A fresh Debian install is clean, stable and honestly a bit bare, and that's on purpose. The first time I set up Debian on my own laptop, I gave root a password during the install, logged in, typed sudo apt install vlc and got told I wasn't in the sudoers file. Twenty minutes of head scratching later, I learned that one installer screen decides how your whole first day goes.
Debian 13 "Trixie" landed in August 2025 with the 6.12 LTS kernel and APT 3.0, and it gets regular security support until 2028, then LTS until mid 2030. That long runway is why picking the right software early matters. Whatever you install now, you will live with it for years.
These are the must-have Debian apps I actually put on every Debian Stable machine I build, almost all free and open-source, and where each piece should come from. If you're still not sure which Debian branch you should be on, read Debian Stable vs Testing vs Sid first.
What Debian 13 Changes for Your App Choices:
- APT 3.0 ships with colored, easier to read output and a new apt modernize-sources command that converts old sources.list files into the deb822 format.
- The non-free-firmware component is enabled by the installer, so most Wi-Fi cards and GPUs work without hunting for firmware.
- Kernel 6.12 LTS brings much better support for recent laptops, which means fewer reasons to chase a backports kernel.
- Firefox ESR is still the default browser. Fine for most people, and it gets security fixes fast without the monthly feature churn.
- Flatpak is in the main repo, but Flathub is not configured out of the box. If you're unsure which universal format to trust, see Flatpak vs Snap vs AppImage.
- 32-bit (i386) is gone as an installable architecture. It still exists for multiarch though, which matters if you plan to install Steam.
With this guide, you will set up the 15 best Debian software picks in 7 steps, grouped in the order I install them on a fresh box, plus a few bonus tools the Debian community keeps recommending. Debian 12 "Bookworm" stays supported under LTS until June 2028, and most of these apps work there too. The exceptions: btop needs bookworm-backports, apt modernize-sources does not exist there, and you install plain keepassxc instead of keepassxc-full. If you're still choosing between distros, our Debian vs Ubuntu comparison will help.
Prerequisites:
Operating System : Debian 13 "Trixie" (Debian 12 works for almost all of it)
User Account : A regular user with sudo rights (Step 1 fixes this if missing)
Disk Space : Around 10 GB free for the full set of apps
Network : Working internet connection for APT and Flathub
Note:
I tested every command here on a Debian 13 GNOME install inside a KVM virtual machine (4 GB RAM, 2 vCPUs) and again on a ThinkPad T14 running KDE Plasma. Both started from the netinstall image with only a desktop task selected, which is what most experienced Debian users recommend because you add what you need instead of removing what you don't. Package names are the same on both desktops. The only difference is the Flatpak store plugin, which I point out in Step 2.
Step-1: Fix Sudo Access and Refresh Your Package Sources
Note:
Before you install a single app, make sure two things are right: your user can run sudo, and APT can see the contrib and non-free components. Some of the picks below (Microsoft fonts, Steam, a few codecs) live there and nowhere else.
Here is the mistake almost everyone hits once. You set a root password in the installer, and Debian quietly decides your normal user should not get sudo.
LinuxTeck
sudo apt update
linuxteck is not in the sudoers file.
Warning:
Don't try to "fix" this by editing /etc/sudoers with a normal text editor or by logging into the desktop as root. One typo in sudoers can lock you out of admin access completely. The safe fix is to switch to root with su - (note the dash, it loads root's PATH), add your user to the sudo group, then log out and back in. Group changes don't apply to sessions that are already open.
LinuxTeck
su -
usermod -aG sudo linuxteck
exit
Log out of the desktop, log back in, and check:
LinuxTeck
groups
See sudo in that list? Good. If you want finer control than "full admin or nothing", our guide on how to configure sudo in Linux covers per-command rules.
Note:
Next, open your sources file and make sure each entry lists all four components. On a fresh Debian 13 install this is usually /etc/apt/sources.list.d/debian.sources. On a system upgraded from Debian 12, you may still have the old /etc/apt/sources.list, and running sudo apt modernize-sources converts it for you. Debian keeps non-free software out of main because of its commitment to the free software definition, so enabling these components is a conscious choice, not a default.
LinuxTeck
sudo nano /etc/apt/sources.list.d/debian.sources
The Components line in each block should look like this:
URIs: http://deb.debian.org/debian
Suites: trixie trixie-updates
Components: main contrib non-free non-free-firmware
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
Types: deb
URIs: http://security.debian.org/debian-security
Suites: trixie-security
Components: main contrib non-free non-free-firmware
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
Save, then refresh and upgrade everything before you add anything new:
LinuxTeck
sudo apt update && sudo apt full-upgrade -y
Get:2 http://deb.debian.org/debian trixie-updates InRelease [47.3 kB]
Get:3 http://security.debian.org/debian-security trixie-security InRelease [43.4 kB]
Get:4 http://deb.debian.org/debian trixie/contrib amd64 Packages [53.8 kB]
Get:5 http://deb.debian.org/debian trixie/non-free amd64 Packages [104 kB]
Fetched 249 kB in 2s (124 kB/s)
All packages are up to date.
Summary:
Upgrading: 0, Installing: 0, Removing: 0, Not Upgrading: 0
Note:
Got an NVIDIA card? Do this now, before installing apps. Debian ships the proprietary driver in non-free, and nvidia-detect tells you which package your GPU needs. If a game or app misbehaves on the default Wayland session, pick GNOME on Xorg from the gear icon on the login screen.
LinuxTeck
sudo apt install nvidia-detect -y
nvidia-detect
sudo apt install nvidia-driver firmware-misc-nonfree -y
Reboot after the driver install so the new kernel module loads.
Step-2: Upgrade How You Install Software (Nala and Flatpak)
Note:
1. Nala is a friendlier front end for APT. It downloads packages in parallel, shows a clean summary before it changes anything, and keeps a history you can undo from. It doesn't replace APT. It just sits on top of it, so you can mix both freely.
LinuxTeck
sudo apt install nala -y
sudo nala fetch
nala fetch tests nearby mirrors and lets you pick the fastest ones. On slow connections this alone makes every later install noticeably quicker. After any install, nala history shows what you did and sudo nala history undo [ID] rolls it back.
Note:
2. Flatpak with Flathub fills the gap Debian Stable leaves on purpose: desktop apps that move fast. Install the matching store plugin so apps show up in your software center too. On GNOME that's gnome-software-plugin-flatpak. On KDE Plasma use plasma-discover-backend-flatpak instead.
LinuxTeck
sudo apt install flatpak gnome-software-plugin-flatpak -y
sudo flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
flatpak remotes
flathub system
Reboot once after adding Flathub. Skip it and your app menu won't show Flatpak apps until you do, which confuses a lot of people.
Note:
My rule of thumb: system tools, CLI tools and anything that touches the base system come from APT. Fast moving desktop apps (OBS, chat clients, games launchers) can come from Flathub. What you should never do is add an Ubuntu PPA or random third party repo to "get a newer version". Mixing repos built for other releases creates what Debian folks call a FrankenDebian, and it usually breaks on your next big upgrade.
Step-3: Install the Everyday Desktop Essentials
Note:
These five cover what most people do on a computer every day: browsing, documents, email, media and passwords. All of them come straight from Debian's own repos, so they get security fixes through your normal updates.
3. Firefox ESR is already installed. I'd keep it. ESR gets security patches promptly but skips feature churn, which fits the Debian mindset. If you want the rapid release version instead, Mozilla runs an official APT repository at packages.mozilla.org that installs a regular firefox package and updates through apt.
4. LibreOffice may already be on your system depending on the desktop task you picked. The part people miss is fonts. Documents from Windows users look wrong without the Microsoft core fonts, which live in contrib:
LinuxTeck
sudo apt install libreoffice libreoffice-gtk3 ttf-mscorefonts-installer -y
You'll get a license prompt for the fonts. Tab to OK and accept it. Those fonts are downloaded during install, so it needs a working connection.
5. Thunderbird handles mail, calendars and contacts in one place, and it plays well with most providers:
LinuxTeck
sudo apt install thunderbird -y
6. VLC plays basically anything. Pair it with the extra codec packages so videos also work in the browser and in GNOME's default player:
LinuxTeck
sudo apt install vlc libavcodec-extra gstreamer1.0-plugins-ugly gstreamer1.0-libav -y
gstreamer1.0-libav gstreamer1.0-plugins-ugly libavcodec-extra vlc
Installing dependencies:
libavcodec-extra61 vlc-bin vlc-data vlc-l10n vlc-plugin-base vlc-plugin-qt
vlc-plugin-video-output libdvbpsi10 libmpcdec6 liba52-0.7.4
Summary:
Upgrading: 0, Installing: 14, Removing: 0, Not Upgrading: 0
Download size: 21.4 MB
Space needed: 78.9 MB / 41.2 GB available
A complaint I see a lot from long time Debian users: VLC isn't always great at hardware video decoding on Linux. If your laptop fan spins up on every 4K video, try mpv. It's tiny, plays the same files, and does GPU decoding with one flag.
LinuxTeck
sudo apt install mpv -y
mpv --hwdec=auto video.mkv
7. KeePassXC is an offline password manager. Your vault is a single encrypted file you control, which is why I trust it more than any cloud option.
LinuxTeck
sudo apt install keepassxc-full -y
Note:
On Debian 13, KeePassXC comes in two builds. A plain sudo apt install keepassxc pulls in the full build through a transitional package, but I name keepassxc-full directly so there is no doubt you get browser integration. If you want the stripped down version with no networking, SSH agent or browser plugin, install keepassxc-minimal instead.
Step-4: Add Creative and Media Tools
Note:
Not everyone needs these, but if you edit images or record your screen, they are the best free options on Linux. GIMP is fine from APT. OBS is the one app where I'd usually reach for Flathub instead, since plugins and new features land there first.
8. GIMP. Debian 13 ships the 3.0 series, which finally brings non-destructive filters and a much nicer interface on high DPI screens:
LinuxTeck
sudo apt install gimp -y
gimp --version
9. OBS Studio for screen recording and streaming. Install from Flathub:
LinuxTeck
flatpak install flathub com.obsproject.Studio -y
Required runtime for com.obsproject.Studio/x86_64/stable (runtime/org.freedesktop.Platform/x86_64/25.08) found in remote flathub
ID Branch Op Remote Download
1. org.freedesktop.Platform 25.08 i flathub < 341.2 MB
2. com.obsproject.Studio stable i flathub < 128.6 MB
Installation complete.
Yes, that first install pulls in a big runtime. It's shared, so the next Flatpak that uses the same runtime will be much smaller.
Bonus picks if you do more creative work: Kdenlive for video editing, Audacity for audio, Flameshot for annotated screenshots, Okular for PDFs and Calibre for your ebook library. All five are open-source and live in Debian's main repo:
LinuxTeck
sudo apt install kdenlive audacity flameshot okular calibre -y
One more the community asks about constantly: yt-dlp. Use it, not the old youtube-dl, which is no longer maintained. Sites change fast and the Stable version ages quickly, so run apt policy yt-dlp to see if trixie-backports has a newer build before you reach for anything outside Debian.
Step-5: Set Up Developer and Terminal Tools
Note:
Even if you don't write code for a living, these are worth having. Half of the "how do I install X" guides out there assume git and a compiler are already present, and a good process monitor saves you the first time something eats your CPU.
10. Git and build-essential. One line, and you can clone projects and compile small tools from source:
LinuxTeck
sudo apt install git build-essential curl -y
git --version
New to git? Start with these essential git commands for Linux developers before you touch branches.
11. Visual Studio Code isn't in Debian's repos because of its license. The cleanest way to get it is extrepo, a Debian tool that adds vetted third party repos with the correct signing keys, so you're not pasting curl commands from a random blog.
Note:
By default extrepo only allows repos with free licenses. VS Code is non-free, so open /etc/extrepo/config.yaml and uncomment the - non-free line under enabled_policies first. If you skip this, extrepo will refuse with a policy error and it's not obvious why.
LinuxTeck
sudo apt install extrepo -y
sudo nano /etc/extrepo/config.yaml
sudo extrepo enable vscode
sudo apt update && sudo apt install code -y
Get:6 https://packages.microsoft.com/repos/vscode stable/main amd64 Packages [19.7 kB]
Fetched 23.3 kB in 1s (21.6 kB/s)
Installing:
code
Summary:
Upgrading: 0, Installing: 1, Removing: 0, Not Upgrading: 0
Download size: 106 MB
The nice part: VS Code now updates with the rest of your system through apt. Same trick works for a few other apps, run extrepo search to see what's available.
12. btop is a process monitor that shows CPU, memory, disk and network on one screen, with mouse support. If you already know the htop command, think of btop as htop with graphs.
LinuxTeck
sudo apt install btop fastfetch -y
Once that finishes, run fastfetch to see a quick summary of your system:
LinuxTeck
fastfetch
------------------
OS: Debian GNU/Linux 13 (trixie) x86_64
Kernel: Linux 6.12.94+deb13-amd64
Uptime: 42 mins
Packages: 2187 (dpkg), 3 (flatpak)
Shell: bash 5.2.37
DE: GNOME 48.4
CPU: AMD Ryzen 5 PRO 4650U (12) @ 2.10 GHz
Memory: 3.12 GiB / 15.03 GiB (21%)
Disk (/): 18.40 GiB / 97.87 GiB (19%) - ext4
fastfetch is a bonus. It's the quickest way to grab your system details when you ask for help on a forum.
A handful of terminal tools that come up in nearly every "what do you install first" thread: tmux keeps sessions alive when your SSH connection drops, ncdu shows what's eating your disk, and bat, fd-find and ripgrep are faster, friendlier versions of cat, find and grep.
LinuxTeck
sudo apt install tmux ncdu bat fd-find ripgrep -y
batcat --version
fdfind --version
Note:
Debian renames two of these to avoid clashes with older packages. bat runs as batcat and fd runs as fdfind. Beginners install them, type bat, get command not found and assume the install failed. Add alias bat=batcat and alias fd=fdfind to your ~/.bashrc if you want the short names.
Step-6: Protect and Maintain Your System
Note:
This is the step most "top apps" lists skip, and it's the one you'll be glad you did. Snapshots, a firewall and file sync turn Debian from "stable" into "stable and recoverable". Set these up before you start experimenting, not after something breaks.
13. Timeshift takes system snapshots so you can roll back a bad update or a broken driver in minutes. On a standard Debian install it uses rsync mode. Its Btrfs snapshot mode needs the Ubuntu style @ and @home subvolumes, and Debian's installer creates a single @rootfs subvolume instead, so stick with rsync unless you set up Btrfs by hand.
LinuxTeck
sudo apt install timeshift -y
sudo timeshift --create --comments "clean install with apps"
Mounted '/dev/vda1' at '/run/timeshift/3192/backup'
Creating new snapshot...(RSYNC)
Saving to device: /dev/vda1, mounted at path: /run/timeshift/3192/backup
Synching files with rsync...
Created control file: /run/timeshift/3192/backup/timeshift/snapshots/2026-11-11_21-14-07/info.json
RSYNC Snapshot saved successfully (58s)
Tagged snapshot '2026-11-11_21-14-07': ondemand
Keep in mind Timeshift protects the system, not your personal files. It excludes /home by default. For documents and photos you still need a real backup, and the Linux backup and restore cheat sheet has the commands I use.
14. UFW with GUFW. Debian doesn't enable a firewall by default. UFW makes it painless, and GUFW gives you a simple GUI if you prefer clicking:
LinuxTeck
sudo apt install ufw gufw -y
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw enable
sudo ufw status verbose
Firewall is active and enabled on system startup
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip
If you SSH into this machine, run sudo ufw allow ssh before enabling, or you'll lock yourself out of the remote session.
15. Syncthing keeps folders in sync between your devices directly, peer to peer, with no cloud account. It runs as a user service:
LinuxTeck
sudo apt install syncthing -y
systemctl --user enable --now syncthing.service
systemctl --user status syncthing.service --no-pager
Loaded: loaded (/usr/lib/systemd/user/syncthing.service; enabled; preset: enabled)
Active: active (running) since Wed 2026-11-11 21:19:33 IST; 4s ago
Docs: man:syncthing(1)
Main PID: 4127 (syncthing)
Tasks: 14 (limit: 18921)
Memory: 38.2M
Open http://127.0.0.1:8384 in your browser to add devices and folders. One tip from experience: sync works best when one device is always on. A small Debian VPS does that job really well for a few dollars a month, and I compared the options worth paying for in our best Linux VPS hosting guide.
Last one for this step, and it's a sysadmin favorite: needrestart. After every apt upgrade it checks which running services still use old libraries and offers to restart them, so security fixes actually take effect without a full reboot.
LinuxTeck
sudo apt install needrestart -y
Step-7: Verify Everything and Turn On Automatic Security Updates
Post-Install Checklist:
Run through this once after installing everything above. It takes about five minutes.
- Turn on automatic security updates with sudo apt install unattended-upgrades apt-listchanges, then sudo dpkg-reconfigure -plow unattended-upgrades and answer Yes.
- Clean out packages nothing depends on anymore with sudo apt autoremove, and unused Flatpak runtimes with flatpak uninstall --unused.
- Confirm the firewall is still active after a reboot with sudo ufw status.
- Take a second Timeshift snapshot now that everything is configured, so your rollback point is a working desktop, not a bare install.
- Bookmark our Linux package management cheat sheet for the apt, dpkg and flatpak commands you'll use from here on.
Quick check that automatic updates are really on:
LinuxTeck
cat /etc/apt/apt.conf.d/20auto-upgrades
APT::Periodic::Unattended-Upgrade "1";
Both values set to 1 means Debian will fetch and install security updates daily on its own. Here's the whole list in one place for reference:
| # | App | Package / Source | Why It Earns a Spot |
|---|---|---|---|
| 1 | Nala | nala (APT) | Faster, clearer installs with undo |
| 2 | Flatpak + Flathub | flatpak (APT) | Newer desktop apps without breaking Stable |
| 3 | Firefox ESR | firefox-esr (preinstalled) | Secure, stable browsing |
| 4 | LibreOffice | libreoffice (APT) | Full office suite, opens MS formats |
| 5 | Thunderbird | thunderbird (APT) | Mail, calendar and contacts |
| 6 | VLC | vlc (APT) | Plays almost any media file |
| 7 | KeePassXC | keepassxc-full (APT) | Offline password vault |
| 8 | GIMP | gimp (APT) | Serious image editing |
| 9 | OBS Studio | Flathub | Screen recording and streaming |
| 10 | Git + build-essential | APT | Clone and compile anything |
| 11 | VS Code | extrepo | Code editor that updates with apt |
| 12 | btop | btop (APT) | Visual system monitor |
| 13 | Timeshift | timeshift (APT) | System rollback in minutes |
| 14 | UFW + GUFW | ufw, gufw (APT) | Firewall that's easy to manage |
| 15 | Syncthing | syncthing (APT) | Private file sync between devices |
| Bonus | mpv | mpv (APT) | Light player with GPU decoding |
| Bonus | Kdenlive, Audacity, Flameshot, Okular, Calibre | APT | Video, audio, screenshots, PDFs, ebooks |
| Bonus | tmux, ncdu, bat, fd-find, ripgrep | APT | Everyday terminal upgrades |
| Bonus | needrestart | needrestart (APT) | Makes security updates take effect |
Conclusion
You now have the best Debian software for daily work, media, development and recovery, with every app coming from a source that won't fight your next upgrade. The next sensible move is tightening security, so work through our Linux hardening checklist next. Drop me your feedback/comments. Feel free to share this article with others if you like it.
Questions I Get Asked About This All the Time
I installed a .deb file from a website and now apt says I have broken dependencies. How do I fix it?
Run sudo apt --fix-broken install first. It will either pull in the missing dependencies or offer to remove the package causing the mess. Next time, install local .deb files with sudo apt install ./filename.deb instead of dpkg -i. The ./ matters, and apt resolves dependencies for you, which dpkg never does. Also check the .deb was built for Debian 13 and not for an Ubuntu release, because that's where most of these breakages come from.
The same app is in apt and on Flathub. Which one should I pick?
For anything that integrates deeply with the system, like shells, drivers, CLI tools or the firewall, use apt. For desktop apps where you actually care about new features, Flathub is usually the better choice, since the Debian version is frozen at release time. The tradeoff is disk space and occasional file access quirks because Flatpaks are sandboxed. If an app can't see a folder, the Flatseal app lets you adjust its permissions without the terminal.
Can I add an Ubuntu PPA to get a newer version of something?
Please don't. PPAs are built against Ubuntu's libraries, and even when the install works today, it tends to blow up during your next major upgrade. If you need a newer version of a Debian package, try trixie-backports first. Add the trixie-backports suite to your sources, run sudo apt update, then install with sudo apt install -t trixie-backports packagename. Backports are rebuilt for Stable, so they're safe to mix in. If it's not there, check Flathub.
I ran sudo apt install steam and it says the package can't be found. What am I missing?
Two things, usually. Steam lives in contrib (Step 1 covers enabling it), and it needs 32-bit libraries. Run sudo dpkg --add-architecture i386, then sudo apt update, and install the package called steam-installer, not steam. On first launch it downloads the actual client. If you have an NVIDIA card, install the 32-bit driver libraries too or most games will refuse to start.
The KeePassXC browser extension says it can't connect to the app. Why?
First check which build you have with apt policy keepassxc-full keepassxc-minimal. If the installed one is keepassxc-minimal, browser integration simply isn't compiled in. Swap it with sudo apt install keepassxc-full, which replaces it cleanly and keeps your database. Then open KeePassXC, go to Settings, Browser Integration, and tick your browser. Restart the browser after that, it won't pick up the change otherwise.
How do I completely remove an app I tried and didn't like, including its leftover config?
For apt packages, sudo apt purge appname removes the package and its system wide config files, then sudo apt autoremove clears dependencies nothing else needs. Your personal settings in ~/.config or ~/.local/share are never touched by apt, so delete those folders by hand if you want a truly clean slate. For Flatpaks, use flatpak uninstall --delete-data appid, which also removes the app's data under ~/.var/app.
Explore LinuxTeck for practical guides covering Rocky Linux, RHEL, AlmaLinux, Ubuntu, Debian, Fedora, Linux administration, shell scripting, networking, and enterprise Linux technologies.
