Why Run Kali Linux from a USB Drive?

A bootable Kali USB is one of the most useful tools you can have as a security professional or learner. Here's why:

💡 Want something even more portable? A USB stick needs a host computer. For a fully self-contained field rig, see how to build a portable Kali pentest box on a Raspberry Pi.

What You'll Need

💾 Which drive should you actually buy?

Any quality USB 3.0 flash drive works for a basic Live USB — but persistence and live-booting hammer the drive with constant random read/writes, so a cheap USB 2.0 stick makes Kali painfully slow and wears out fast. If you'll use this regularly, here's what's worth buying:

  • Budget Live-USB pick — SanDisk Ultra Fit USB 3.0: compact and low-profile, stays flush in the port. View on Amazon →
  • Best for persistence — Samsung T7 portable SSD: dramatically faster for saved files, VM images, and captures. View on Amazon →
  • Rugged alternative — SanDisk Extreme Portable SSD. View on Amazon →

Affiliate links — I may earn a small commission at no extra cost to you. Full disclosure.

⚠️ Apple Silicon limitation: Mac computers with M1/M2/M3/M4 chips cannot boot from a Kali USB. Apple Silicon Macs have locked bootloaders that don't support arbitrary OS booting. If you have an Apple Silicon Mac, run Kali in a VM instead — see our VirtualBox install guide.
⚠️ Important: Flashing a USB drive completely erases all data on it. Back up anything important before proceeding. Triple-check that you've selected the correct drive — selecting the wrong one will wipe an internal disk without warning.

Step 1: Download the Kali Linux Live ISO

  1. Go to kali.org/get-kali
  2. Under "Bare Metal", click Live
  3. Choose the amd64 ISO (for 64-bit Intel/AMD systems)
  4. Wait for the ~4 GB download to complete
Download Kali Linux Live ISO
ℹ️ Live vs Installer vs NetInstaller: Make sure you download the Live image. The Installer and NetInstaller images are designed to install Kali to an internal hard drive, not to run from a USB.

Verify the download (recommended)

Kali publishes SHA256 checksums for every release. Verifying ensures the ISO wasn't corrupted in transit or tampered with:

Terminal — Verify ISO checksum
# macOS $ shasum -a 256 kali-linux-2026.1-live-amd64.iso # Linux $ sha256sum kali-linux-2026.1-live-amd64.iso # Windows (PowerShell) PS> Get-FileHash kali-linux-2026.1-live-amd64.iso -Algorithm SHA256

Compare the output to the checksum on the Kali downloads page. If they don't match, re-download.

Step 2A: Create the USB on Windows (Rufus)

Rufus is the recommended tool for Windows — it handles persistence in one step and gives you control over partitioning.

  1. Download Rufus (the portable version doesn't require installation)
  2. Plug in your USB drive
  3. Open Rufus. Under Device, select your USB drive (verify the size matches!)
  4. Under Boot selection, click SELECT and choose the Kali Live ISO
  5. Set Partition scheme:
    • GPT — for modern UEFI machines (most computers from 2015+)
    • MBR — for older BIOS-only systems
  6. Leave File system as FAT32
  7. (Optional) Drag the Persistent partition size slider to allocate space for saved data — see persistence section below
  8. Click START. If asked about ISO vs DD mode, choose ISO Image mode
  9. Wait for completion — typically 10–20 minutes
Creating Kali Linux bootable USB

Step 2B: Create the USB on macOS or Linux (balenaEtcher)

balenaEtcher is the simplest cross-platform option. It runs on macOS (Intel and Apple Silicon hosts), Linux, and Windows, and refuses to write to drives that look like internal disks — protecting you from accidental data loss.

  1. Download balenaEtcher
  2. Plug in your USB drive
  3. Open Etcher and click Flash from file
  4. Select the Kali Linux Live ISO
  5. Click Select target and choose your USB drive
  6. Click Flash!
  7. Enter your admin password when prompted
  8. Wait for the write and validation to complete
ℹ️ Etcher limitation: Etcher can't add a persistence partition during flashing. If you want persistence, either use Rufus on Windows, or follow the manual persistence setup below after flashing with Etcher.

Step 2C: Create the USB on Linux/macOS (dd command)

The dd command is the official Kali-recommended method for terminal users. It's fast and reliable, but unforgiving of typos.

Terminal — dd command
# Find your USB drive's device name (do this BEFORE plugging in, then again after) $ lsblk # Linux $ diskutil list # macOS # IMPORTANT: replace /dev/sdX with YOUR actual USB device (e.g., /dev/sdb) # Triple-check this — dd will overwrite whatever you point at! $ sudo dd if=kali-linux-2026.1-live-amd64.iso of=/dev/sdX bs=4M conv=fsync status=progress # macOS uses /dev/diskN (not /dev/sdX) and rdisk for faster writes $ sudo diskutil unmountDisk /dev/disk2 $ sudo dd if=kali-linux-2026.1-live-amd64.iso of=/dev/rdisk2 bs=4m
⚠️ The dd command is dangerous. If you point it at the wrong drive, you'll wipe your internal hard drive without warning. Always use lsblk or diskutil list first to confirm which device is your USB. The size shown (e.g., 32 GB for a 32 GB stick) is your sanity check.

Step 3A: Boot from USB on Windows

  1. Insert the USB drive
  2. Restart the computer
  3. As soon as the manufacturer logo appears, press the boot menu key. Common keys:
    • Dell: F12
    • HP: F9 or Esc
    • Lenovo: F12 or Fn+F12
    • ASUS: F8 or Esc
    • Acer: F12 or F2
    • MSI: F11
    • Most generic: F12 or Esc
  4. Select your USB drive from the boot menu
Boot menu on Windows
⚠️ Secure Boot may block Kali: Many modern Windows PCs ship with Secure Boot enabled, which prevents booting unsigned operating systems like Kali. If your USB doesn't appear or fails to boot, enter BIOS/UEFI settings (typically F2 or Del at startup) and disable Secure Boot. You can re-enable it later.

Step 3B: Boot from USB on Intel Mac

This works on Intel Macs (pre-2020). It does not work on Apple Silicon Macs (M1/M2/M3/M4).

  1. Power off the Mac
  2. Plug in the Kali USB drive
  3. Power on while holding Option (Alt) until the Startup Manager appears
  4. Select the Kali USB drive (usually labeled "EFI Boot")
  5. Press Return
Boot from USB on Mac

Step 4: Choose Your Boot Mode

You'll see the Kali boot menu with several options:

Kali Linux boot menu
OptionUse For
Live systemDefault — runs Kali in RAM. Nothing is saved.
Live system (persistence)Kali with saved files (requires persistence partition setup)
Live system (encrypted persistence)Persistence + LUKS encryption (most secure)
Live (forensic mode)For digital forensics — disables auto-mounting and swap
Install / Graphical installInstall Kali to internal hard drive (replaces existing OS)

For most users, select Live system and press Enter. After about 30 seconds, you'll see the Kali desktop.

Default login credentials:

FieldValue
Usernamekali
Passwordkali
ℹ️ Note on credentials: Older guides reference root / toor. Those credentials no longer work — Kali switched to a non-root default user (kali / kali) starting with version 2020.1.

Step 5: Setting Up Persistence (Optional but Recommended)

By default, anything you do in a live session — files saved, tools installed, settings changed — is wiped on reboot. Persistence creates a separate partition on the USB to save your data across reboots.

If you used Rufus and set the persistence slider, skip this section — Rufus already created the partition for you. Test it by selecting Live system (persistence) from the boot menu.

Manual persistence setup (after flashing with Etcher or dd)

You'll need GParted (a partition editor) and a Linux environment. The easiest way is to boot into Kali Live first, then set up persistence on the same USB.

Terminal — Manual persistence setup
# Boot into Kali Live, then open a terminal # Find your USB drive (it's NOT the one Kali booted from) $ sudo fdisk -l # Use parted to create a new partition in the unallocated space $ sudo parted /dev/sdX (parted) print # note the end of the last partition (parted) mkpart primary ext4 [end-of-last-partition] 100% (parted) quit # Format the new partition as ext4 with label "persistence" $ sudo mkfs.ext4 -L persistence /dev/sdX3 # Mount it and create the persistence config file $ sudo mkdir -p /mnt/usb $ sudo mount /dev/sdX3 /mnt/usb $ echo "/ union" | sudo tee /mnt/usb/persistence.conf $ sudo umount /mnt/usb

Now reboot, select Live system (persistence) from the boot menu, and any changes you make will be saved.

Encrypted persistence (recommended for sensitive work)

If you're going to save credentials, client data, or anything sensitive, use LUKS-encrypted persistence:

Terminal — Encrypted persistence
# Encrypt the new partition with LUKS $ sudo cryptsetup --verbose --verify-passphrase luksFormat /dev/sdX3 # Open the encrypted volume $ sudo cryptsetup luksOpen /dev/sdX3 my_usb # Format and label it $ sudo mkfs.ext4 -L persistence /dev/mapper/my_usb # Mount and create config $ sudo mkdir -p /mnt/my_usb $ sudo mount /dev/mapper/my_usb /mnt/my_usb $ echo "/ union" | sudo tee /mnt/my_usb/persistence.conf # Cleanup $ sudo umount /mnt/my_usb $ sudo cryptsetup luksClose /dev/mapper/my_usb

On boot, choose Live system (encrypted persistence) and you'll be prompted for the passphrase.

Post-Boot Tips

The tips below are the essentials. For the complete setup routine, follow my guide to the 25 things to do after installing Kali Linux, and if the command line is new to you, start with the beginner commands guide.

Update Kali immediately

Terminal — Initial update
$ sudo apt update && sudo apt full-upgrade -y

Change the default password

The default kali / kali credentials are well-known. If anyone gets physical access to your USB, they have full access. Change it:

Terminal — Change password
$ passwd

Install additional tools

The Live image includes a curated tool set. Install metapackages for more. Not sure where to begin? See the top 10 Kali Linux tools and our bash cheatsheet:

Terminal — Install tool sets
$ sudo apt install kali-tools-wireless # Wireless $ sudo apt install kali-tools-web # Web app testing $ sudo apt install kali-tools-passwords # Password tools

Frequently Asked Questions

Can I install Kali USB on an Apple Silicon Mac (M1/M2/M3/M4)?

No. Apple Silicon Macs cannot boot from USB drives running x86 operating systems. The bootloader is locked. Use a virtual machine instead — see our Kali on VirtualBox guide, or use UTM with the ARM64 Kali image.

What's the difference between Kali Live and a full USB installation?

Live runs entirely in RAM with the USB as the boot source — fast to set up but resets on reboot (unless you add persistence). A full USB install treats the USB as a hard drive and saves everything natively, but requires more setup and a faster, larger USB drive (USB 3.1 SSD recommended).

How big should my USB drive be?

Minimum 8 GB for live-only (no persistence). 16 GB for live + small persistence. 32 GB or more for live + serious persistence with installed tools. USB 3.0 or USB 3.1 strongly recommended — USB 2.0 is painfully slow.

My USB doesn't show up in the boot menu. Why?

Three common causes: (1) Secure Boot is enabled — disable it in BIOS. (2) The USB wasn't flashed correctly — try re-flashing with a different tool. (3) The boot order isn't checking USB first — enter BIOS/UEFI and add USB to the boot order. Some older systems also can't boot from USB 3.0 ports — try a USB 2.0 port.

What's GPT vs MBR partition scheme?

MBR is the older partition standard (works on legacy BIOS systems). GPT is the modern standard (required for UEFI without Compatibility Support Module). For most computers from 2015 onwards, use GPT. If unsure, use Rufus's auto-detection — it usually picks correctly.

How do I update Kali on my USB?

Boot the USB with persistence enabled, then run sudo apt update && sudo apt full-upgrade -y. Updates persist on the persistence partition. For major Kali version upgrades (e.g., 2025.x → 2026.x), it's usually cleaner to re-flash the USB with the new ISO.

Is running Kali from USB secure?

Live mode (no persistence) is very secure — nothing is saved, so there's nothing for an attacker to steal. With persistence, your saved data is at risk if the USB is lost. Use encrypted persistence with LUKS for sensitive work — it requires a passphrase to decrypt.