Security for
People Who
Actually Mean It

No account required. You get a random number, no email, no name. Pay cash or Monero if you want. WireGuard and OpenVPN both well-implemented. Audits are published. If you're being serious about this, Mullvad is the answer.

Swiss jurisdiction, open-source clients, independently audited. Secure Core bounces your traffic through an extra hop in a privacy-friendly country before it exits. Useful if exit-node correlation is in your threat model. Works well with the Proton ecosystem.

Three relays. Traffic encrypted between each one. No single relay knows both who you are and what you're requesting. Right tool when you actually need network-level anonymity rather than just ISP privacy. Slow by design. Use it when you need it.

Note: exit nodes can be operated by governments or other interested parties. Anonymity is probabilistic, not guaranteed.

Boots from USB. Routes everything through Tor. Leaves nothing on the host when you shut down. Right tool when you need a clean session from hardware you don't fully trust. Journalists in hostile environments use it for a reason.

The Signal Protocol is the gold standard for messaging encryption. WhatsApp licensed it, which tells you something. Open source, audited, minimal metadata collection. Disappearing messages, sealed sender, note-to-self. Registration requires a phone number. Use a VoIP number if identity separation is part of your setup.

Zero-access encryption at rest. Proton can't read your inbox. Swiss jurisdiction. Has a .onion address. Sign up over Tor if you want a clean identity. E2EE only applies when both parties are on Proton or you're using PGP. The to/from/subject header is still metadata regardless.

German jurisdiction, open-source clients. Encrypts the subject line which is unusual and genuinely useful. Good Proton alternative if you want to diversify or prefer being under EU regulatory scope. Calendar and contacts encrypted too.

Generate email aliases that forward to your real address. Never hand out your actual inbox again. Service gets breached, you kill the alias. Owned by Proton now, integrates cleanly. Addy.io is the alternative if you want self-hostable.

Federated. You can run your own homeserver. E2EE in DMs and private rooms, cross-signing for device verification. Good when coordinating a team without depending on a commercial provider. More setup than Signal, justified when the control matters.

Each app, browser session, and network zone runs in its own Xen VM. A browser compromise can't touch your work files because they're in a separate VM entirely. Disposable VMs for one-off tasks. Hardware requirements are real, learning curve is real. Worth it when your threat model calls for it.

Hardened Android fork, Pixel hardware only. Hardened memory allocator, verified boot, per-app network/sensor/storage permissions, sandboxed Google Play that you can install or skip entirely. Right answer for a private Android phone. Install from their installer. Don't flash random builds from forums.

LUKS2 with Argon2id on Linux. VeraCrypt cross-platform, or if you need hidden volumes for plausible deniability. FDE protects against physical seizure. It does nothing to a running system or a compromised OS. Enable it, use a strong passphrase, don't leave machines unlocked and unattended.

Replaces proprietary BIOS/UEFI with open firmware. Heads adds measured boot and TPM attestation so you can verify the boot chain hasn't been tampered with. Relevant if physical interdiction or supply-chain firmware compromise is in scope. Specific ThinkPad models only.

Open source, audited, zero-knowledge. Self-host with Vaultwarden if you want to remove the server trust entirely. Works everywhere. Use a long Diceware passphrase for the master. Enable a hardware key for vault access.

Fully offline. Vault is an encrypted file you sync yourself. Syncthing handles this well. Nothing touches a server anywhere. FIDO2 hardware key unlock supported. Right choice when you don't want to trust any cloud infrastructure with your credentials.

FIDO2 hardware key. Phishing-resistant because authentication binds to the specific origin. A fake site can't intercept it. Buy direct from Yubico. Get two: one to use, one backup somewhere secure. Enable on every high-value account that supports it.

Open-source hardware alternative to YubiKey. Firmware is fully auditable. Also works as a hardware OpenPGP card. German company. Good choice if open hardware is part of your model.

Designed to reduce fingerprinting entropy on the clearnet. Applies Tor Browser-style hardening without requiring the Tor network. Defaults tuned to make users look similar to each other rather than unique. Pairs well with a VPN. Not a routing anonymity tool.

Currently the most mature anti-fingerprinting implementation available. Standardises window size, blocks identification APIs, isolates sites into separate contexts, reduces entropy from rendering behaviour. Both network and browser layer protection in one.

Can be made reasonably private with configuration. Disable telemetry. Keep extensions minimal. Consider canvas permission prompts and fingerprint-resisting settings. Out of the box it's not there, but it's the most configurable mainstream option.