Chapters
  1. Welcome to Omarchy!
  2. Getting Started
  3. Coming From Mac or Windows
  4. Navigation
  5. The Top Bar
  6. Themes
  7. Hotkeys
  8. Unified Clipboard & History
  9. Reminders
  10. Notices
  11. Text Extraction & Dictation
  12. Screenshots & Recording
  13. Toggles, Idle & the Screensaver
  14. Omarchy CLI
  15. Terminal
  16. Neovim
  17. AI
  18. Development Tools
  19. Shell Tools
  20. Shell Functions
  21. TUIs
  22. GUIs
  23. Browsers
  24. Commercial apps/services
  25. Web Apps
  26. Gaming
  27. Filling out PDFs
  28. Windows VM
  29. Other Packages
  30. Updates
  31. Dotfiles
  32. Shell Plugins
  33. Monitors
  34. Keyboard, Mouse, Trackpad
  35. Networking
  36. System sleep
  37. Hardware authentication
  38. Fonts
  39. Backgrounds
  40. Prompt
  41. Branding
  42. Common tweaks
  43. Making your own theme
  44. Mac support
  45. Troubleshooting
  46. FAQ
  47. System snapshots
  48. Security
  49. Omarchy on...
  50. Dual Boot Install
  51. Unattended Installs

Security

Omarchy takes security extremely seriously. This is meant to be an operating system that you can use to do Real Work in the Real World. Where losing a laptop can’t lead to a security emergency. So here’s what we do:

  1. Full-disk encryption is mandatory: This is the most important step to securing the physical protection of your data. If your computer is lost or stolen, the data is fully encrypted using standard LUKS (Linux Unified Key Setup).
  2. Firewall is enabled by default: All incoming traffic is blocked by default except for port 53317 for LocalSend. Even ssh is off until you turn it on via Setup > Security > SSHD, which opens port 22 (rate limited against brute force) as part of the setup. We even lock down Docker access using the ufw-docker setup to prevent that your containers are accidentally exposed to the world.
  3. Arch always have the latest updates: Arch, the underlying distro that Omarchy is built on, is a rolling distribution. This means that any security vulnerability that’s discovered and patched in any package is quickly available for install using omarchy-update. You’re always running the latest, most secure versions of everything that way.
  4. Omarchy maintains its own packages and mirror: Omarchy only relies on packages from Arch’s own core/extra/multilib repositories and its own Omarchy Package Repository by default. You can install software directly from AUR, but the base install doesn’t - only a few optional installs, like the third-party browsers, pull from the AUR.
  5. Cloudflare protects us from DDoS: All the Omarchy distribution infrastructure - the ISOs, the Omarchy packages, the Arch mirror - is protected behind Cloudflare’s formidable DDoS shield and hosted on their CDN. This provides superb availability.

Changing your passwords

You have two passwords on an encrypted install: the one that unlocks the drive at boot, and the one you log in and sudo with. Both can be changed under Update > Password in the Omarchy menu - Drive Encryption for the first, User for the second. Changing the drive password asks for the current one first, so have it handy.

Passing on a machine you’ve already used

If you’re handing your machine over to someone else, you don’t have to reinstall it. Run Setup > Reset Computer in the Omarchy menu, type reset to confirm, and reboot. That wipes every user account and everything in /home, throws away all the packages and system changes you made since installation, and clears the machine’s identity - network connections, host keys, and all. What comes back up is the setup wizard from the first boot, ready for its new owner to enter their own name, password, and encryption password.

It works by restoring the baseline snapshot the installer takes, so it’s only available on machines installed from the Omarchy ISO. And on a drive without encryption, a reset is deletion rather than a secure erase, so if the data was sensitive, do a fresh install instead.

Passwordless sudo

Sometimes you want sudo to stop asking, most often when an AI agent is doing a long stretch of system work for you. Setup > Security > Passwordless Sudo turns that off for 15 minutes and then puts it back automatically. Run it again before the timer runs out to end it early, and pass your own number of minutes with omarchy-sudo-passwordless 30 if 15 isn’t enough.

Be clear-eyed about this one: while it’s on, anything running as your user can do anything as root without being asked. That’s the whole point, and it’s also the whole risk.

Signing Keys

The public key for all ISO signatures and Omarchy repo package is 40DFB630FF42BCFFB047046CF0134EE680CAC571 (verify at openpgp.org). The omarchy/omarchy-keyring package contains this as well and will be used to rollout any potential updates seamlessly.

You can find the signature for any ISO release by adding .sig to the URL. Like https://iso.omarchy.org/omarchy-x.x.x.iso.sig.