were empty, which is more cleanup than the one sed line.
From here the install command is the same on all three distros. The package lists tor as a recommended dependency, not a required one, and with the default settings apt installed it and started a system Tor daemon on 127.0.0.1:9050. Tor Browser runs its own bundled tor and never uses that daemon, so skip it:
sudo apt update
sudo apt install -y --no-install-recommends torbrowser-launcherOn a bare Debian 13 cloud VM with no desktop, that still pulled in 157 packages for the Python and Qt stack, left tor uninstalled and port 9050 closed. A standard Linux Mint 22 desktop already has most of it: even a default install there, with tor included, added only 15 packages. The repository versions are older than the Flathub build:
- Ubuntu 26.04: 0.3.9-1build1
- Debian 13: 0.3.7-3
- Linux Mint 22 and Ubuntu 24.04: 0.3.7-1ubuntu1
That gap did not matter in testing. The 0.3.7 launcher on Debian and Mint printed Latest version: 16.0 and extracted the same build as 0.3.9, because both versions ask the same update URL, and it verified the signature fine without the system tor present. Run it once to do the download:
torbrowser-launcherAfter that first run the browser sits in ~/.local/share/torbrowser/tbb/x86_64/tor-browser, and the menu gets a Tor Browser entry plus a separate Tor Browser Launcher Settings entry.
If you already installed the launcher without that flag, the daemon is running on Ubuntu, Debian and Mint alike. Unless something else on the machine needs a SOCKS proxy, turn it off. On Mint, disable --now tor alone left port 9050 open, because the daemon really runs as tor@default, which kept listening until it was stopped explicitly:
sudo systemctl disable --now tor
sudo systemctl stop tor@default
ss -ltn | grep 9050 || echo "port 9050 closed"After a reboot on Mint, both units stayed inactive and the port stayed closed.
Install Tor Browser on ARM64 Linux
Native Linux builds for 64-bit ARM moved to the stable channel with the 16.x line, and the release announcement names Raspberry Pis and Apple Silicon Macs running Linux as targets. The same release dropped 32-bit x86 Linux. We did not run any of this on ARM hardware, so treat this section as sourced from the Tor Project rather than tested here.
The tarball method needs no changes. On an ARM64 board uname -m prints aarch64, the update server publishes download-linux-aarch64.json, and the mirror carries tor-browser-linux-aarch64-16.0.tar.xz with its .asc. Run the same detection, download, GPG and extract commands from the tarball section, and echo "$ARCH $TOR_VERSION" should print aarch64 followed by the version.
One trap on Raspberry Pi: the 32-bit Raspberry Pi OS can boot a 64-bit kernel on a Pi 4 or 5, and then uname -m reports aarch64 while every program on the system is 32-bit armhf. The aarch64 tarball will not run on that userland. Check what your packages are built for before downloading:
dpkg --print-architectureIt has to print arm64. If it prints armhf, install a 64-bit OS first, because the Linux builds on the mirror are x86_64 and aarch64 only.
Skip the other two methods on ARM. Flathub lists org.torproject.torbrowser-launcher for x86_64 only, and the Debian and Ubuntu packages are built for amd64 (Debian adds i386) and not for arm64, so apt install finds no candidate. The launcher’s own code has no aarch64 branch either: it maps any 64-bit system to linux-x86_64.
Connect to Tor and set the security level
Whichever method you used, the first window is the Connect to Tor page. Click Connect on a normal network. Configure Connection is for networks that block Tor, where you need a bridge. Turn on “Always connect automatically” if you don’t want this page on every start.
On the lab network the connection was up well inside the 40 seconds we waited. To prove traffic leaves through Tor, open https://check.torproject.org, which names the exit relay address (redacted in the capture) instead of your own public IP.
Settings were reorganized in this release. The old General page is gone, split into Appearance, Downloads, Tabs and browsing, Accessibility and Languages, and a “Same settings, new look!” banner says your old choices carried over. The About Tor Browser entry, last in the main group of the sidebar, shows the running version and the update mode:
Bridges live under Connection, which shows the internet and Tor network status at the top. On a censored network, switch on “Use bridges” there and add a built-in bridge or one you requested from the Tor Project:
The security level sits in Privacy and security, or type “security level” into the new Find in Settings box. Change security level opens a dialog with three choices:
- Standard: everything enabled, the default
- Safer: turns off website features that are often dangerous
- Safest: static sites only, with images, media and scripts restricted
Changing the level needs a restart, and the dialog warns that it closes every window and tab, so pick the level before you start reading:
Safer is a sensible default for daily reading. Save Safest for sites you don’t trust, because it restricts scripts, images and media everywhere and plenty of modern pages stop working.
Turn on generic window titles
By default the window title carries the page title, so any program that can list windows on your desktop, a screen recorder or a time tracker, can read what you’re looking at. The new opt-in setting replaces every title with just “Tor Browser”. It hides the title, not the browser itself, so confining the other apps with something like AppArmor profiles on Ubuntu 26.04 is still the stronger control. The checkbox is buried two levels deep, under Privacy and security, then Advanced settings:
- 1Connection and software security
- 2Use generic window titles
- Open Connection and software security: in Privacy and security, click Advanced settings, or search “window title” in Find in Settings.
- Tick Use generic window titles under Protections from third-party applications. It applies at once, no restart.
We checked the effect from outside the browser with xdotool, which lists the X11 window names any other app could read (it needs an X11 session, not Wayland). With check.torproject.org open, this is the query we ran:
for w in $(xdotool search --name "."); do xdotool getwindowname $w; done | grep -v '^Firefox$' | sort -uWith the box clear, the name was the full page title, “Congratulations. This browser is configured to use Tor.”, followed by the browser name. After ticking it, the same query returned only this:
Tor BrowserBehind the checkbox are two Firefox preferences in the profile’s prefs.js, which is handy if you script your setup or want to confirm the change stuck after a restart.
user_pref("privacy.exposeContentTitleInWindow", false);
user_pref("privacy.exposeContentTitleInWindow.pbm", false);HTTPS-Only Mode lives on the same page and is already on for all windows. Leave it that way, because a plain HTTP page over Tor is readable by the exit relay.
Update and uninstall Tor Browser
Updates come from two places. The browser updates itself: the About page showed “Automatically install updates (recommended)” selected by default, and its Check for updates button runs the check on demand. The launcher, if you used one, updates with the rest of your packages:
sudo flatpak update -y org.torproject.torbrowser-launcher
sudo apt update && sudo apt install --only-upgrade -y torbrowser-launcherUninstalling depends on the method. For the tarball, remove the menu entry first, then the files:
cd ~/tor-browser
./start-tor-browser.desktop --unregister-app
cd ~ && rm -rf ~/tor-browser ~/tor-browser-linux-*For the Flatpak, uninstall the app and then delete its data folder by hand. In testing, sudo flatpak uninstall --delete-data left ~/.var/app/org.torproject.torbrowser-launcher in place, because under sudo it looks in root’s home, not yours:
sudo flatpak uninstall -y org.torproject.torbrowser-launcher
sudo flatpak uninstall -y --unused
rm -rf ~/.var/app/org.torproject.torbrowser-launcherFor the apt package, purge it and let autoremove take the Qt dependencies with it, plus tor if you installed without --no-install-recommends (that default install came to 51 packages on Ubuntu 26.04). The downloaded browser lives in your home directory, so remove that separately:
sudo apt purge -y torbrowser-launcher
sudo apt autoremove -y --purge
rm -rf ~/.local/share/torbrowser ~/.config/torbrowser ~/.cache/torbrowserIf you’re tidying a fresh install anyway, the Debian 13 post-install checklist and the Ubuntu 26.04 Snap, Flatpak and apt guide cover the package housekeeping around it.
Troubleshooting
Every error below came up in the lab runs, with the fix that cleared it.
error: Nothing matches com.github.nickvergessen.TorBrowser in remote flathub
That app ID is gone from Flathub, and a flatpak search torbrowser on the fresh Ubuntu VM did not find the replacement either, because the appstream data had not been fetched yet. Install the Tor Project’s app by its exact ID instead: sudo flatpak install flathub org.torproject.torbrowser-launcher. Some guides also print com.github.micahflee.torbrowser-launcher in their uninstall step, and Flathub returns nothing for that ID either.
Flatpak system operation Deploy not allowed for user
Mint’s Flathub remote is a system installation, and installing into it needs either a polkit password prompt or root. Over SSH there is no prompt, so the install failed with this message and GetRevokefsFd not allowed for user on every runtime. Run the install with sudo, as shown above, or from a terminal inside your desktop session where the password dialog can appear.
E: Package ‘torbrowser-launcher’ has no installation candidate
Debian prints this when only main is enabled. The full message says the package “is referred to by another package” and is “only available from another source”, which is the contrib component. Add it with the sed line from the launcher section, run sudo apt update, and the candidate becomes 0.3.7-3.
curl: (22) The requested URL returned error: 404
If TOR_VERSION is empty, the URL becomes .../torbrowser//tor-browser-linux-x86_64-.tar.xz and the mirror returns 404. Our first detection attempt hit exactly this, because the JSON is pretty-printed as "version" : "16.0" with a space before the colon, and a pattern expecting "version": matched nothing. The \s*:\s* in the command above handles both forms. Always echo the variables before downloading.
gpg: BAD signature from “Tor Browser Developers (signing key)”
The file does not match its signature. We produced this deliberately by changing one byte, but in real use it means a corrupt or tampered download, so don’t extract it. Delete the .tar.xz and .asc, download both again from dist.torproject.org and verify once more. A “No public key” or expired-key error instead points at a stale keyring: run gpg --refresh-keys EF6E286DDA85EA2A4BA7DE684E2C6E8793298290 to pick up the current signing subkey. If the key was never imported, the refresh has nothing to work on, so re-run the WKD --locate-keys command from the tarball section instead.
It worked, thanks!