You can install BleachBit on Ubuntu 26.04 LTS in three ways: the Universe package through APT, the official upstream .deb, or Flatpak from Flathub. APT is the lowest-maintenance route. The official DEB gets you the newest release. Flatpak suits people who already standardize on sandboxed apps.

Every Linux box eventually fills up. It might be a developer laptop with six months of browser caches, or a staging VPS where the package cache and rotated logs have eaten the last 2 GB of the root partition. Sooner or later someone types df -h, sees 97% on /, and starts deleting things by hand. That is where mistakes happen.

BleachBit exists for this situation. It knows where hundreds of applications hide their caches, temp files, thumbnails and logs. It can also overwrite files so they are harder to recover, which matters when you retire a machine or hand it to someone else.

Ubuntu 26.04 LTS, codenamed Resolute Raccoon, was released on 23 April 2026 and is supported until April 2031. Canonical highlights TPM-backed full-disk encryption and Rust-based utilities in this release. Those changes do not stop BleachBit from working. They do change a few details around sudo, encryption and what “secure deletion” can realistically promise.

This guide covers all three install methods and how to choose between them. It then goes through first-run configuration, command-line use, automation, hardening and troubleshooting, with the reasoning behind each step.

What BleachBit Does (and Doesn’t Do)

BleachBit is an open-source disk space cleaner and privacy tool for Linux and Windows. It works from “cleaners,” each a definition of files or actions tied to an application or system component. The Firefox cleaner knows where cache, cookies and session data live. The system cleaner handles tmp files, the APT cache, trash and so on.

Recent releases keep adding application coverage. Version 6.0.2 added cleaners for Visual Studio Code, Codium, Cursor, Windsurf and Claude Code, among others. Version 6.0.6 added cleaners for the Helium browser and Docker Desktop, and covers more crash reports and GPU caches. Developer workstations pile up gigabytes of editor and tooling cache, so this matters more than it sounds.

It does not replace proper storage hygiene. It will not fix a runaway log that grows 5 GB a day, because that is a logrotate problem. It will not shrink a bloated Docker image store or an oversized database. Treat it as a precise broom, not a fix for architecture problems.

Pick Your Install Method First

Most guides skip this step and go straight to apt install. That is a mistake, because the three methods behave differently once you factor in updates.

BleachBit’s own documentation points out that Ubuntu, Debian and Fedora follow a no-rolling-release policy. The version in the distribution repository is locked for the life of that release, and the project recommends its own packages if you want newer builds. The package lives in Universe on Ubuntu 26.04, 24.04 and 22.04.

A practical rule from fleet management: on servers, use APT and accept an older version. A cleaner that is a few releases behind is fine for apt caches and /tmp. On a developer desktop, use the official DEB, because new application cleaners (editors, browsers, AI tooling) are the main reason to run it at all. Flatpak is a middle path, but sandboxing limits what BleachBit can see, and that has real consequences covered later.

Prerequisites

Before touching anything, check a few basics.

• Ubuntu 26.04 LTS, desktop or server. BleachBit has a GUI and a CLI, and the CLI works fine over SSH.
• A user with sudo rights.
• Internet access to the Ubuntu mirrors, or to bleachbit.org and Flathub, depending on the method.
• The Universe component enabled (for the APT method).

Confirm the release first:

lsb_release -a
cat /etc/os-release
uname -m

The architecture matters for the DEB method. The all suffix on BleachBit’s Debian package means it is pure Python and architecture-independent, but always read the filename the download page gives you for your Ubuntu version.

Refresh the package index while you are at it:

sudo apt update
sudo apt upgrade -y

Doing the upgrade first avoids half-updated dependency states. A pending python3 or GTK update mid-install produces confusing errors.

Method 1: Install BleachBit with APT

This is the simplest option and the one most people should start with.

Enable Universe if needed

On a stock Ubuntu install Universe is already on. Minimal cloud images and containers sometimes lack it. Check with:

apt-cache policy bleachbit

If it returns nothing, enable the component:

sudo apt install software-properties-common -y
sudo add-apt-repository universe
sudo apt update

Install the package

sudo apt install bleachbit -y

APT pulls in Python 3, GTK bindings and a handful of helper libraries. On a headless server that can mean a surprising number of GUI-adjacent packages. If you only want the CLI on a server, you can reduce the footprint:

sudo apt install --no-install-recommends bleachbit -y

Test that the CLI still works afterward. Some features depend on recommended packages, and the only way to know is to run it.

Verify the installation

bleachbit --version
apt-cache policy bleachbit
which bleachbit

apt-cache policy shows the installed version, the candidate version and the repository it came from. Note the version number. You will want it when comparing against upstream.

Method 2: Install the Official DEB Package

When you want the current upstream release, this is the route. At the time of writing, BleachBit 6.0.6 is the newest release, and Neowin covered it on 18 October 2026. The 6.0.6 announcement adds native package support for Ubuntu 26.10 and openSUSE Leap 16.1. BleachBit also publishes separate .deb builds for Ubuntu 26.04, 24.04 and 22.04.

Download the right file

Go to the BleachBit Linux download page and choose the package that matches Ubuntu 26.04. Picking the wrong Ubuntu build is the most common mistake. Packages are tied to distribution releases for a reason: they are built against that release’s library versions.

If you prefer the terminal, download into a temp directory. Copy the exact URL from the download page rather than guessing it:

mkdir -p ~/bleachbit-install && cd ~/bleachbit-install
wget "PASTE_THE_URL_FROM_THE_DOWNLOAD_PAGE"
ls -lh

Verify the checksum

Skipping verification on a cleaner that can run as root is a poor habit. The download page lists SHA256 values. Compare them:

sha256sum bleachbit_*.deb

If the hash does not match the one on the site, delete the file and download again. A mismatch usually means a truncated download. It could also mean something worse, and either way you should not install it.

Install with APT, not dpkg

BleachBit’s documentation recommends apt over dpkg because apt resolves dependencies automatically. Use the local-file form, which needs the ./ prefix:

sudo apt install ./bleachbit_*.deb

Without ./, apt treats the argument as a package name and fails with “Unable to locate package.” This catches people constantly.

You may see a notice that the file is in a directory not accessible to the _apt sandbox user, or a warning about third-party packages. The first is harmless; it just means apt downloaded nothing and read the file directly as root. Moving the file to /tmp silences it if it bothers you.

Understand the update trade-off

A DEB install does not add a repository. That means apt upgrade will never bring you a newer BleachBit. If you installed 6.0.4 and 6.0.6 appears, you must download the new file and run the install again. Put a calendar reminder in place, or script the check.

One reasonable approach is a small shell function that fetches the download page and compares versions. If you manage more than a few machines, that is worth the afternoon it takes. For one or two desktops, checking manually every couple of months is enough.

Method 3: Install the Flatpak Version

sudo apt install flatpak -y
flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
flatpak install flathub org.bleachbit.BleachBit

Run it with:

flatpak run org.bleachbit.BleachBit

Flatpak gives you easy updates through flatpak update and keeps BleachBit’s dependencies away from the system Python. The cost is the sandbox. A cleaner needs to reach into other applications’ directories, and the sandbox restricts that. Expect it to miss caches belonging to apps outside the sandbox unless you grant extra filesystem permissions, for example:

flatpak override --user --filesystem=home org.bleachbit.BleachBit

That override widens access and weakens the reason for using Flatpak in the first place. For this particular tool, the APT or DEB method is usually the more honest choice.

First Launch and Safe Configuration

Open BleachBit from the application menu. You will see a list of cleaners on the left and a log pane on the right. Two launchers usually appear: one for your user and one “as administrator.” The second prompts for authentication through polkit.

Run as user versus root

This distinction trips up a lot of people.

• As your user: cleans your home directory caches, browser data, thumbnails, shell history if selected.
• As root: also cleans system-wide items like the APT cache, system logs, and other users’ temp files.

Do not run the GUI as root by default. Run it as your normal user for routine cleanup and escalate only when you need system-level cleaners. Launching GUI programs through sudo can also leave root-owned files in your home directory, which causes confusing permission errors later.

Ubuntu’s move toward Rust-based utilities, mentioned in Canonical’s 26.04 announcement, includes the sudo replacement. In practice, sudo bleachbit --clean ... on the CLI works as you would expect. For the GUI, use the “as administrator” launcher so polkit handles the elevation.

Preferences worth changing

Open the menu and go to Preferences.

1. Confirm before delete: leave it on until you trust your selection.
2. Overwrite contents of files to prevent recovery: off by default for good reasons, covered below.
3. Whitelist: add paths BleachBit must never touch. Anything under a project directory with a build/ or cache/ folder you depend on belongs here.
4. Languages: if you remove unused locale files, make sure you keep every language you may need.

The cardinal rule: preview first

Never tick a dozen boxes and click Clean on a machine that matters. Use the Preview button. It lists exactly what would be removed and how much space you would reclaim, and it removes nothing.

A concrete example: someone ticks “Deep Scan” and “Firefox: Passwords” together and wipes saved logins they never meant to lose. Preview would have shown the passwords entry in the output. Reading the preview takes thirty seconds.

Using BleachBit from the Command Line

The CLI is where BleachBit becomes useful for administrators. It works over SSH, in scripts, and from cron.

List available cleaners

bleachbit --list-cleaners

The output is a long list of cleaner.option identifiers such as system.cache or apt.autoclean. Filter it:

bleachbit --list-cleaners | grep -E '^(apt|system|journald|thumbnails)'

Preview, then clean

The same pairing as in the GUI:

bleachbit --preview apt.autoclean system.tmp
sudo bleachbit --clean apt.autoclean system.tmp

Run the preview as the same user who will run the real clean. A preview as a normal user does not show what root would find.

Common cleaners for servers

sudo bleachbit --preview apt.autoclean apt.autoremove apt.clean system.tmp system.trash journald.clean

• apt.clean removes all downloaded .deb files from /var/cache/apt/archives.
• apt.autoclean removes only packages that can no longer be downloaded.
• journald.clean vacuums the systemd journal. Be careful here: it deletes logs you may need for an incident review.

Desktop-oriented cleaners

bleachbit --preview firefox.cache chromium.cache thumbnails.cache system.recent_documents

Browser cache cleaning has a performance cost. After it runs, the first page loads are slower because everything is re-fetched. Doing it hourly is counterproductive. Weekly or only when space is short makes more sense.

Shredding files

bleachbit --shred ~/Documents/old-contract.pdf

This overwrites the file and then deletes it. Read the next section before relying on it.

Wiping free space

sudo bleachbit --wipe-free-space /home

This fills free space with data to overwrite remnants of previously deleted files. It is slow on large disks and generates heavy write load. Do not run it on a production database host during business hours. It will saturate disk I/O.

The Honest Truth About Secure Deletion

Overwriting works as advertised on a traditional spinning hard disk with a simple filesystem like ext4 in its default ordered mode. Beyond that, the guarantees weaken considerably.

• SSDs and NVMe: wear-leveling means the controller may write your “overwrite” to different physical cells, leaving the old data intact until garbage collection. Shredding a file does not reliably destroy it.
• Copy-on-write filesystems (Btrfs, ZFS): new data goes to new blocks by design, so old blocks persist.
• Snapshots and backups: a shredded file can still exist in last night’s snapshot.
• Journals and RAID: metadata and parity can retain traces.

The reliable answer for modern hardware is full-disk encryption plus discarding the key, or the drive’s own secure erase command (nvme format with the secure erase option, or hdparm --security-erase for SATA). Canonical’s TPM-backed full-disk encryption in 26.04 makes that approach more accessible on new installs. If a laptop was encrypted from day one, destroying the keys is a far stronger guarantee than any overwrite pass.

So when is BleachBit’s shredding still worthwhile? For removing the casual traces: browsing history, recent-file lists, and temporary files that would be visible to the next person who opens the file manager. That is a privacy cleanup, not forensic erasure.

Automating Cleanup with Cron or systemd

Manual cleanup works until you forget. Automation helps, but only if it is conservative.

A safe maintenance script

Create /usr/local/sbin/bleachbit-maint.sh:

#!/usr/bin/env bash
set -euo pipefail

LOG=/var/log/bleachbit-maint.log
{
  echo "=== $(date -Is) ==="
  df -h / | tail -1
  /usr/bin/bleachbit --clean apt.autoclean system.tmp
  df -h / | tail -1
} >> "$LOG" 2>&1

Make it executable:

sudo chmod 750 /usr/local/sbin/bleachbit-maint.sh
sudo chown root:root /usr/local/sbin/bleachbit-maint.sh

Logging the df output before and after gives you evidence of what the job accomplishes. If the numbers never change, remove the job. Scheduled tasks that do nothing are just future confusion.

A systemd timer

Timers are easier to inspect than cron and handle missed runs better.

/etc/systemd/system/bleachbit-maint.service:

[Unit]
Description=BleachBit maintenance cleanup

[Service]
Type=oneshot
ExecStart=/usr/local/sbin/bleachbit-maint.sh
Nice=19
IOSchedulingClass=idle

/etc/systemd/system/bleachbit-maint.timer:

[Unit]
Description=Weekly BleachBit maintenance

[Timer]
OnCalendar=Sun 03:30
Persistent=true
RandomizedDelaySec=15m

[Install]
WantedBy=timers.target

Enable it:

sudo systemctl daemon-reload
sudo systemctl enable --now bleachbit-maint.timer
systemctl list-timers | grep bleachbit

The Nice=19 and IOSchedulingClass=idle lines are not decoration. They tell the kernel this job should yield CPU and disk to everything else. On a busy web server, a cleanup that competes with PHP-FPM and MySQL for I/O at the wrong moment can cause visible latency. The RandomizedDelaySec setting matters when you manage many VMs on shared storage, because it stops them all hammering the datastore at the same second.

Performance Considerations

BleachBit is light, but a few points are worth knowing.

• CPU: scanning is mostly single-threaded Python. A full scan on a large home directory takes a while but rarely spikes CPU for long.
• RAM: modest. Expect tens of megabytes, more with a large “Deep Scan.”
• Disk I/O: the real cost. Scanning walks directory trees, and wiping free space writes at full disk speed. Use ionice -c3 for manual runs on shared hosts.
• Network: none during normal operation, apart from the download itself.

sudo ionice -c3 nice -n19 bleachbit --clean system.tmp

Avoid the Deep Scan cleaner on servers with millions of small files, such as mail stores or image caches. It will crawl them all. Choose targeted cleaners instead.

Troubleshooting Common Problems

“Unable to locate package bleachbit.” Universe is disabled or the package index is stale. Run sudo add-apt-repository universe && sudo apt update.

“E: Unsupported file ./bleachbit_x.deb given on commandline.” Usually a corrupted or incomplete download. Check the file size, re-download and verify the SHA256 checksum.

“Unable to locate package bleachbit_x.deb” when installing a DEB. You left off the ./. Use sudo apt install ./filename.deb.

Dependency errors on the official DEB. You probably picked a build for a different Ubuntu release. Remove it with sudo apt remove bleachbit, then download the Ubuntu 26.04 package. If it is only half-installed, run sudo apt --fix-broken install.

The GUI will not open, or crashes on launch. Run it from a terminal to see the error:

bleachbit --debug-log /tmp/bleachbit-debug.log

Missing GTK bindings are the typical cause, especially after installing with --no-install-recommends on a minimal system. Install them with sudo apt install python3-gi gir1.2-gtk-3.0.

Over SSH, “cannot open display.” The GUI needs a display. Use the CLI, or forward X with ssh -X. On Wayland sessions, remote GUI use is awkward, so the CLI is the better choice.

Cleaner does nothing for an application. Either the application is not installed in a location BleachBit expects (Snap and Flatpak apps keep data in different paths), or the cleaner needs root. Snap-packaged browsers store caches under ~/snap/<app>/, so classic cleaners may not find them. Check bleachbit --list-cleaners for the relevant entry, and see whether a newer upstream release adds support.

Permission denied during a clean. Run the specific cleaner with sudo, or check for immutable attributes with lsattr. If the files are owned by another user, you need elevated rights.

Version is older than the website. Expected with APT, because of the no-rolling-release policy. Switch to the official DEB if you need the newer release.

Flatpak version shows nothing to clean. Sandbox restrictions. Either grant filesystem access or install via APT.