You’re reading this in your browser.
PrivacyTests
Every major browser, tested and scored.
Privacy Guides
Readable write-ups on what each feature does.
Blocks ads and trackers out of the box and works like any Chromium browser. Turn the crypto and rewards prompts off in settings.
Get Brave →
Firefox with the telemetry stripped and privacy turned up — a solid daily driver that still keeps your logins and tabs.
Get LibreWolf →
Built by the Tor Project to kill fingerprinting, but for everyday use: pair it with a VPN and you blend into a crowd of identical-looking users. Clears itself on close, fast enough for everyday use. Use this when you want day-to-day privacy without Tor's slowdown.
Get Mullvad Browser →
For when you need to be genuinely unlinkable — sensitive research, getting around censorship, protecting a source. Routes through the Tor network so no single party sees both who you are and what you're loading. Slower, and overkill for normal browsing.
Get Tor Browser →Runs its own index, so no Google or Bing sees your searches — and it's genuinely tunable. Goggles let you re-rank results with your own or shared rules: favor independent sites, bury SEO spam, build a lens for a topic. That customization is why it stays our pick even as rivals build their own indexes.
Try Brave Search →
Mostly Bing’s results with a privacy layer on top. Safari only lets you choose from five engines, and this is the one to pick there. Turn its ads off (Settings, General, Advertisements): clicking one of its ads is the one case where it still lets Microsoft track you. Why Brave Search over DuckDuckGo
Try DuckDuckGo →
French and privacy-respecting, and building its own European index (Staan) to cut its reliance on Bing. A reasonable default — but it still leans on Bing today, and has nothing like Goggles for shaping what you get back.
Try Qwant →
A small UK company that runs its own crawler and index of billions of pages, so its results come from neither Google nor Bing. It doesn’t log searches or IP addresses. The trade-off is depth: obscure or very new topics can come back thin.
Try Mojeek →
Funded by subscriptions, so you're the customer instead of the product — no ads, no profile, and domain re-ranking to bury SEO spam. Its results blend Google’s and Brave’s indexes with Yandex, Russia’s largest search engine, Mojeek, and a small index of its own. Still an account with a US company.
Try Kagi →
Run your own metasearch: it pulls from Google, Bing, and others without any of them profiling you, because the queries come from your server, not you. The maximalist option if you'll host it.
Set up SearXNG →The right messenger depends on your threat model — what you're guarding against, and which tradeoffs you're willing to accept. The two below are both worth recommending; they fit different needs, not a ranking.
Private texts and calls no one else can read — not even Signal. Free, works like a normal messaging app, and it's where the club organizes. Since 2024 you can connect by username without sharing your number — though a number is still required to create the account.
Get Signal →
No identifier at all — no phone number, email, or username. You connect by one-time link or QR code, so no directory maps a person to an account. Assessed twice by Trail of Bits. Newer and smaller, with no cloud backup.
Get SimpleX →- End-to-end encrypted by default — every chat and call.
- Keeps almost no metadata, so there's little it could ever turn over.
- Open-source, independently audited, run by a non-profit.
- Big enough that the people you text are already on it.
Briar — peer-to-peer over Tor, with no servers and no phone number. Built for high-risk or internet-blackout situations rather than everyday texting.
Session — another option with no phone number or account, on a smaller and newer network.
Discord isn’t a private messenger. It’s a community and voice platform, closer to a social network, and there’s no private tool that drops in to replace it — its servers see your messages, and there’s no end-to-end encryption for servers or DMs. But a lot of communities live there, so if you’re going to use it, Vesktop is an open-source client that carries no telemetry of its own, blocks Discord’s telemetry by default, and limits Discord’s access to your machine. It won’t make Discord private, since the servers still see everything, but it’s a cleaner client.
Free, open-source, and audited. A strong, unique password for every account, synced across your devices. The easy default that's also genuinely private.
Get Bitwarden →
End-to-end encrypted and audited, with a free tier. A natural fit if you already use Proton's Mail and VPN.
Get Proton Pass →
An offline vault stored as a file you control — nothing synced to anyone's cloud. You handle the backups; you hold the keys.
Get KeePassXC →
Your login codes, encrypted and synced across every device — iPhone, Android, desktop. Open-source, free, and end-to-end encrypted, from the team behind Ente Photos.
Get Ente Auth →
An offline authenticator for Android — your codes stay in an encrypted vault on the phone, nothing synced to a server. Open-source and free.
Get Aegis →
A physical key like a YubiKey that you tap to log in — phishing-proof and the strongest 2FA there is. It costs money and is more than most people need — but it's the most bulletproof option if you want it.
See YubiKey →Your password manager can store these codes too — Proton Pass and Bitwarden both offer it. Convenient, but it drops both factors into one vault: break into that and your second factor falls with the first. A separate authenticator keeps them apart — which is the whole point of a second factor.
A VPN moves who gets to watch you: your ISP stops seeing which sites you load, and the VPN company starts. Worth it if you trust them more, useless if you don’t, and it changes nothing about the accounts you’re logged into.
Privacy Guides
Criteria, audits, and the case against most providers.
Techlore
Every major VPN, side by side, filterable.
No account, no email — a random number, and you can mail them cash. Flat monthly rate, no logs, audited yearly. Built for this one job: it dropped port forwarding in 2023, and streaming services block it.
Get Mullvad →
Swiss and audited, with the one free tier worth using: unlimited data, no ads, the same no-logs policy as paid. Free is one device and ten countries; paid adds streaming, torrenting, and a student discount.
Get Proton VPN →
Two companies, one tunnel: Obscura runs the entry hop and can’t decrypt what it relays, Mullvad runs the exit and never sees your address. The app shows you the exit key so you can check it yourself. Young service — three connections, no Windows or Linux app.
Get Obscura →
If you pay Apple for storage you already have this and may not have switched it on. Same two-party idea, and free at that point — but Safari only, and it keeps you in your own region on purpose.
Turn it on →Platforms block addresses they recognize as a VPN’s — Mullvad documents this itself — and Utah’s SB 73 counts anyone physically in the state as local no matter what a VPN reports, though a federal judge blocked that rule in September 2026. See age verification.
Kape Technologies lists ExpressVPN, Private Internet Access, and CyberGhost as its own brands; Nord Security and Surfshark merged in 2022. A “top five VPNs” list can be five brands and two owners. See the capital behind surveillance.
Zero-access encryption on Swiss servers — only you hold the keys, not Proton. Open-source and audited, and one login also covers Calendar, Drive, and the VPN. Skip an identifying recovery email if you want to stay unlinkable.
Get Proton Mail →
Encrypts more than the rest — subject lines, contacts, and calendar too, with post-quantum crypto on by default. German and open-source; the catch is a walled garden, so no IMAP and no PGP to outside providers. Why Proton over Tuta
Get Tuta →
Built for PGP and standard protocols — an encrypted inbox, normal IMAP/SMTP, and it works with other PGP users. Around a euro a month, no free tier.
Get Mailbox Mail →
Proton-owned, Swiss, and open-source. Give every site its own address, kill any one when it starts drawing spam, and reply straight from the alias — replies work even on the free tier.
Get SimpleLogin →
Open-source and self-hostable, with automatic PGP on every tier — even free — so your mailbox provider never sees plaintext. UK-based, or run it yourself.
Get Addy.io →The “but everyone I email uses Gmail” problem
When you send from Proton Mail to a Gmail address, the message isn’t end-to-end encrypted at the other end — Google can read what lands in their inbox. There’s a workaround: Proton’s Password-Protected Emails feature (free, no PGP setup) lets you send an encrypted message to any address; the recipient gets a link and enters a password you’ve shared with them to unlock it. The message never lands in their Gmail inbox as plain text. There’s a limit: replies are capped on free plans. Tutanota (Tuta) has an equivalent. It’s not a fix for every email, but for anything genuinely sensitive, it does the job.
Free, encrypted DNS you can use without a Mullvad account, with ad, tracker, and malware-blocking variants. Point a device at it in minutes.
Set up Mullvad DNS →
Hosted like Mullvad's, but you choose the blocklists — granular control and per-device profiles. The free tier is plenty.
Get NextDNS →
Resolves queries itself instead of trusting an upstream, and keeps no query logs by default. The most private of these if you'll run a server.
Get Technitium →
Network-wide ad and tracker blocking on a cheap device, with the biggest blocklist community behind it.
Set up Pi-hole →
The same idea with the friendliest interface and strong per-device controls.
Get AdGuard Home →
The one cryptocurrency built for privacy: sender, receiver, and amount are hidden by the protocol itself, so there’s no public ledger to subpoena. The weak point is acquisition — buy from an exchange that checked your ID and you’ve made the record yourself.
About Monero →Mullvad already skips the email. Pay in Monero or cash by mail and the subscription isn’t tied to your name either; card and PayPal route through third parties that log everything.
How payments work →
Virtual card numbers in front of your real one: cap what each merchant can charge, kill the number when it misbehaves. But it’s a US company tied to your bank account, and it answers subpoenas like any bank. It hides you from merchants, not from your bank.
About Privacy.com →These range from a quick switch to a full hardened setup.
Privacy Guides
Hardening guides for Windows, macOS, Linux, Android, and iOS.
GrapheneOS
What phone hardening means, from the people who built it.
A closed OS can only promise what it does with everything it sees. An open one makes it structural.
Telemetry on by default, an advertising ID, and ads in the Start menu. Switch the advertising ID off under Settings → Privacy & security, and leave Recall off.
Closed, so you’re trusting Apple — but no ads in the OS. Turn off analytics and personalized ads under System Settings → Privacy & Security.
The easiest switch from Windows: a familiar desktop, huge community, and it just works.
Get Mint →
Clean GNOME, no telemetry layered on, SELinux enforcing by default. The pick if Mint feels too familiar.
Get Fedora →
Made to look and feel like Windows or macOS — the gentlest on-ramp for switchers.
Get Zorin →Hundreds more exist — Distrochooser helps you narrow it down.
Security by isolation: every app runs in its own VM, so a compromise stays contained. Tails and Whonix run inside it as templates. Steep hardware requirements and a learning curve.
Get Qubes →
An amnesic live system on a USB stick: everything routes through Tor, nothing survives shutdown.
Get Tails →
Splits the system into a Tor gateway and an isolated workstation, so even malware can’t find your real IP.
Get Whonix →Hardened Android for Pixels: Google removed entirely, or Play Services sandboxed if you still need them. Per-app network permissions and verifiable builds. Pixels only.
Get GrapheneOS →Closed, but the Secure Enclave makes a locked, updated iPhone genuinely hard to extract from. Turn off Siri and analytics, and use Lockdown Mode if you need it.
Every category has a pick to start with; the more-private options ask more of you for more control. We go deeper — Tor, email aliases, self-hosting — at meetings. Wondering why any of this matters? That's the third-party doctrine — the rule that lets the government reach this data in the first place.
Get involved
It’s free, open to everyone at Pitt, and joining takes about a minute.
No dues, no experience needed. Come to a meeting, or leave your name and we’ll tell you when the next one is.