Essential Tools for Privacy in Daily Life

Threat Modeling: Start Here Before Picking Any Tool

The most common privacy setup failure isn’t a weak tool. It’s someone installing Tails, Signal, a VPN and a password manager over one weekend, hitting friction on day nine, and quietly reverting all four. The setup that protects you is the one you’re still running in six months.

So the question before any tool is: what are you protecting, and from whom? Privacy isn’t a switch, it’s a spectrum, and the answer changes the entire kit. For most people the realistic adversaries are ad networks, data brokers, and an ISP with a commercial interest in your DNS queries — an annoyance-grade threat, defeated by DNS filtering and a hardened browser. That is a completely different problem from a journalist facing a state actor with device-seizure powers and the ability to correlate traffic timing.

Both directions cost something. Under-build and you leak by default. Over-build and you’ll be the person who stopped using encrypted email because attachments kept failing. Pick the level you can sustain, then move up deliberately.

Operating Systems: Desktop & Mobile Hardening

The OS is the root of the trust chain, and nothing above it can compensate for it. A VPN encrypts traffic leaving a machine that is already reporting your behaviour from inside the encryption. A browser extension can’t block telemetry emitted by the kernel. If the base is untrustworthy, everything layered on it is decoration.

That said, be honest about what each option costs you in daily use. The hardened choices below are ordered roughly by how much of your ordinary computing they break.

Desktop Environments

Mobile Environments

A phone is a tracking device that also makes calls, and no settings screen changes that. Reclaiming mobile privacy means replacing the firmware — which in practice means buying a specific handset, because the projects worth using target a narrow hardware list.

• GrapheneOS: The strongest option available, and Pixel-only — that hardware constraint exists because it depends on the verified-boot and secure-element guarantees Google’s own devices provide. Sandboxed Play services mean most apps still work without granting Google system-level access, alongside hardened memory allocation and per-app network and sensor permissions. The friction is real and specific: some banking apps refuse to run under attestation, and you cannot rely on that changing.
• DivestOS: Broader device support than GrapheneOS, with automated kernel patching and proprietary blobs stripped out. Wider hardware coverage necessarily means weaker per-device guarantees — an older handset with no vendor firmware updates cannot be made as secure as a current Pixel, whatever ROM you flash onto it. Check the project’s current status before committing to it — small ROM projects depend on a very short list of maintainers, and an unmaintained security ROM is worse than stock firmware that still gets patches.

Browsers: Fingerprinting and Tracking Protection

Private browsing windows do not stop tracking. They clear cookies when you close the window, which addresses the person who borrows your laptop and nobody else. Fingerprinting — canvas rendering, installed fonts, screen geometry, audio stack quirks — identifies the device itself, and incognito changes none of those values.

Which points at the counterintuitive rule for browsers: uniqueness is the enemy. A stack of privacy extensions makes you more identifiable, not less, because the combination is rare. The projects below take the opposite approach and make their users look identical to each other.

Credential Security & Encryption Tools

Encryption is the most reliable self-defence available to an ordinary person, mainly because it doesn’t depend on anyone’s good behaviour. A stolen laptop or an intercepted stream yields nothing without the key.

It also has the sharpest failure mode in this article: lose the key and the data is gone. Not recoverable-with-effort. Gone. Whatever you encrypt, decide where the recovery material lives before you turn it on — printed and in a drawer is a perfectly respectable answer for most threat models.

Password Managers

Reuse is what actually gets people. Credential-stuffing works because one breached forum password unlocks an email account, and the email account unlocks everything else through password reset. Use a dedicated manager rather than the browser vault.

• KeePassXC: Local-first and open-source; the encrypted .kdbx file sits on your machine, so no provider breach can reach it. You inherit the sync problem and the backup problem instead — and a corrupted .kdbx with no second copy is a genuinely bad afternoon.
• Bitwarden: Audited, open-source, cloud-synced, and the pragmatic default for most households because it works on every device without you building anything. Self-hosting via Vaultwarden removes the provider from the picture and makes you responsible for uptime and backups — worth it only if you’d genuinely maintain it.

Data & Storage Encryption

• VeraCrypt: The maintained successor to TrueCrypt, for encrypted containers and full volumes. Worth knowing that your OS probably already offers this — LUKS, BitLocker, FileVault — and the built-in option integrates with boot and sleep in ways a third-party container doesn’t. Reach for VeraCrypt when you need a portable container or cross-platform access.
• Cryptomator: Encrypts client-side before upload, so Drive or Dropbox hold ciphertext and a subpoena to the provider produces nothing readable. Filenames are encrypted too, which is the part people forget matters. The cost: no server-side search, no web preview, and sync conflicts get considerably harder to untangle.
• Age: Minimal file encryption that does away with most of GPG’s complexity and footguns. If your use case is “encrypt this file for this person”, it’s the better tool. If you need the web of trust, signatures or existing OpenPGP interoperability, you still need GPG.

VPNs: Shifting Trust, Not Eliminating It

A VPN relocates trust from your ISP to your VPN provider. That’s the whole transaction. It hides your address from destination sites and encrypts the local hop, which genuinely matters on hotel Wi-Fi and matters much less now that the web is almost entirely HTTPS.

What it does not do is make you anonymous. If you log into your own accounts through the tunnel, the tunnel is irrelevant — you’ve identified yourself at the far end. And a provider funded by selling traffic data is strictly worse than your ISP, because you’ve concentrated everything through one party you chose off a review site that was paid to recommend it. Providers worth using publish audits and take payment that isn’t tied to your identity.

Communication: Encrypted Email & Messaging

Email leaks metadata by design, and no provider fixes that. Headers carry sender, recipient, timestamps and routing, and encryption of the body doesn’t conceal any of it — who spoke to whom, when, is usually the more revealing dataset anyway. SMS is worse still: plaintext across carrier infrastructure, interceptable, and the reason SIM-swap attacks work.

The honest summary is that encrypted email is a partial fix and encrypted messaging is a real one. If a conversation genuinely matters, move it off email.

Encrypted Email Providers

• Proton Mail: Swiss jurisdiction, zero-access encryption at rest, PGP for external contacts. End-to-end only holds between Proton users or with a PGP correspondent; mail to a Gmail address arrives at Google in the clear, as it must.
• Tuta (formerly Tutanota): Encrypts subject lines and attachments as well as bodies, which most providers don’t. Its encryption isn’t OpenPGP-compatible, so external encrypted mail goes through a password-protected link rather than your correspondent’s existing key — better for people you can brief, worse for people you can’t.
• Email masking (SimpleLogin / Addy.io): A unique alias per signup kills spam at the source and, more usefully, tells you exactly which company sold your address. It also names a single point of failure: lose access to the alias provider and you lose the login path to every account behind it. Keep the important accounts on a real address.

Instant Messaging

• Signal: The benchmark, and the only one here your family will actually install. The protocol is the most scrutinised in the field, the clients are open source, and the organisation holds almost no metadata — a claim tested repeatedly by subpoenas that returned little beyond an account creation date. The residual cost is the phone number requirement, which ties an account to an identity even when usernames hide it from your contacts.
• Session: No phone number, no email, onion-routed through a decentralised network. Dropping the phone number is a real gain; it also forked away from Signal’s protocol, so it doesn’t inherit the same review history. Reasonable for pseudonymous contact, not the one to bet a source’s safety on.
• Briar: Peer-to-peer over Bluetooth, local Wi-Fi or Tor, with no server anywhere — which means it keeps working through an internet shutdown, the specific scenario it was built for. Also means no message history sync across devices and no delivery while both parties are offline.

Network-Level Ad & Tracker Blocking

This is the highest return per hour of anything in this article. One change, applied once, covers every device on the network — including the smart TV and the thermostat, which have no extension model and were never going to stop phoning home on their own.

• Pi-hole / AdGuard Home: Self-hosted DNS sinkholes, typically on a Raspberry Pi. Two warnings. It becomes single-point infrastructure — when it goes down, the household’s internet appears broken, so configure a second resolver before anyone else notices. And over-aggressive blocklists break things in confusing ways: a payment page that silently fails, an app that won’t log in. Both are the same lesson, which is that DNS filtering is invisible until it isn’t.
• NextDNS: Hosted filtering with the same blocklists and none of the maintenance, and it follows you onto mobile data and other people’s Wi-Fi — where Pi-hole can’t help. You’re handing your full query log to a third party in exchange, which is a different trade from the self-hosted version, not a strictly better one.

Advanced Tools & Financial Privacy

For people who want control over what leaves the machine, and over financial metadata:

• Safing Portmaster: An application-level firewall that shows every outbound connection your system attempts and lets you refuse them per app. Run it for an afternoon purely as an observation exercise — the list of things your ordinary software talks to is more educational than any article on the subject. Blocking indiscriminately will break software in ways that surface hours later, so start in monitor mode.

• Monero (XMR): Ring signatures, stealth addresses and RingCT keep sender, receiver and amount confidential by default, which is the opposite of Bitcoin’s permanently public ledger. The practical costs are considerable: several major exchanges have delisted it, liquidity is thinner, and in some jurisdictions holding or converting it draws scrutiny of its own. Privacy at the protocol layer doesn’t buy you privacy at the point where you enter or leave the system.

  [!IMPORTANT] Centralised peer-to-peer platforms like LocalMonero and AgoraDesk have shut down. To acquire Monero without KYC, use decentralised alternatives like Bisq, Haveno, or non-custodial atomic swap services over Tor.

Practical OPSEC for Daily Life

1. Use hardware MFA where you can. A security key or a local authenticator app (Aegis, or an equivalent on iOS) beats SMS codes, which a SIM swap defeats entirely — and SIM swaps are a social-engineering call to a carrier, not a technical attack. Buy two keys and enrol both. A single key is a single point of failure attached to your keyring.
2. Treat app permissions as grants, not defaults. Audit location, microphone and contacts, and revoke anything not actively in use. Contacts access is the one to be least generous with: it exposes other people, who didn’t agree to anything.
3. Minimise your metadata footprint. Aliases and VoIP numbers for non-essential signups. The address you never gave out can’t appear in a breach dump.
4. Compartmentalise. Banking, private conversation and casual browsing in separate browser profiles or VMs. This is the habit with the best ratio of protection to effort, and the one most often abandoned — because switching profiles is mildly irritating every single day. Set it up so the default profile is the restricted one.
5. Turn telemetry off explicitly. Windows, macOS, iOS and essentially every smart device ship with diagnostic sharing on. Go through the settings by hand, and check again after major OS updates, which have a habit of re-enabling things you switched off.

Recommended Privacy Communities

Tooling moves faster than any article can. Recommendations here will age; these keep current.

• Privacy Guides: Community-maintained successor to PrivacyTools.io, with criteria stated openly enough that you can disagree with a recommendation on the merits. Check it before adopting anything on this page.
• EFF Surveillance Self-Defense: Organised around threat models and situations rather than product lists, which is the right way round.
• Proton Privacy Blog: Good technical writing, from a company that also sells several of the products discussed. Read it with that in mind.

Two things worth carrying away. Threat models differ, so the correct setup for a journalist under surveillance is the wrong setup for someone who mostly wants ad networks out of their living room. And every item above costs something — money, speed, convenience, or a Saturday. Choose the smallest set that covers your actual exposure, keep it running, and add to it when the reason is concrete rather than aspirational.