Zero-access encryption on Swiss servers — only you hold the keys, not Proton. Open-source and audited, and one login also covers Calendar, Drive, and the VPN. Skip an identifying recovery email if you want to stay unlinkable.

Encrypts more than the rest — subject lines, contacts, and calendar too, with post-quantum crypto on by default. German and open-source; the catch is a walled garden, so no IMAP and no PGP to outside providers.

Built for PGP and standard protocols — an encrypted inbox, normal IMAP/SMTP, and it works with other PGP users. Around a euro a month, no free tier.

Proton-owned, Swiss, and open-source. Give every site its own address, kill any one when it starts drawing spam, and reply straight from the alias — replies work even on the free tier.

Open-source and self-hostable, with automatic PGP on every tier — even free — so your mailbox provider never sees plaintext. UK-based, or run it yourself.

Free, encrypted DNS you can use without a Mullvad account, with ad, tracker, and malware-blocking variants. Point a device at it in minutes.

Hosted like Mullvad's, but you choose the blocklists — granular control and per-device profiles. The free tier is plenty.

Resolves queries itself instead of trusting an upstream, and keeps no query logs by default. The most private of these if you'll run a server.

Network-wide ad and tracker blocking on a cheap device, with the biggest blocklist community behind it.

The same idea with the friendliest interface and strong per-device controls.

Mullvad already skips the email — you get a random account number, not a login tied to your identity. Pay for it in Monero (or cash by mail) and the subscription isn't linked to your name at all. Card and PayPal run through third parties that log everything, which quietly undoes the point.

Virtual card numbers that sit in front of your real bank card. Give each merchant its own number, cap what it can charge, and pause or delete it in a tap — so a breached store can't keep billing you, and the merchant never sees your real card or, usually, your real name. But this solves a different problem than Monero: Privacy.com is a US company tied to your actual bank account, it logs every transaction, and it answers subpoenas like any bank. It hides you from merchants and data brokers, not from your bank or the government. Reach for it to cut what online stores learn about you — not to be anonymous.

Collects diagnostic telemetry by default, assigns an advertising ID, and shows ads in the Start menu and lock screen; setup pushes a Microsoft account, and on newer Copilot+ PCs the opt-in Recall feature can periodically screenshot your screen. Turn down what you can in Settings → Privacy & security, switch off the advertising ID, and leave Recall off.

Closed, so you’re trusting Apple — but far less ad-driven than Windows, with no ads in the OS. Turn off analytics in System Settings → Privacy & Security → Analytics & Improvements, and personalized ads under Apple Advertising.

The easiest switch from Windows: a familiar desktop, huge community, and it just works.

Clean GNOME desktop with no extra telemetry layered on top, a fast release cycle, and SELinux enforcing by default. Red Hat–backed and ships the latest kernel — a solid all-purpose pick if Mint feels too familiar.

Made to look and feel like Windows or macOS — the gentlest on-ramp for switchers.

Security by isolation — every app and task runs in its own VM, so a compromise in one stays contained. Whonix is a first-party template (Qubes-Whonix), meaning you can run a Tor-routed browser or an air-gapped workstation as just another VM alongside your regular work; Tails also runs in a disposable VM. Serious hardware requirements and a learning curve — but nothing else matches it for a full desktop threat model.

An amnesic live system on a USB stick: it routes everything through Tor and leaves no trace when you shut down. Built for journalists, activists, and whistleblowers who need privacy without a permanent install.

Splits your system into a Tor gateway and an isolated workstation, so even malware can’t discover your real IP. Pairs naturally with Qubes.

The hardened Android build for Pixels that removes Google entirely — or sandboxes Play Services in a walled-off container if you still need them. Open-source with verifiable builds, per-app network-permission controls, hardened memory allocation, and forensic resistance comparable to a locked iPhone. Pixels only.

Closed source — you’re trusting Apple — but its Secure Enclave hardware encryption makes modern iPhones notably resistant to forensic extraction tools in a way stock Android is not. Turn off iCloud backup for anything sensitive, disable Siri and analytics under Settings → Privacy & Security, and enable Lockdown Mode if your threat model calls for it. A locked, updated iPhone is a strong baseline for most people.