The tools and tactics described on this page are provided strictly for personal security, digital hygiene, and the lawful defense of privacy under applicable international human rights frameworks. Users are responsible for complying with local laws. This page does not provide legal advice, and some tools may be restricted or banned in certain jurisdictions. Always assess your environment before use.
- →Update software promptly. Security patches close known vulnerabilities
- →Use passcodes and biometrics on every device
- →Never reuse passwords. Use a password manager
- →Never link personal accounts to anonymous ones
- →Minimize cloud syncing and location tracking
Messaging
Every message leaves a metadata trail: who contacted whom, when, and from where, even when the content itself is encrypted. Many regimes use these trails to map social networks and preemptively target perceived threats. Protecting your communication is both a legal right and a tactical necessity. Pair these tools with the compartmentalization practices in Identity Discipline. For identifier-free messaging beyond the three below, SimpleX Chat removes user IDs entirely.
Threema
A privacy-first, Swiss-based messaging app that charges a one-time fee and requires no phone number or email to register. Offers end-to-end encryption, anonymity by default, and self-hosted options for enterprise users. Servers are in Switzerland, the app is open-source, and it is regularly audited. The strongest choice for users who value security and independence from big tech ecosystems.
Session
A fully anonymous, decentralized messaging app that requires no phone number, email, or central server. Session runs on the decentralized Session Network and routes messages through onion-style hops, protecting both content and metadata. Ideal for users operating in repressive environments where association, identity, and traffic patterns must remain hidden. Trades speed and features for maximum privacy.
Signal
The gold standard for free, secure messaging. Offers end-to-end encryption for texts, calls, and media, and is trusted by journalists, activists, and professionals worldwide. Open-source, supported by a nonprofit foundation, with a strict no-data retention policy. Requires a phone number for registration, but its transparency and widespread adoption make it a reliable daily-use option.
Browsing
Every click, scroll, and search can be tracked, profiled, and weaponized. Browser fingerprints, cookies, and unsecured Wi-Fi expose users to tracking and compromise. Private browsing modes only delete local history. Networks, employers, and ISPs still see your traffic. Use hardened browsers and avoid personal logins when researching sensitive topics. Privacy Guides maintains current browser hardening recommendations.
NextDNS
An encrypted DNS service that filters trackers, ads, malware domains, and telemetry at the network level, hardening every browser and app on every device. Configurable blocklists, per-device profiles, and detailed query analytics. The free tier covers light use; the inexpensive paid tier removes query limits. Protects browsing everywhere rather than inside a single hardened browser.
Tor Browser
Provides the highest level of browsing anonymity by routing traffic through a global volunteer network. Hides your IP address, masks behavior, and resists surveillance, including by advanced actors. Slower than standard browsers, but the definitive tool for users in repressive or heavily monitored environments where identity exposure is unacceptable. For hardened daily browsing without Tor routing, Mullvad Browser applies the same fingerprinting defenses.
Brave Browser
A fast, secure browser that blocks ads, trackers, and fingerprinting out of the box with no configuration required. Excellent daily-use option for most users. Includes a built-in private search engine and optional Tor integration for added anonymity when needed. Strong default privacy protections without sacrificing usability.
Passwords & Storage
Passwords are the front line of your digital defenses and the most common point of failure. In hostile environments, compromised credentials can unravel entire resistance efforts. Strong, unique, and securely stored passwords are a non-negotiable layer of personal digital defense. Air-gapped or locally stored vaults are preferable in high-risk contexts.
1Password
A polished, full-featured password manager with strong encryption, cross-platform support, and team-sharing capabilities. Offers secure vault storage for passwords, documents, and sensitive notes with a seamless user experience. Its Travel Mode lets you hide sensitive vaults when crossing borders, a feature directly relevant to high-risk operational contexts.
KeePassXC
A fully offline, open-source password manager that stores your vault locally: no cloud, no sync, no third-party exposure. Ideal for air-gapped environments and users in jurisdictions with backdoor surveillance authority over cloud services. Technically demanding but provides maximum control. The vault file can be stored on encrypted offline media for additional security.
Bitwarden
A powerful, open-source password manager with a free tier supporting unlimited passwords, cross-device sync, browser integration, and mobile apps. Fully encrypted end-to-end, easy to use, and professionally audited. The best entry-level option for individuals seeking professional-grade protection. Self-hosting is available for users who want to eliminate third-party cloud dependency.
Device & Metadata Protection
Your phone is a sensor, a tracker, and a witness. Even when idle, it generates a steady stream of metadata: who you contacted, when, where you were, which networks you connected to. Adversaries rarely need to break encryption. Traffic volume, SIM movement, and app telemetry are enough to build a behavioral map. Device discipline extends the physical practices covered in Street Level Tactics.
SLNT Faraday Bags
Instant, portable signal isolation for your devices. Blocks cellular, Wi-Fi, Bluetooth, GPS, and RFID signals, preventing tracking, remote activation, and data leakage even when your phone appears idle. Ideal for sensitive meetings, travel, or high-surveillance areas. SLNT products are rugged, field-tested, and available for phones, tablets, and laptops.
Air-Gapped Device Preparation
For the highest-risk environments, physical isolation beats all wireless safeguards. Involves disabling or removing Wi-Fi and cellular radios, using encrypted backups on offline media, and managing data transfers via secure USB. Build a temporary offline device for storing sensitive content that transfers data only through controlled media and never touches the internet.
Simple Settings Hardening
A secure device starts with disciplined setup and maintenance. Enforcing strong locks, disabling unnecessary services (Bluetooth, hotspot, background GPS), and removing metadata (EXIF from photos) costs nothing. Configuring your OS, adopting a secure browser, and stripping built-in tracking minimizes your digital footprint with zero spend. The EFF’s Surveillance Self-Defense guides walk through the process for both Apple and Android devices.
Privacy Utilities
Privacy utilities actively obscure, minimize, or sanitize the digital traces you leave behind, from anti-tracking extensions and secure file shredders to sandboxing apps and DNS filtering. Used together, they form an essential privacy stack. Knowing which utilities to trust is part of the challenge: choose open-source, publicly audited tools. These utilities also support the verification workflows covered in Countering Misinformation.
DeleteMe
A subscription service that removes your name, address, phone number, and family details from data broker sites and people-search engines, then re-scans and re-removes on a continuing cycle. Reduces the exposure profile that enables doxxing, harassment, and physical targeting. Particularly relevant for anyone with an established public footprint. Optery is a comparable alternative that offers a free exposure report.
Tails OS
A secure, portable Linux-based operating system designed for high-risk users. Runs entirely from a USB stick, leaving no trace on the host computer, and routes all internet activity through the Tor network. Includes encrypted storage tools, secure messaging apps, and offline document handling. Trusted by journalists, whistleblowers, and those operating in denied or repressive environments.
uBlock Origin
The reference standard for open-source content blocking. Blocks ads, trackers, and malicious domains with minimal overhead, and its element picker strips page components that leak data. Fully supported on Firefox; Chrome users get the more limited uBlock Origin Lite due to Manifest V3 restrictions. A foundational layer for any privacy stack, and a practical reason to make Firefox your hardened daily browser.
VPNs & Network Privacy
Every connection exposes your IP address, location, and traffic. A VPN is not a complete anonymity solution on its own. Free VPNs can be traps, and some paid providers keep logs or cooperate with law enforcement. Choose providers with strict no-log policies, open-source clients, and transparent business models. VPN use is criminalized in some jurisdictions, so always check local laws. Know the Law covers how to assess your legal exposure.
Mullvad VPN
A privacy-first service based in Sweden with a strict no-logs policy and anonymous account creation that requires no email, only a randomly generated account number. Accepts cash payments by mail. Supports WireGuard, multihop routing, and bridge mode for obfuscation. Open-source and regularly independently audited. Minimal data collection makes it a top choice for users in high-risk or surveillance-heavy environments.
Outline VPN
An open-source tool built by Jigsaw (Google) to help journalists, NGOs, and at-risk individuals create and manage their own secure VPN servers. Rather than connecting to a public provider, users deploy a private server, removing third-party exposure entirely. Supports strong encryption and is designed to bypass censorship. One of the safest VPN frameworks for those operating in hostile digital environments.
Proton VPN
Operated by the team behind Proton Mail and based in Switzerland under strong privacy laws. Robust no-logs policy, Secure Core multi-hop routing, and integration with other Proton services. Offers a free tier with unlimited bandwidth and a paid tier unlocking higher speeds and more countries. Transparent policies and open-source apps make it a strong choice for both beginners and advanced users.
Accounts & Identity
Account takeover is the most common real-world compromise vector. Phishing kits, SIM swapping, and credential-stuffing attacks defeat passwords alone, and a captured email account unlocks everything attached to it. Two-factor authentication raises the cost of every one of those attacks, and hardware keys defeat phishing outright. Secure the accounts first; every other tool on this page assumes they hold.
YubiKey
Hardware security keys that make phishing-resistant two-factor authentication practical. The physical key must be present to log in, which defeats credential theft, SIM swapping, and remote phishing kits entirely. Supports FIDO2, WebAuthn, TOTP, and smart card modes across major platforms and services. A hardware key is the single strongest account security upgrade available at any price.
Aegis Authenticator
A free, open-source authenticator for Android that stores two-factor codes in an encrypted, password-protected vault with no cloud dependency. Codes never leave the device, and encrypted backups can be exported to offline media. Ideal where cloud-synced authenticators create seizure or subpoena exposure. Pair with a hardware key where services support both.
Proton Mail
Free, end-to-end encrypted email from the team behind Proton VPN, based in Switzerland. Zero-access encryption means Proton cannot read stored messages, and address aliases reduce exposure when registering for services. Open-source clients, independent audits, and a free tier sufficient for a secure primary account. The natural replacement for big tech email that links your identity across services.
Defensive Mindsets
// The Posture Behind the ToolsDigital security begins with a mindset. A defensive mindset is the habit of anticipating surveillance, preparing for compromise, and adapting behavior to reduce exposure. Every action online leaves a trail. Defensive thinking means recognizing that trail and deliberately shaping or minimizing it.
Adversaries rely on predictability. They exploit routine, assumption, and carelessness. A defensive mindset asks: What if this device is compromised? What if this account is monitored? What if this file is intercepted? It also includes emotional regulation. Adversaries use fear, urgency, and overconfidence to control you. Defensive thinking slows reactions, checks assumptions, and builds habits of caution. Surveillance rarely operates alone; it pairs with manipulation, and Countering Misinformation covers the information side of the same fight.
When operating in a high-risk setting:
- Assume your device can and will be compromised
- Always separate identities, locations, and communications
- Consider burner devices, offline notes, and plausible deniability
- Practice need-to-know: never transmit more than required
- Use decoy accounts with misinformation where appropriate
- Regularly rotate tools and credentials
- Disable biometrics during travel or protests
- Use a secure bootable OS for critical sessions
// Filter by Risk Level
// Browse by Category