Short list of laptops/desktops that work well with Qubes OS

Is getting one of the certified hardware laptops (eg Nitropad) with Qubes pre-installed ok?

I’ve heard a few people say it’s better to install a clean version of the OS yourself for maximum safety?


Is getting one of the certified hardware laptops (eg Nitropad) with Qubes pre-installed ok?

The Qubes OS Project certifies only that a particular hardware configuration is supported by Qubes OS and is available to purchase with Qubes OS preinstalled. We take no responsibility for any vendor’s manufacturing, shipping, payment, or other practices; nor can we control whether physical hardware is modified (whether maliciously or otherwise) en route to the user.

I’ve heard a few people say it’s better to install a clean version of the OS yourself for maximum safety?

You can do that. You can even build your own heads version and flash it (with hardware clips if you want to be really sure). At that point however you could just as well buy a used X230 or T430 and perform all the work yourself.

The certified laptops are meant for people who are not able to do this themselves (time, skills etc.).

As I don’t find them in the list, I found the notebooks from Schenker/XMG very suitable!

SCHENKER Laptops & Desktops - individual like you and XMG | The fastest gaming laptops & desktop PCs.

One can at least tweak some components as they have some kind of modular concept. Moreover, are their notebooks manufactured in Germany and their service is great too!

In my experience they work very well with Qubes OS!

First of all does it perfectly support its hardware requirements so that if you follow the standard installation procedure everything usually works out-of-the-box even “suspend” and every single 4.1 release candidate ran through without any issue at all. :wink:

BIOS settings for Intel ME are also great as they allow to easily import xen and grub efi’s - if one want to trust Intel ME to secure your boot chain of cause… :smiley:

@voidstar please start sending in HCL reports for those machines.

1 Like


1 Like

@Sven Somehow I was convinced that sleep must work reliably in order to say that a computer “just works”. Do you disagree? You also wrote yourself earlier:

I don’t see it mentioned in the table for p51.

In my opinion, working sleep must be among the criteria to include in this list, especially given that Qubes OS does not have hibernation. If the machine doesn’t wake up from sleep, the standard system menu misleadingly suggests to users to loose all their data unless it’s saved beforehand.

We should go through the list and mark/mention when sleep doesn’t work for any particular machine. I am not sure I’ll get to it before the weekend, so if you want to take a stab at it… :wink:

If the user is aware that sleep doesn’t work, it won’t hinder the use of Qubes OS in any way. I’ve been using both a DELL and the Lenovo P51 without sleep for years. Sleep is a minor convenience that comes with a pretty big impact on security (in the wrong direction). So I would not support any notion to consider it “critical” or part of the “just works” criteria.

The T430 has reliable sleep/wake.

It strongly depends on your threat model. The main goal of Qubes AFAIK is to protect you from online and USB threats, and it does it very well. If you also care about physical access of you machine, you open a huge can of worms, which is likely unimportant for most users. I am not sure Qubes protects from it as strongly. Having suspend doesn’t prevent you from switching off your machine whenever you feel a threat. Most people work from home now btw.

Suspend saves a lot of time for me every single day: I do not need to open a ton of documents, windows and browsers anew and put them at the right places on the screens and virtual desktops. I wish Qubes had hibernate instead, but it seems like a big work (and not good for SSDs).

I’ll try to add as much as I can, although I disagree that such machines should be in the list.

@Sven I added “HCL reports” line to the laptop pages with links. I think it helps to evaluate which information we have and easily find it. I did not touch the certified laptops, since they do not have enough reports anyway. This technically makes them not “community-recommended” in my opinion (but I already expressed that before).

I also found that a lot of forum links in the HCL got broken after you moved posts to machine-specific topics.

@fsflover wrote:

@Sven I added “HCL reports” line to the laptop pages with links.

Thank you!

I also found that a lot of forum links in the HCL got broken after you moved posts to machine-specific topics.

Not cool. I expected discourse to handle that. @deeplow?

4 posts were merged into an existing topic: HCL links broken

My impression is that nobody understood what I mean when I suggest to separate certified laptops from developer-test and from the community-recommended in this list. Below I try to show how I see it. Feel free to ignore it if makes no sense. In my opinion such view has less clutter and more structure.


brand model CPU max. mem in GB (slots)[1] USB ctrl.[2] core boot[3] note
Certified hardware
Insurgo PrivacyBeast X230 i7-3520M 16 (2) 3 yes pre-installed
Nitrokey NitroPad T430 i5-3320M, i7-3840QM 16 (2) 3 yes pre-installed
NitroPad X230 i5-3320M, i7-3520M 16 (2) 3 yes pre-installed
Hardware tested by the developers
Lenovo ThinkPad X230 i5-3210M, i5-3320M, i7-3520M 16 (2) 3 opt
Hardware tested by the Community
Lenovo ThinkPad E570 i5-7200U 32 (2) 1 no
ThinkPad L380 i7-8550U 32 (2) 1 no
ThinkPad P51 i7-7820HQ 64 (4) 1 no Suspend broken, No HDMI audio
ThinkPad T430 i5-3320M, i7-3840QM 16 (2) 3 opt
ThinkPad T450s i7-5600U 20 (1) 2 no
ThinkPad T480s i7-8550U 40 (1) 1 no
ThinkPad X220 / Tablet i5-2520M 16 (2) 2 opt
ThinkPad X250 i5-5300U 16 (1) 2 no
Purism Librem 14 v1 i7-10710U 64 (2) 1 yes pre-installed

  1. if a computer has slots (aka DIMM sockets) upgrading the memory at a later time is an option. ↩︎

  2. multiple USB controllers allow to further compartmentalize the use of peripherals. ↩︎

  3. coreboot provides auditability and maximum user control. ↩︎

1 Like

This indeed looks tidier and more systematical, no doubt at all.
But, if anyone would ask me what I’d prefer compared to CTRL+F in a HCL list is - filtering as detailed as possible, and it shouldn’t be hard to achieve that.
We all have some starting point - mine is CPU, so, first I’d choose CPU from, then would search for laptops with this CPU offers to see what I could expect regarding the price, then would come back to HCL list, filtered it to chosen CPU then to all other criteria I’d like to have, then would browse for detailed specs for filtered laptops’ bios characteristics and chipsets, then would go back to to check chipsets, then would try to find reviews on a, and then would try to check availability, and at the end I’d insist to enter bios and to start Qubes installation from USB flash.

So, as can be seen, at least for me, HCL list is not crucial, but is more a supportive spot that I made a proper choice.

Once filtering is present, it is less important for me how the table itself is organized…

Pretty good @fsflover, also, while we might be at it, a section that properly addressed DIY or self-built systems might be nice. Note that currently a lot of DIY gets shoved into Motherboards & any future DIY should probably focus on motherboard/CPU/GPU combo as there really is about a tri-fecta of core components with independent manufacturer & model names which provide the core details for someone looking at HCL. I’m thinking about posting further on the associated topic of more info from installations (HCL inclusion of select portions of lspci outputs) as pertains to bridged devices & how to help everyone be more prepared for the Qubes installation process (fight?).

If I understand you correctly, it’s already in the current table, I just did not touch this part. See “desktops”.

I won’t quibble with you much @fsflover but, as of this date/time, the link (which is a closed thread) which you provided has a single entry for Desktop & that entry is decidedly not a DIY. Proprietary/commercial offerings that are repurposed as Qubes systems is not what I meant. But I understand, this is a topic that isn’t likely to go anywhere - mostly to put a cross on the T, dot on the I, you know. I was also likely pointing back at the HCL as much as anything.

@kysstfafm, as far as the HCL goes we have the following classifications:

  • laptop
  • desktop/workstation
  • server
  • motherboard

The first three are in my understanding for off-the-shelf (NOT DIY) systems, while the last covers all DIY systems. I have tried to catch all DIY systems that are currently listed as desktop and move them into motherboards.

I am one of the HCL maintainers and want to clean this up. I’d appreciate if you could point out to me all the systems that are currently misclassified. You can respond here or send me a PM, whatever you prefer.

1 Like

Where would DIY laptops go @Sven? Does upgrading CPU/RAM/Storage/other components in laptop count as DIY?

@enmus “DIY” implies “one of a kind”, “build from scratch” by assembling separately ordered parts. While I know (from books) that DIY laptops are possible, I’ve never seen one and don’t believe we have received an HCL report for one.

Upgrading memory, storage, CPU, WiFi, display etc are common and while you can do them yourself, you can also have them done at any ordinary repair shop. I wouldn’t call this DIY.


I will try, however I expect that it won’t be easy, for either of us. I know, you are very busy with real world plus this duty.

I notice on a cursory examination of HCL today that there seem to be a number of Asus motherboards (I’m going to have to run down portions of the list at a time to sort out any true systems rather than motherboards) that likely fit this category too. I am unfamiliar of too many Asus products which would fit this broad number of items better than their motherboards but let me take a closer look.

I do though have to suggest that Gigabyte Brix (only as a for instance since my Zotac system never made it in or got culled long ago for some reason, also Intel NUCs can fit into this quasi-category) or other items like a Zotac small form factor PC that in some (but not all cases) come provided sans OS (I once used a Zotac for Qubes in the early days - worked with Atom processor & only 8GB of RAM rather well) should likely count too. If it wasn’t pre-assembled & never had Microsoft installed by a merchant/manufacturer before sale to the end-user posting this to the HCL…