How NAILS compares with VeraCrypt, Tails and Shufflecake

A VeraCrypt hidden operating system is installed in a hidden volume in the partition behind a decoy system's partition, and while it runs, reads and writes aimed at the system partition go to that hidden volume.

The wizard also helps you create the decoy system, because the unencrypted VeraCrypt Boot Loader can indicate that system encryption is in use.

The hidden operating system builds on VeraCrypt's system encryption, which currently supports only Windows: Windows 11 and Windows 10 version 1809 or later, both on x64.

In VeraCrypt 1.26.29, the interface does not offer to create a hidden operating system when the system partition is GPT.

VeraCrypt makes local unencrypted filesystems and non-hidden VeraCrypt volumes read-only, except those on CD/DVD-like media and on custom, atypical or non-standard devices.

Its precautions for a hidden operating system say to use the decoy system as often as you use the computer, and to keep the computer off every network, the internet included, while the hidden system runs.

NAILS also asks you to keep its decoy in plausible, regular use.

A VeraCrypt hidden volume is created inside the free space of an outer VeraCrypt volume, and VeraCrypt's hidden volume page says it "should be impossible to prove" that one exists, even with the outer volume mounted.

That claim comes with a condition: the instructions of its volume creation wizard and its security requirements for hidden volumes must be followed.

Its command-line documentation for Linux includes a procedure for creating hidden volumes.

For Linux, VeraCrypt's security requirements for hidden volumes say:

• mount hidden volumes only while a "live-CD" system runs, entirely stored on and booted from a CD or DVD, that writes any system-volume data to a RAM disk
• during that session, mount only filesystems inside hidden volumes read-write
• if you cannot comply, and cannot ensure that applications and the operating system write no sensitive data to non-hidden volumes or filesystems, you "must not mount or create hidden VeraCrypt volumes under Linux"

With NAILS, you unlock and mount the hidden volume on the decoy before you run nails activate.

• Alternative. Its hidden operating system runs a hidden system behind a decoy, on Windows only. NAILS runs only on Linux.
• Complement. A VeraCrypt hidden volume opened with cryptsetup is one of the backends NAILS is tested with, and NAILS keeps the hidden session's changes in it. Any deniability the volume has is VeraCrypt's, on the conditions VeraCrypt sets out above. NAILS encrypts nothing and adds nothing to the backend's claim.

• You use Windows and want a hidden system behind a decoy. That is what VeraCrypt's hidden operating system is for, but VeraCrypt 1.26.29 does not offer one in its interface when the system partition is GPT.
• You need hidden storage for files, not a hidden session, and can follow VeraCrypt's security requirements for hidden volumes. NAILS adds a session, not storage.

Shufflecake runs on Linux with its own kernel module and a command-line tool.

One device holds up to 15 volumes, ordered from less secret to more secret, and the password of one volume also opens every less secret volume.

Less secret volumes serve as decoys whose passwords can be given up under pressure.

Opened volumes appear as block devices under /dev/mapper, and you format and mount them yourself.

A Shufflecake hidden operating system is not available yet: the project says it is working on one and has a booting prototype.

Shufflecake's FAQ answers "We don't" when asked how it prevents the operating system from logging filesystem access and leaking the existence of hidden volumes, and says the operating system and its applications cannot be reliably trusted not to.

The project calls Shufflecake experimental software and asks users not to rely on its security for anything important.

Shufflecake hides storage volumes. NAILS does not hide that a hidden volume exists. It runs a session on an overlay whose writable layer is on a volume you provide.

The NAILS docs list Shufflecake as not evaluated and make no claims about it as a backend.

You want hidden volumes on Linux with decoy passwords to give up under pressure, and accept software the project calls experimental. NAILS never unlocks, mounts or encrypts the hidden volume you provide.

Qubes defines a disposable as a stateless qube that does not save data between reboots.

Qubes says that at this time, disposables "should not be relied upon to circumvent local forensics" because they do not run entirely in RAM.

When it is essential to avoid leaving any trace, it suggests Tails on bare metal.

As of October 20, 2026, deniable encryption is an open feature request in the Qubes OS issue tracker. The request's most wanted option is deniable full disk encryption, such as a hidden operating system in the style of TrueCrypt or VeraCrypt.

Qubes OS keeps your work in isolated compartments on one desktop. NAILS isolates only what the hidden session writes through the decoy's mounted filesystems. It does not give the session a separate machine, kernel, account or online identity, and it is built against one adversary: someone with offline access to your disks after the fact.

You want a desktop operating system built around isolated compartments. NAILS runs one environment at a time, the decoy or the hidden session.