🦄 A curated list of privacy & security-focused software and services
See the codeA curated list of privacy-respecting apps, software, and providers
[CodeBerg Mirror] | [Submit an Addition] | [Raw data & API]
Large data-hungry corporations dominate the digital world but with little, or no respect for your privacy. Migrating to open-source applications with a strong emphasis on privacy and security will help stop corporations, governments, and hackers from logging, storing or selling your personal data.
[!CAUTION] Remember that no software is perfect, and it is important to follow good security practices
📋 Contents
- Essentials
- Password Managers (8)
- 2-Factor Authentication (12)
- File Encryption (3)
- Browsers (5)
- Search Engines (6)
- Communication
- Encrypted Messaging (4)
- P2P Messaging (4)
- Encrypted Email (4)
- Email Clients (6)
- Mail Forwarding (4)
- Email Security Tools (3)
- VOIP Clients (2)
- Virtual Phone Numbers (8)
- Team Collaboration (5)
- Security Tools
- Browser Extensions (21)
- Mobile Apps (22)
- Online Tools (17)
- Networking
- Virtual Private Networks (7)
- Self-Hosted Network Security (8)
- Anonymity Networks (3)
- Proxies (2)
- DNS Providers (3)
- DNS Clients (5)
- Firewalls (14)
- Ad Blockers (7)
- Host Block Lists (5)
- Router Firmware (2)
- Network Analysis (3)
- Intrusion Detection (5)
- Cloud Hosting (4)
- Domain Registrars (2)
- DNS Hosting (1)
- Mail Servers (3)
- Productivity
- Digital Notes (9)
- Calendar (4)
- Scheduling (2)
- Task Management (3)
- Backup and Sync (4)
- Cloud Productivity Suites (4)
- Encrypted Cloud Storage (6)
- Secret Sharing (3)
- File Drop (2)
- Browser Sync (4)
- Habit Trackers (1)
- Secure Conference Calls (2)
- Maps & Navigation (1)
- Accessibility (1)
- Utilities
- Virtual Machines (3)
- PGP Managers (8)
- Metadata Removal (3)
- Data Erasers (8)
- Operating Systems
- Mobile Operating Systems (3)
- Desktop Operating Systems (5)
- Linux Defenses (7)
- Windows Defences (17)
- Mac OS Defences (2)
- Anti-Malware (2)
- Development
- Code Hosting (5)
- IDEs (1)
- Terminal Emulators (1)
- Developer Tools (3)
- Smart Home & IoT
- Smart Home (1)
- Security Cameras (1)
- Wearables & Health (1)
- Finance
- Cryptocurrencies (2)
- Crypto Wallets (6)
- Crypto Exchanges (2)
- Crypto Tools (1)
- Virtual Credit Cards (2)
- Other Payment Methods (3)
- Secure Budgeting (7)
- Social
- Social Networks (4)
- Video Platforms (2)
- Blogging Platforms (6)
- News Readers (1)
- Proxy Sites (4)
- Media
- Gaming (1)
- Video Players (1)
- Photo Management (2)
- Podcast Players (1)
- Torrent Downloaders (1)
- File Converters (2)
- Creativity
- Image Editors (8)
- Video Editors (7)
- Audio Editors & Recorders (1)
- Casting & Streaming (1)
- Screenshot Tools (1)
- 3D Graphics (2)
- Animation (1)
KeePass - Hardened, secure and offline password manager. Does not have cloud-sync baked in, deemed to be gold standard for secure password managers. KeePass clients: Strongbox (Mac & iOS), KeePassium (Mac & iOS)…
AliasVault - End-to-end encrypted open source password and alias manager with built-in email server. AliasVault protects your privacy by creating alternative identities, passwords and email addresses for every web…
PaperVault - Store secrets and passwords on encrypted paper with distributed keys. Designed to last generations. Open source, client-side only, works offline.
- Password Safe - An offline, open source password manager designed by Bruce Schneier, with native applications for Windows, Linux, MacOS, Android and iOS, and support for YubiKey. The UI is a little dated, and there is no official browser extension, making is slightly less convenient to use compared with other options
- PassBolt - A good option for teams. It is free, open source, self-hosted, extensible and OpenPGP based. It is specifically good for development and DevOps usage, with integrations for the terminal, browser and chat, and can be easily extended for custom usage, and deployed quickly with Docker
- 1Password - (proprietary) A fully-featured cross-platform password manager with sync. Free for self-hosted data (or $3/ month hosted). Be aware that 1Password is not fully open source, but they do regularly publish results of their independent security audits, and they have a solid reputation for transparently disclosing and fixing vulnerabilities
Other Open Source PM: Buttercup, Clipperz, Pass, Padloc, TeamPass, PSONO, UPM, Gorilla, Seahorse (for GNOME), GNOME Keyring, KDE Wallet Manager.
If you are using a deprecated PM, you should migrate to something actively maintained. This includes: Firefox Lockwise, Encryptr, Mitro, Rattic, JPasswords, Passopolis, KYPS, Factotum.
2FAS - Free, secure and open source authenticator app for both iOS and Android. Supports creating encrypted backups and syncing between devices without the need for an account.
Aegis - Free, secure and open source authenticator app for Android. Has a backup/ restore feature and a customisable UI with dark mode
Stratum - Free and open-source two factor authentication app for Android. It features encrypted backups, icons, categories and a high level of customisation. It also has a Wear OS companion app
Tofu - An easy-to-use, open-source two-factor authentication app designed specifically for iOS
Authenticator - Simple, native, open source 2-FA Client for iOS, which never connects to the internet - built by @mattrubin.me
Authenticator CC - Authenticator Extension is an in-browser One-Time Password (OTP) client, supports both Time-Based One-Time Password (TOTP, specified in RFC 6238) and HMAC-Based One-Time Password (HOTP, specified in RFC 4226…
Ente Auth - Free, open source TOTP authenticator for mobile, desktop and web. Works fully offline, or with an Ente account to sync codes across devices with end-to-end encrypted backups. Codes can be imported fro…
Bitwarden Authenticator - Bitwarden Authenticator is a free and open-source app which stores and generates time-based codes for multi-factor authentication. It can be used with an online account to backup and sync your tokens…
Proton Authenticator - Proton Authenticator is free, open source, and available for both iOS and Android. A Proton account is required to use Proton Authenticator. Existing 2FA codes can be imported from other popular apps…
Chronos Authenticator - Chronos Authenticator is a free, open-source two-factor authentication app for iOS, designed to provide robust security and reliable backup options.
Autheris - Open-source 2FA authenticator for iPhone, iPad, Mac and Apple Watch. Secrets stay in the device Keychain, with no account, no analytics and optional iCloud SyncOTPClient (Linux), gauth (Self-Hosted, Web-based), Etopa (Android)
For KeePass users, TrayTop is a plugin for managing TOTP's - offline and compatible with Windows, Mac and Linux.
Check which websites support multi-factor authentication: 2fa.directory
Cryptomator - Open source client-side encryption for cloud files - Cryptomator is geared towards using alongside cloud-backup solutions, and hence preserves individual file structure, so that they can be uploaded.…
age - 
age is a simple, modern and secure CLI file encryption tool and Go library. It features small explicit keys, no config options, and UNIX-style composabilityWhere possible, choose a cross-platform and well established encryption method, so that you are never faced with not being able to access your files using your current system.
Although well-established encryption methods are usually very secure, if the password is not strong, then an adversary may be able to gain access to your files, with a powerful enough GPU. If your system is compromised, then the password may also be able to be skimmed with a keylogger or other similar malware, so take care to follow good basic security practices
- AES Crypt - A light-weight and easy file encryption utility. It includes applications for Windows, Mac OS, BSD and Linux, all of which can be interacted with either through the GUI, CLI or programatically though an API (available for Java, C, C# and Python). Although it is well established, with an overall positive reputation, there have been some security issues raised recently.
- CryptSetup - is a convenient layer for use on top of dm-crypt. EncFS is a cross-platform file-based encryption module, for use within user local directories. geli is a disk encryption subsystem included with FreeBSD.
- BitLocker - is popular among Microsoft Windows and enterprise users, and provides fast, efficient and (if correctly configured) reasonably secure full drive encryption. However it is not open source, has poor compatibility with other operating systems, and has some very dodgy defaults, which could lead to your system being compromised. Similarly, Apple's FileVault on MacOS is easy and secure, but again, the source code is proprietary.
- DiskCryptor - Windows-only, open source, file and volume encryption solution, that makes a good alternative to BitLocker.
LibreWolf - An independent fork of Firefox hardened for privacy by default. No telemetry, uBlock Origin bundled, anti-fingerprinting, strict settings
Brave Browser - Chromium-based browser with strong built-in ad, tracker and fingerprint blocking, and timely Chromium security updates. Note that Brave does bundle potentially unwanted features, like crypto, rewards…
Firefox - The main independent browser, on Mozilla's own Gecko engine rather than Chromium. Reliable, long-standing, with frequent security updates, broad extension support and strong customization. However tel…
Tor Browser - Tor provides an extra layer of anonymity, by encrypting each of your requests, then routing it through several nodes, making it near-impossible for you to be tracked by your ISP. While excellent for a…
Mullvad Browser - A Firefox-based browser maintained in collaboration between the Tor Project and Mullvad. With strong anti-fingerprinting (so users look alike), no telemetry and uBlock Origin bundledNew vulnerabilities are being discovered and patched all the time - use a browser that is being actively maintained, in order to receive these security-critical updates.
Even privacy-respecting browsers, often do not have the best privacy options enabled by default. After installing, check the privacy & security settings, and update the configuration to something that you are comfortable with. 12Bytes maintains a comprehensive guide on Firefox Configuration for Privacy and Performance
- Cromite - Chromium fork and successor of Bromite. Adds built-in ad and tracker blocking, removes Google service calls, and disables several fingerprinting vectors. Note that patches often lag several weeks behind upstream> - WaterFox - Firefox fork with telemetry, studies and data collection removed. The legacy Classic line retains support for XUL/NPAPI extensions; the current Quantum-based release does not.> - PaleMoon - Independent Firefox-derived browser using its own Goanna engine. Disables telemetry and retains support for legacy XUL extensions. Lagging support for modern web-platform features (e.g. CSP) has led to incidents of Cloudflare blocking the browser.> - Iridium - Chromium fork with telemetry, background pings and most Google service integrations stripped out or made opt-in.> - SeaMonkey - All-in-one internet suite (browser, mail, IRC, HTML editor) derived from the Mozilla Application Suite. Receives security fixes but lags upstream Firefox on features.> - Ungoogled-Chromium - Chromium with all Google web service integrations, binary blobs and background calls removed. Tries to retain the default Chromium experience as closely as possible. No built-in auto-updates; relies on third-party rebuilds for security patches.> - Basilisk Browser - Firefox/UXP-based fork originally created by Moonchild Productions and independently maintained since 2022. Retains NPAPI plugin and XUL extension support dropped by mainline Firefox.> - IceCat - GNU's fully-free Firefox fork. Removes proprietary components such as DRM and EME, and bundles LibreJS to block non-free JavaScript. Tracks Firefox ESR, but release cadence lags upstream and can delay security fixes.
12Bytes maintains a list of privacy & security extensions.
DuckDuckGo - DuckDuckGo is a user-friendly and fast secure search engine. While it doesn't use trackers or cookies, there are search-related ads. It's also highly customisable, with theming, languages, bangs and p…
Brave Search - Brave Search is a privacy-focused search engine that does not track users or their searches, does not use secret algorithms or user profiling, and is based on its own search index.
Mojeek - British search engine providing independent and unbiased search results using its own crawler. Has a zero tracking policy (it is not open source)
Uruky - Uruky is an ad-free, private search engine focused on personalization. It uses, among other providers, Mojeek and Marginalia. It is EU-based and does not keep or track any personal data (it is not 100…
PriEco - PriEco is an independent web search engine with growing index. It is EU-based and 100% open source. It allows customization via Goggles.
- Qwant - French search engine, running on Bing results and the new European Search Perspective. Contains contextual, non-tracking ads. Privacy policy is out-dated, and Qwant does track users despite claiming not to. See full review for more info.
- MetaGear
- YaCy
- Searx - Self-hostable search engines that use the results of multiple other engines (such as Google and Bing) at the same time. They're open source and self-hostable, although using a public instance has the benefit of not singling out your queries to the engines used. A fork of the original Searx.
Signal - Probably one of the most popular, secure private messaging apps that combines strong encryption (see Signal Protocol) with a simple UI and plenty of features. It's widely used across the world, and ea…
SimpleX - Simplex is gaining popularity as a secure and private messaging app renowned for its robust encryption protocol without user IDs or phone numbers and this improves your privacy. Simplex offers instant…
XMPP - XMPP, also known as Jabber, is an open standard for decentralized messaging that has been widely used for decades. It has actually been the basis upon which WhatsApp, Facebook's Chat and Google's Talk…Many messaging apps claim to be secure, but if they are not open source, then this cannot be verified - and they should not be trusted. This applies to Telegram, Cypher, Wickr, Silent Phone and Viber, to name a few - these apps should not be used to communicate any sensitive data. Wire has also been removed, due to a recent acquisition
- Chat Secure
- KeyBase - Allows encrypted real-time chat, group chats, and public and private file sharing. It also has some nice features around cryptographically proving social identities, and makes PGP signing, encrypting and decrypting messages easy. However, since it was acquired by Zoom in 2020, it has no longer been receiving regular updates.
- OpenPGP - can be used over existing chat networks (such as email or message boards). It provides cryptographic privacy and authentication, PGP is used to encrypt messages.
Note/ Issues with PGP PGP is not easy to use for beginners, and could lead to human error/ mistakes being made, which would be overall much worse than if an alternate, simpler system was used. Do not use 32-bit key IDs - they are too short to be secure. There have also been vulnerabilities found in the OpenPGP and S/MIME, defined in EFAIL, so although it still considered secure for general purpose use, for general chat, it may be better to use an encrypted messaging or email app instead.- Threema - A paid, business-focused Swiss messenger. The apps are open source, but the server is proprietary.
With Peer-to-Peer networks, there are no central server, so there is nothing that can be raided, shut-down or forced to turn over data. There are P2P networks available that are open source, E2E encrypted, routed through Tor services, totally anonymous and operate without the collection of metadata.
Briar - Tor-based Android app for P2P encrypted messaging and forums. Where content is stored securely on your device (not in the cloud). It also allows you to connect directly with nearby contacts, without i…
Ricochet Refresh - Desktop instant messenger, that uses the Tor network to rendezvous with your contacts without revealing your identity, location/ IP or meta data. There are no servers to monitor, censor, or hack so Ri…
Jami - P2P encrypted chat network with cross-platform GNU client apps. Jami supports audio and video calls, screen sharing, conference hosting and instant messaging.
Tox & qTox client - Open source, encrypted, distributed chat network, with clients for desktop and mobile - see supported clients. Clearly documented code and multiple language bindings make it easy for developers to int…Email is not secure - your messages can be easily intercepted and read. Corporations scan the content of your mail, to build up a profile of you, either to show you targeted ads or to sell onto third-parties. Through the Prism Program, the government also has full access to your emails (if not end-to-end encrypted) - this applies to Gmail, Outlook Mail, Yahoo Mail, GMX, ZoHo, iCloud, AOL and more.
For a more details comparison of email providers, see email-comparison.as93.net
ProtonMail - An end-to-end encrypted anonymous email service. ProtonMail has a modern easy-to-use and customizable UI, as well as fast, secure native mobile apps. ProtonMail has all the features that you'd expect…
Tuta - Free and open source email service based in Germany. It has a basic intuitive UI, secure native mobile apps and desktop email clients, anonymous signup, and an encrypted calendar. Tuta has a full-feat…
Mailfence - Mailfence supports OpenPGP so that you can manually exchange encryption keys independently from the Mailfence servers, putting you in full control. Mailfence has a simple UI, similar to that of Outloo…
MailBox.org - A Berlin-based, eco-friendly secure mail provider. There is no free plan, the standard service costs €12/year. You can use your own domain, with the option of a catch-all alias. They provide good acco…
- When using an end-to-end encryption technology like OpenPGP, some metadata in the email header will not be encrypted.
- OpenPGP also does not support Forward secrecy, which means if either your or the recipient's private key is ever stolen, all previous messages encrypted with it will be exposed. You should take great care to keep your private keys safe.
Email clients are the programs used to interact with the mail server. For hosted email, then the web and mobile clients provided by your email service are usually adequate, and may be the most secure option. For self-hosted email, you will need to install and configure mail clients for web, desktop or mobile. A benefit of using an IMAP client, is that you will always have an offline backup of all email messages (which can then be encrypted and archived), and many applications let you aggregate multiple mailboxes for convenience. Desktop mail clients are not vulnerable to the common browser attacks, that their web app counterparts are.
Mozilla Thunderbird - Free and open source email application developed and backed by Mozilla -it's secure, private easy and customizable. As of V 78.2.1 encryption is built in, and the TorBirdy extension routes all traffic…
SnappyMail - Simple, modern, fast web-based mail client. This is an IMAP-only fork of RainLoop that mitigates a severe RainLoop vulnerability and adds several new features.…
RoundCube - Browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an email client, including MIME support, address book, folder manipulatio…
FairEmail - Open source, fully-featured and easy mail client for Android. Supports unlimited accounts and email addresses with the option for a unified inbox. Clean user interface, with a dark mode option, it is…
K-9 Mail - K-9 (or Thunderbird for Android) is open source, very well supported and trusted - k9 has been around for nearly as long as Android itself! It supports multiple accounts, search, IMAP push email, mult…One disadvantage of mail clients, is that many of them do not support 2FA, so it is important to keep your device secured and encrypted
Revealing your real email address online can put you at risk. Email aliasing allows messages to be sent to [anything]@my-domain.com and still land in your primary inbox. This protects your real email address from being revealed. Aliases are generated automatically, the first time they are used. This approach lets you identify which provider leaked your email address, and block an alias with 1-click.
Addy - An open source anonymous email forwarding service, allowing you to create unlimited email aliases. Has a free plan.
Firefox Private Relay - Developed and managed by Mozilla, Relay is a Firefox addon, that lets you make an email alias with 1 click, and have all messages forwarded onto your personal email. Relay is totally free to use, and…
Forward Email - Catch-all email forwarding service with unlimited aliases and custom domains, configured via DNS records. Self-hostable; the hosted version has a limited free plan, with paid plans (from $3/month) add…Some full email providers include aliasing or catch-all addresses as a built-in (usually premium) feature. For example, Proton (catch-all, plus hide-my-email aliases via Proton Pass), StartMail, mailbox.org and Posteo all offer this.
DKIM Verifier - Verifies DKIM signatures and shows the result in the e-mail header, in order to help spot spoofed emails (which do not come from the domain that they claim to).
Paperweight - Paperweight scans your inbox to map your digital footprint, then helps you take back control and delete your data.If you are using ProtonMail, then the ProtonMail Bridge enables you to sync & backup your emails to your own desktop mail client. It works well with Thunderbird, Microsoft Outlook and others
Mumble - Open source, low-latency, high quality voice chat software. You can host your own server, or use a hosted instance, there are client applications for Windows, MacOS and Linux as well as third-party ap…
Linphone - Open source audio, video and IM groups with E2E encryption and built-in media server. SIP-based evolving to RCS. Native apps for Android, iOS, Windows, GNU/Linux and MacOS.…
SMSPool - Don't feel comfortable giving out your phone number? Protect your online identity by using our one-time-use non-VoIP phone numbers. We support over 50+ countries and support over 300+ services.
Silent.link - Anonymous eSIM for sending / receiving SMS, incoming calls and 4G / 5G internet + world-wide roaming. No data is required at sign-up. Affordable pricing, with payments and top-ups accepted in BTC. Req…
Crypton.sh - Physical SIM card in the cloud, for sending + receiving SMS messages. Messages are encrypted using your chosen private key. Includes a web interface, as well as an API for interacting with it from any…
Jmp.chat - Phone number for incoming + outgoing calls and messages, provided by Soprani. Works with Jabber, Matrix, Snikket, XMPP or any SIP client. Pricing starts at $4.99 / month. Only available in the US and…
MoneroSMS - Anonymous SMS service able to activate accounts. Accessible over web, CLI, or email. Pricing starts at $3.60 / month. The service is in beta as of 2022.
PikaSim - Privacy-focused eSIM provider for 170+ countries, with instant eSIM delivery. No account, ID, email needed, and accepts crypto via a self-hosted BTCPay Server.
Narayana - Anonymous physical SIMs, eSIMs, VoIP phone numbers, and other advanced features. Inbound/outbound calls, SMS and roaming internet. Very private, has a Tor mirror, accepts crypto, doesn't KYC and you c…Now more than ever we are relying on software to help with team collaboration. Unfortunately many popular options, such as Slack, Microsoft Teams, Google for Work and Discord all come with some serious privacy implications.
Typical features of team collaboration software includes: instant messaging, closed and open group messaging, voice and video conference calling, file sharing/ file drop, and some level or scheduling functionality.
Rocket.Chat - Easy-to-deploy, self-hosted Slack alternative with polished cross-platform apps. End-to-end encryption is supported, but off by default - without it, workspace admins can read all messages. Usage stat…
Element - Privacy-focused messenger using the Matrix protocol. The Element client allows for group chat rooms, media sharing, voice and video group calls. End-to-end encryption by default for message content, b…
Mattermost - Self-hostable Slack alternative with native desktop, mobile and web apps, and many integrations. There's no end-to-end encryption, so the server can read all messages, and telemetry is on by default.…
Zulip - Open source team chat organized around topic-based threading, which keeps busy conversations easier to follow than channel-only tools. Can be self-hosted, or used as a paid cloud service. The threadin…
Xeres - A decentralized, encrypted P2P friend-to-friend app for chat, forums, channels, boards, voice calls and anonymous file sharing. Best for trusted contacts, as it isn't anonymous unless you route it thr…Some chat platforms allow for cross-platform group chats, voice and video conferencing, but without the additional collaboration features. For example, Tox, Mumble and Jami.
IRC is decentralized, easy to self-host and has a wide choice of clients, making it a good fit for open community channels and public project support. But there's no end-to-end encryption - TLS only protects the connection to the server, so operators can read all messages, and your IP may be exposed unless the network supports host cloaking. Avoid it for private or confidential team communication.
For Conferences, OSEM is an open source all-in-one conference management tool, providing Registration, Schedules, Live and Recorded Sessions, Paper Submissions, Marketing Pages and Administration.
The following browser add-ons give you better control over what content is able to be loaded and executed while your browsing.
Before installing anything, you should read the Word of Warning section below.
Privacy Badger - Blocks invisible trackers, in order to stop advertisers and other third-parties from secretly tracking where you go and what pages you look at. Less configurable but simpler than uBlock, and focuses o…
uBlock Origin - Block ads, trackers and malware sites. Download: Chrome - Firefox…
Firefox Multi-Account Containers - Firefox Multi-Account Containers lets you keep parts of your online life separated into color-coded tabs that preserve your privacy. Cookies are separated by container, allowing you to use the web wit…
WebRTC-Leak-Prevent - Provides user control over WebRTC privacy settings in Chromium, in order to prevent WebRTC leaks. Download: Chrome. For Firefox users, you can do this through browser settings. Test for WebRTC leaks,…
Canvas Fingerprint Blocker - Block fingerprint without removing access to HTML5 Canvas element. Canvas fingerprinting is commonly used for tracking, this extension helps to mitigate this through disallowing the browser to generat…
ClearURLs - This extension will automatically remove tracking elements from the GET parameters of URLs to help protect some privacy Download: Chrome - Firefox / Source…
Privacy-Oriented Origin Policy - Prevent Firefox from sending Origin headers when they are least likely to be necessary, to protect your privacy Download: Firefox - Source…
Decentraleyes - Similar to LocalCDN, Serves up local versions of common scripts instead of calling to 3rd-party CDN. Improves privacy and load times. Works out-of-the-box and plays nicely with regular content blocker…
Privacy Essentials - Simple extension by DuckDuckGo, which grades the security of each site. Download: Chrome \ Firefox…
User Agent Switcher - Spoofs browser's User-Agent string, making it appear that you are on a different device, browser and version to what you are actually using. This alone does very little for privacy, but combined with…
PrivacySpy - The companion extension for PrivacySpy.org - an open project that rates, annotates, and archives privacy policies. The extension shows a score for the privacy policy of the current website. Download:…
Skip Redirect - Some web pages use intermediary pages before redirecting to a final page. This add-on tries to extract the final url from the intermediary url and goes there straight away if successful Download: Firefox…
Web Archives - View archived and cached versions of web pages on 10+ search engines, such as the Wayback Machine, Archive.is, Google etc Useful for checking legitimacy of websites, and viewing change logs Download:…
Flagfox - Displays a country flag depicting the location of the current website's server, which can be useful to know at a glance. Click icon for more tools such as site safety checks, whois, validation etc Download…
Netcraft Extension - Notifies you when visiting a known or potential phishing site, and detects suspicious JavaScript (including skimmers and miners). Also provides a simple rating for a given site's legitimacy and securi…
LibRedirect - A browser extension that redirects popular sites to alternative privacy friendly frontends Download: Firefox - Chrome…
SponsorBlock - Crowdsourced browser extension that skips sponsored segments and other unwanted parts of YouTube videos using community-submitted timestamps. Download: Firefox - Chrome…
DeArrow - Crowdsourced browser extension that replaces YouTube video titles and thumbnails using community-submitted versions to stop clickbait. Download: Firefox - Chrome…
- Having many extensions installed raises entropy, causing your fingerprint to be more unique, hence making tracking easier.
- Much of the functionality of the above addons can be applied without installing anything, by configuring browser settings yourself. For Firefox this is done in the user.js
- Be careful when installing unfamiliar browser add-ons, since some can compromise your security and privacy. At the time of writing, the above list were all open source, verified and 'safe' extensions.
- In most situations, only a few of the above extensions will be needed in combination.
- See the arkenfox wiki for more information on the obsolescence and purposelessness of many popular extensions, and why you may only need a very limited set.
- Extension source viewer - A handy extension for viewing the source code of another browser extension, which is a useful tool for verifying the code does what it says
Orbot - System-wide Tor proxy, which encrypts your connection through multiple nodes. You can also use it alongside Tor Browser to access .onion sites.
NetGuard - A firewall app for Android, which does not require root. NetGuard provides simple and advanced ways to block access to the internet, where applications and addresses can individually be allowed or den…
Island - A sandbox environment, allowing you to clone selected apps and run them in an isolated box, preventing it from accessing your personal data, or device information.
Insular - An actively-maintained fork of the Island project with additional enhancements
Exodus - Shows which trackers, each of your installed apps is using, so that you can better understand how your data is being collected. Uses data from the Exodus database of scanned APKs.
Bouncer - Gives you the ability to grant permissions temporarily, so that you could for example use the camera to take a profile picture, but when you close the given app, those permissions will be revoked.
SuperFreezZ - Makes it possible to entirely freeze all background activities on a per-app basis. Intended purpose is to speed up your phone, and prolong battery life, but this app is also a great utility to stop ce…
Secure Task - Triggers actions, when certain security conditions are met, such as multiple failed login attempts or monitor settings changed. It does require Tasker, and needs to be set up with ADB, device does not…
Cryptomator - Encrypts files and folders client-side, before uploading them to cloud storage (such as Google Drive, One Drive or Dropbox), meaning none of your personal documents leave your device in plain text.
Fing App - A network scanner to help you monitor and secure your WiFi network. The app is totally free, but to use the advanced controls, you will need a Fing Box.
Blokada - This application blocks ads and trackers, doesn't require root and works for all the apps on your Android phone. Check out how it works here.
TrackerControl - Monitor and control hidden data collection in mobile apps about user behavior/ tracking. Get from F-Droid
Greentooth - Auto-disable Bluetooth, then it is not being used. Saves battery, and prevent some security risks. Get from F-Droid
PrivateLock - Auto lock your phone based on movement force/ acceleration. Get from F-Droid See also PluckLock
CamWings - Prevent background processes gaining unauthorized access to your devices camera. Better still, use a webcam sticker. ScreenWings - Prevent background processes taking unauthorized screenshots, which could expose sensitive data.
AFWall+ - Android Firewall+ (AFWall+) is an advanced iptables editor (GUI) for rooted Android devices, which provides very fine-grained control over which Android apps are allowed to access the network. Get fro…
Catch the Man-in-the-Middle - Simple tool, that compares SHA-1 fingerprints of the the SSL certificates seen from your device, and the certificate seen from an external network. If they do not match, this may indicate a man-in-the…
RethinkDNS & Firewall - An open-source ad-blocker and firewall app for Android 6+ (does not require root).
F-Droid - F-Droid is an installable catalogue of FOSS applications for Android. The client enables you to browse, install, and keep track of updates on your device.
Spectre - A radio frequency scanner app for Android with recon and offensive capabilities.Too many installed apps will increase your attack surface - only install applications that you need. Be sure to check the permissions, and what data an app has access to prior to installation. Only install from official sources.
For more open source security & privacy apps, check out these publishers: The Guardian Project (Play Store, F-Droid), The Tor Project (Play Store, F-Droid), Oasis Feng (Play Store), FairCode (Marcel Bokhorst) (Play Store, F-Droid), SECUSO Research Group (Play Store, F-Droid), and Fossify (Play Store, F-Droid) - all of which are trusted developers or organisations, who've done amazing work.
For offensive and defensive security, see The Kali Nethunter Catalogue of apps
For advanced users, the following tools can be used to closely monitor your devise and networks, in order to detect any unusual activity. [PortDroid] for network analysis, [Packet Capture] to monitor network traffic, [SysLog] for viewing system logs, [Dexplorer] to read .dex or .apk files for your installed apps, and [Check and Test] to check status and details of devices hardware.
A selection of free online tools and utilities, to check, test and protect your security
Have i been pwned - Checks if your credentials (Email address or Password) have been compromised in a data breach. See also Firefox Monitor.
εxodus - Checks how many, and which trackers any Android app has. Useful to understand how data is being collected before you install a certain APK, it also shows which permissions the app asks for.
Phish.ly - Analyzes emails, checking the URLs and creating a SHA256 and MD5 hash of attachments, with a link to VirusTotal. To use the service, just forward a potentially malicious or suspicious email to scan@ph…
Redirect Detective - Check where a suspicious URL redirects to (without having to click it). Lets you avoid being tracked by not being redirected via adware/tracking sites, or see if a shortened link actually resolves a l…
Blocked.org - Checks if a given website is blocked by filters applied by your mobile and broadband Internet Service Providers (ISP).
Virus Total - Analyses a potentially-suspicious web resources (by URL, IP, domain or file hash) to detect types of malware (note: files are scanned publicly).
Hardenize - Scan websites and shows a security overview, relating to factors such as HTTPS, domain info, email data, www protocols and so on.
Is Legit? - Checks if a website or business is a scam, before buying something from it.
10 Minute Mail - Generates temporary disposable email address, to avoid giving your real details.
Site Report - A tool from Netcraft, for analysing what any given website is running, where it's located and information about its host, registrar, IP and SSL certificates.Browsers are inherently insecure, be careful when uploading, or entering personal details.
Mullvad - Mullvad is one of the best for privacy, they have a totally anonymous sign up process, you don't need to provide any details at all, you can choose to pay anonymously too (with Monero, BTC or cash).
Azire - Azire is a Swedish VPN provider, who owns their own hardware with physically removed storage and a no logging policy. Pricing starts at €3.25/mo, with crypto (including XMR) supported. Note that they'…
IVPN - Independently Security Audited VPN with anonymous signup, no logs, no cloud or customer data stored, open-source apps and website. Strong ethics: no trackers, no false promises, no surveillance ads. A…
ProtonVPN - From the creators of ProtonMail, ProtonVPN has a solid reputation. They have a full suite of user-friendly native mobile and desktop apps. ProtonVPN is one of the few "trustworthy" providers that also…
Party VPN - Crypto-native VPN with pay-as-you-go pricing. Accepts cryptocurrency only, including Monero. WireGuard and AmneziaWG protocols, no-logs policy, REST API for developers. No subscriptions or credit card…
Windscribe - An audited and court-proven VPN with a free 10GB plan, in-RAM servers, browser extensions and open source WireGuard/IKEv2/OpenVPN clients. Supports split tunneling, customizable DNS blocking, MAC spoo…
- A VPN does not make you anonymous - it merely changes your public IP address to that of your VPN provider, instead of your ISP. Your browsing session can still be linked back to your real identity either through your system details (such as user agent, screen resolution even typing patterns), cookies / session storage, or by the identifiable data that you enter. Read more about fingerprinting
- Logging - If you choose to use a VPN because you do not agree with your ISP logging your full browsing history, then it is important to keep in mind that your VPN provider can see (and mess with) all your traffic. Many VPNs claim not to keep logs, but you cannot be certain of this (VPN leaks). See this article for more
- IP Leaks - If configured incorrectly, your IP may be exposed through a DNS leak. This usually happens when your system is unknowingly accessing default DNS servers rather than the anonymous DNS servers assigned by an anonymity network or VPN. Read more: What is a DNS leak, DNS Leak Test, How to Fix a DNS Leak
- Stealth - It will be visible to your adversary that you are using a VPN (usually from the IP address), but other system and browser data, can still reveal information about you and your device (such as your local time-zone, indicating which region you are operating from)
- Many reviews are sponsored, and hence biased. Do your own research, or go with one of the above options
- Using Tor (or another Mix Network) may be a better option for anonimity
If you don't trust a VPN provider not to keep logs, then you could self-host your own VPN. This gives you you total control, but at the cost of anonymity (since your cloud provider, will require your billing info). See Streisand, to learn more, and get started with running a VPN. Digital Ocean provides flexible, secure and easy Linux VMs, (from $0.007/hour or $5/month), Here is a 1-click install scriptfor on Digital Ocean, by Carl Friess. Recently distributed self-hosted solutions for running your own VPNs have become more popular, with services like Outline letting you spin up your own instance and share it with friends and family. Since it's distributed, it is very resistant to blocking, and gives you world-wide access to the free and open internet. And since you have full control over the server, you can be confident that there is no logging or monitoring happening. However it comes at the cost of anonymity, especially if it's only you using your instance.
While choosing a VPN, consider the following: Logging policy (logs are bad), Jurisdiction (avoid 5-eyes), Number of servers, availability and average load. Payment method (anonymous methods such as BTC, Monero or cash are better), Leak protection (1st-party DNS servers = good, and check if IPv6 is supported), protocols (OpenVPN and WireGuard = good). Finally, usability of their apps, user reviews and download speeds.
Fun little projects that you can run on a Raspberry Pi, or other low-powered computer. In order to help detect and prevent threats, monitor network and filter content
Pi-Hole - Network-level advertisement and Internet tracker blocking application which acts as a DNS sinkhole. Pi-Hole can significantly speed up your internet, remove ads and block malware. It comes with a nice…
IPFire - A hardened, versatile, state-of-the-art open source firewall based on Linux. Its ease of use, high performance and extensibility make it usable for everyone.
PiVPN - A simple way to set up a home VPN on any Debian server. Supports OpenVPN and WireGuard with elliptic curve encryption keys up to 512 bit. Supports multiple DNS providers and custom DNS providers - wor…
E2guardian - Powerful open source web content filter.
PF Sense - Widely used, open source firewall/router.
Zeek - Detect if you have a malware-infected computer on your network, and powerful network analysis framework and monitor. Tor - Tor provides robust anonymity, allowing you to defend against surveillance, circumvent censorship and reduce tracking. It blocks trackers, resists fingerprinting and implements multi-layered encryptio…To provide low-latency browsing, Tor does not mix packets or generate cover traffic. If an adversary is powerful enough, theoretically they could either observe the entire network, or just the victims entry and exit nodes. It's worth mentioning, that even though your ISP can not see what you are doing, they will be able determine that you are using a mix net, to hide this - a VPN could be used as well. If you are doing anything which could put you at risk, then good OpSec is essential, as the authorities have traced criminals through the Tor network before, and made arrests. Don't let Tor provide you a false sense of security - be aware of information leaks through DNS, other programs or human error. Tor-supported browsers may might lag behind their upstream forks, and include exploitable unpatched issues. See #19
Note: The Tor network is run by the community. If you benefit from using it and would like to help sustain uncensored internet access for all, consider running a Tor relay
Tor, I2P and Freenet are all anonymity networks - but they work very differently and each is good for specific purposes. So a good and viable solution would be to use all of them, for different tasks. You can read more about how I2P compares to Tor, here
A proxy acts as a gateway between you and the internet, it can be used to act as a firewall or web filter, improves privacy and can also be used to provide shared network connections and cache data to speed up common requests. Never use a free proxy.
ShadowSocks - Secure socks5 proxy, designed to protect your Internet traffic. Open source, superfast, cross-platform and easy to deploy, see GitHub repo.
Privoxy - Non-caching web proxy with advanced filtering capabilities for enhancing privacy, modifying web page data and HTTP headers, controlling access, and removing ads and other obnoxious Internet junk.Malicious Proxies are all too common. Always use open source software, host it yourself or pay for a reputable cloud service. Never use a free proxy; it can monitor your connection, steal cookies and contain malware. VPNs are a better option, better still - use the Tor network.
V2ray-core is a platform for building proxies to bypass network restrictions and protect your privacy. See more TransparentTorProxy is a Linux CLI utility that transparently routes all system traffic through the Tor network.
Without using a secure, privacy-centric DNS all your web requests can be seen in the clear. You should configure your DNS queries to be managed by a service that respects privacy and supports DNS-over-TLS, DNS-over-HTTPS or DNSCrypt.
CloudFlare - One of the most performant options, Cloudflare's DNS supports DoH and DoT, and has a Tor implementation, providing world-class protection. They have native cross-platform apps, for easy set-up.
AdGuard - Open-source DNS provider, specialising in the blocking of ads, trackers and malicious domains. They have been independently audited and do not keep logs.Using an encrypted DNS resolver will not make you anonymous, it just makes it harder for third-partied to discover your domain history. If you are using a VPN, take a DNS leak test, to ensure that some requests are not being exposed.
- Quad9 - A well-funded, performant DNS with a strong focus on privacy and security and easy set-up, however questions have been raised about the motivation of some of the financial backers.
- BlahDNS - (Japan, Finland or Germany) is an excellent security-focused DNS> - OpenNIC - NixNet DNS and UncensoredDNS are open source and democratic, privacy-focused DNS
- Unbound - A validating, recursive, caching DNS resolver, designed to be fast and lean. Incorporates modern features and based on open standards
- Clean Browsing - A good option for protecting kids, they offer comprehensive DNS-based Content Filtering
- Mullvad - Mullvads public DNS with QNAME minimization and basic ad blocking. It has been audited by the security experts at Assured. You can use this privacy-enhancing service even if you don't use Mullvad.
DNS Protocols
DNS-over-TLS was proposed in RTC-7858 by the IETF, then 2 years later, the DNS-over-HTTPS specification was outlined in RFC8484 in October '18. DNSCrypt, is a protocol that authenticates communications between a DNS client and a DNS resolver. It prevents DNS spoofing, through using cryptographic signatures to verify that responses originate from the chosen DNS resolver, and haven't been tampered with. DNSCrypt is a well battle-tested protocol, that has been in use since 2013, and is still widely used.
Unbound - Validating, recursive, caching DNS resolve with support for DNS-over-TLS. Designed to be fast, lean, and secure Unbound incorporates modern features based on open standards. It's fully open source, an…
Nebulo - Non-root, small-sized DNS changer utilizing DNS-over-HTTPS and DNS-over-TLS. (Note, since this uses Android's VPN API, it is not possible to run a VPN while using Nebulo.)
RethinkDNS & Firewall - Free and open source DNS changer with support for DNS-over-HTTPS, DNS-over-Tor, and DNSCrypt v3 with Anonymized Relays. (Note, since this uses Android's VPN API, it is not possible to run a VPN while…
Stubby - Acts as a local DNS Privacy stub resolver (using DNS-over-TLS). Stubby encrypts DNS queries sent from a client machine (desktop or laptop) to a DNS Privacy resolver increasing end user privacy. Stubby…A firewall is a program which monitors the incoming and outgoing traffic on your network, and blocks requests based on rules set during its configuration. Properly configured, a firewall can help protect against attempts to remotely access your computer, as well as control which applications can access which IPs.
NetGuard - Provides simple and advanced ways to block access to the internet. Applications and addresses can individually be allowed or denied access to Wi-Fi and/or mobile connection. AFWall+ - Android Firewall+ (AFWall+) is an advanced iptables editor (GUI) for rooted Android devices, which provides very fine-grained control over which Android apps are allowed to access the network. RethinkDNS & Firewall - An open-source ad-blocker and firewall app for Android 6+ (does not require root).
SimpleWall - Tool to control Windows Filtering Platform (WFP), in order to configure detailed network activity on your PC. (Windows)
LuLu - Free, open source macOS firewall. It aims to block unknown outgoing connections, unless explicitly approved by the user.
Little Snitch - A very polished application firewall, allowing you to easily manage internet connections on a per-app basis. (Mac OS)
OpenSnitch - Makes internet connections from all apps visible, allowing you to block or manage traffic on a per-app basis. GNU/Linux port of the Little Snitch application firewall.
Gufw - Open source GUI firewall for Linux, allowing you to block internet access for certain applications. Supports both simple and advanced mode, GUI and CLI options, very easy to use, lightweight/ low-over…iptables much more easily. IPFire - IPFire is a hardened, versatile, state-of-the-art Open Source firewall based on Linux. Easy to install on a raspberry Pi, since it is lightweight and heavily customizable.
BunkerWeb - BunkerWeb is an open-source Next-Generation Web Application Firewall (WAF). It provides easy protection for your web services and is designed to remain secure by default. It integrates seamlessly with…
OPNSense - Enterprise firewall and router for protecting networks, built on the FreeBSD system.There are different types of firewalls, that are used in different circumstances. This does not omit the need to configure your operating systems defences. Follow these instructions to enable your firewall in Windows, Mac OS, Ubuntu and other Linux distros.
Even when properly configured, having a firewall enabled does not guarantee bad network traffic can not get through and especially during boot if you don't have root privileges.
There are a few different ways to block ads - browser-based ad-blockers, router-based / device blockers or VPN ad-blockers. Typically they work by taking a maintained list of hosts, and filtering each domain/ IP through it. Some also have other methods to detect certain content based on pattern matching
Pi-Hole - Incredibly powerful, network-wide ad-blocker. Works out-of-the-box, light-weight with an intuitive web interface, but still allows for a lot of advanced configuration for power users. As well as block…
Diversion - A shell script application to manage ad-blocking, Dnsmasq logging, Entware and pixelserv-tls installations and more on supported routers running Asuswrt-Merlin firmware, including its forks.
hBlock - A POSIX-compliant shell script, designed for Unix-like systems, that gets a list of domains that serve ads, tracking scripts and malware from multiple sources and creates a hosts file (alternative for… RethinkDNS & Firewall - Free and open source ad-blocker and a firewall for Android 6+ (no root required). uBlock Origin - Light-weight, fast browser extension for Firefox and Chromium (Chrome, Edge, Brave Opera etc), that blocks tracking, ads and known malware. uBlock is easy-to-use out-of-the-box, but also has a highly…
AdGuard Home - Self-hosted, network-wide DNS server that blocks ads and trackers for every device on your network, comparable to Pi-hole. Open source, with a web dashboard, encrypted DNS, and parental controls. Need…Some VPNs have ad-tracking blocking features, such as TrackStop with PerfectPrivacy.
Private Internet Access, CyberGhost, PureVPN, and NordVPN also have ad-block features. But do not meet security/privact requirements to be included.
Hosts by StevenBlack - Open source, community-maintained consolidated and extending hosts files from several well-curated sources. You can optionally pick extensions to block p0rn, Social Media, gambling, fake news and othe…
No Google - Totally block all direct and indirect content from Google, Amazon, Facebook, Apple and Microsoft (or just some).
iBlockList - Variety of lists (free and paid-for) for blocking content based on certain topics, inducing: spam, abuse, political, illegal, hijacked, bad peers and more.Installing a custom firmware on your Wi-Fi router gives you greater control over security, privacy and performance
Flashing custom firmware may void your warranty. If power is interrupted mid-way through a firmware install/ upgrade it is possible for your device to become bricked. So long as you follow a guide, and use a well supported system, on a supported router, than it should be safe
Whether you live in a country behind a firewall, or accessing the internet through a proxy - these tools will help you better understand the extent of blocking, deep packet inspection and what data is being analysed
OONI - Open Observatory of Network Interference - A free tool and global observation network, for detecting censorship, surveillance and traffic manipulation on the internet. Developed by The Tor Project, an…
Goodbye DPI - Passive Deep Packet Inspection blocker and Active DPI circumvention utility, for Windows.An IDS is an application that monitors a network or computer system for malicious activity or policy violations, and notifies you of any unusual or unexpected events. If you are running a server, then it's essential to know about an incident as soon as possible, in order to minimize damage.
Zeek - Zeek (formally Bro) Passively monitors network traffic and looks for suspicious activity.
OSSEC - OSSEC is an Open Source host-based intrusion detection system, that performs log analysis, integrity checking, monitoring, rootkit detection, real-time alerting and active response.
Kismet - An 802.11 layer2 wireless network detector, sniffer, and intrusion detection system.
Snare - SNARE (System iNtrusion Analysis and Reporting Environment) is a series of log collection agents that facilitate centralized analysis of audit log data. Logs from the OS are collected and audited. Ful…Web, VPS, storage and managed app hosting, from privacy-conscious providers that own and run their own infrastructure
Bunker - French sovereign cloud from France Nuage: managed open-source apps, PostgreSQL and S3-compatible storage in its own datacenters. Source is public but under SSPL-1.0, which is not OSI-approved. ISO 270…The country that your data is hosted in will be subject to local laws and regulations. It is therefore important to avoid a jurisdiction that is part of the 5 eyes and other international cooperatives who have legal right to view your data.
See also: Bahnhof, which offers high-security hosting from its own data centres in Sweden, but takes card and PayPal only. Greenhost runs its own network in Amsterdam, and hosts GlobaLeaks whistleblowing platforms for journalists and NGOs. Exoscale is an ISO 27001 certified Swiss IaaS provider with EU zones, though it is owned by Telekom Austria and colocates rather than owning its data centres. FlokiNET hosts in Iceland, Finland and Romania, needs no personal data and takes Monero, but its network is tracked by threat intelligence feeds for abuse. And Packetra offers hosting in Finland and Switzerland, with no identity documents at signup and payment in Bitcoin or Monero via a self-hosted BTCPay instance, though it is a new provider with no track record yet (see #749 for details).
deSEC - Free DNS hosting provider designed with security in mind, and running on purely open source software. deSEC is backed and funded by SSE.
Mail-in-a-box - Easy-to-deploy fully-featured and pre-configured SMTP mail server. It includes everything from webmail, to spam filtering and backups.
Docker Mailserver - A full-stack but simple mailserver (smtp, imap, antispam, antivirus, ssl...) using Docker. Very complete, with everything you will need, customizable and very easy to deploy with docker.
mailcow - A mail server with everything you need (SMTP, IMAP, webmail, NextCloud support..) using Docker.Self-hosting your own mail server is not recommended for everyone, it can be time consuming to setup and maintain and securing it correctly is critical
Turtle - A secure, collaborative notebook. Self-host it yourself, or use their hosted plan (free edition or $3/ month for premium).
Joplin - Cross-platform desktop and mobile note-taking and todo app. Easy organisation into notebooks and sections, revision history and a simple UI. Allows for easy import and export of notes to or from other…
Logseq - Privacy-first, open-source knowledge base that works on top of local plain-text Markdown and Org-mode files. Supports lots of different note modes, including task management, PDF annotation, flashcard…
Obsidian - A powerful knowledge base that works on top of local plain-text Markdown files. It has a strong community, and a lot of plugins and themes. Generally privacy-respecting, but no encryption out of the b…
Cryptee - Private & encrypted rich-text documents. Cryptee has encryption and anonymity at its core, it also has a beautiful and minimalistic UI. You can use Cryptee from the browser, or download native apps. C…If you are already tied into Evernote, One Note etc, then SafeRoom is a utility that encrypts your entire notebook, before it is uploaded to the cloud.
Org Mode is a mode for GNU Emacs dedicated to working with the Org markup format. Org can be thought of as a more featureful Markdown alternative, with support for keeping notes, maintaining todo lists, planning projects, managing spreadsheets, and authoring documents -all in plaintext.
For a simple plain text note taking app, with strong encryption, see Protected Text, which works well with the Safe Notes Android app. Laverna is a cross-platform secure notes app, where all entries are formatted with markdown. Bangle.io is a local-first WYSIWYG Markdown notes PWA, storing notes in browser storage or user-selected folders.
Proton Calendar - The calendar app from the Proton suite. End-to-end encrypted. Supports ICS (not encrypted), colours, recurring events, mail integration, notifications and multiple time zones.
Nextcloud Calendar - Calendar app for the self-hosted Nextcloud platform. Uses CalDAV for sync across devices. No E2E encryption support.
Fossify Calendar - Fossify Calendar from the family of forked FOSS apps from the discontinued SimpleMobileTools. Simple, customizable, includes widgets. Note that CalDAV support is currently limited (see #921…
KashCal - Offline-first Android calendar that syncs with iCloud, CalDAV and device calendars. No account, no telemetry; credentials are stored in the Android Keystore. Events are not end-to-end encrypted, so sy…
Tymeslot - Open-source (AGPL-3.0), self-hostable scheduling and calendar platform. Guests book without creating an account; hosts get a full calendar with two-way sync to Google, Outlook and iCloud. A managed cl…
Rallly - Open-source & self-hostable scheduling tool that helps you find the best date and time to meet. Create a poll with a few options, share the link, and let your participants vote on when they're availab…
Super Productivity - Privacy-respecting, open-source task manager and time tracker. All data is stored locally on your device - no account required, no cloud dependency, and zero telemetry. Supports Jira, GitLab, GitHub,…
Mindwtr - A Getting Things Done + Pomodoro productivity system for desktop and mobile. Local-first, no account required, can sync via WebDAV/Dropbox/local file or self-hosted deployment. With a CLI, REST API an…
SeaFile - An open source cloud storage and sync solution. Files are grouped into Libraries, which can be individually encrypted, shared of synced. Docker image available for easy deployment, and native clients…
Syncthing - Continuous file synchronization between 2 or more clients. It is simple, yet powerful, and fully-encrypted and private. Syncthing can be deployed with Docker, and there are native clients for Windows,…
NextCloud - Feature-rich productivity platform, that can be used to backup and selectively sync encrypted files and folders between 1 or more clients. A key benefit the wide range of plug-ins in the NextCloud App…
bewCloud - Modern and simpler alternative to Nextcloud/ownCloud crafted with TypeScript. Unifies file management, sync, sharing, notes, RSS, expenses, calendars, contacts, and photos, with MFA, WebDAV, CalDAV, C…You should always ensure that any data stored in the cloud is encrypted. If you are hosting your own server, then take the necessary precautions to secure the server. For hosted solutions - use a strong password, keep your credentials safe and enable 2FA.
Alternatively, consider a headless utility such as Duplicacy or Duplicity. Both of offer an encrypted and efficient sync between 2 or more locations, using the rsync algorithm.
SpiderOak, Tresorit and Resilio are good enterprise solutions, all with solid encryption baked-in
FileRun and Pydio are self-hosted file explorers, with cross-platform sync capabilities.
CryptPad - A zero knowledge cloud productivity suite. Provides Rich Text, Presentations, Spreadsheets, Kanban, Paint a code editor and file drive. All notes and user content, are encrypted by default, and can on… NextCloud - A complete self-hosted productivity platform, with a strong community and growing app store. NextCloud is similar to (but arguably more complete than) Google Drive, Office 365 and Dropbox. Clear UI an…
Disroot - A platform providing online services based on principles of freedom, privacy, federation and decentralization. It is an implementation of NextCloud, with strong encryption configured - it is widely us…Backing up important files is essential, and keeping an off-site copy is recommended. But many free providers do not respect your privacy, and are not secure enough for sensitive documents. Avoid free mainstream providers, such as Google Drive, cloud, Microsoft Overdrive, Dropbox.
It is recommended to encrypt files on your client machine, before syncing to the cloud. Cryptomator is a cross-platform, open source encryption app, designed for just this.
An alternative option, is to use a cloud computing provider, and implement the syncing functionality yourself, and encrypt data locally before uploading it - this may work out cheaper in some situations. You could also run a local server that you physically own at a secondary location, that would mitigate the need to trust a third party cloud provider. Note that some knowledge in securing networks is required.
1time.io - 1time.io - Zero-knowledge one-time secret sharing with AES-256-GCM browser-side encryption, HKDF key derivation, CLI tool, and Docker self-hosting.
SkySend - Share end-to-end encrypted Markdown notes, files, code and passwords/keys, or request secrets from others. Set a password, expiration time and/or maximum views. No account necessary. Self-hostable and…Instant.io, is another peer-to-peer based solution, using Web Torrent.
For specifically transferring images, Up1 is a good self-hosted option, with client-side encryption.
Finally PsiTransfer is a feature-rich, self-hosted file drop, using streams.
Shiori - Simple bookmark manager written in Go, intended to be a clone of Pocket, it has both a simple and clean web interface as well as a CLI. Shiori has easy import/ export, is portable and has webpage arch…Ymarks is a C-based self-hosted bookmark synchronization server and Chrome extension.
syncmarx uses your cloud storage to sync bookmarks (Chrome and Firefox).
NextCloud Bookmarks has several community browser extensions, inducing FreedomMarks (Firefox) and OwnCloud Bookmarks (Chrome).
Finally, Turtl Notes has excellent link saving functionality built-in
RainDrop is a fully-featured all-in-1 bookmarking and web-snip suite. It has a beautiful UI, good data controls and some very handy integrations and features. Available on desktop, mobile, web and through a browser extension. The catch is that it is not open source, there is a free and premium plan, but no option for self-hosting.
OpenHabitTracker - Free, open source habit tracker. Take notes, plan tasks, and track habits. All data stored locally or self-hosted via Docker. No accounts required.With the many, many security issues with Zoom, and other mainstream options, it becomes clear that a better, more private and secure alternative is required. As with other categories, the "best video calling app" will be different for each of us, depending on the ratio of performance + features to security + privacy required in your situation.
Jami - A free and open source, distributed video, calling and screenshare platform with a focus on security. Jami is completely peer-to-peer, and has full end-to-end encryption with perfect forward secrecy f…
Jitsi - Encrypted, free and open source video calling app, which does not require creating an account/ providing any personal details. Available as a web app, and native app for Windows, MacOS, Linux, Android…Apache OpenMeetings provides self-hosted video-conferencing, chat rooms, file server and tools for meetings.
together.brave.com is Brave's Jitsi Fork.
For remote learning, BigBlueButton is self-hosted conference call software, aimed specifically at schools and Universities. It allows for the host/ teacher to have full control over the session, and provides high-quality video streaming, multi-user whiteboards, breakout rooms, and instant chat.
Mainstream mapping apps log your location history, search queries and routes, building a detailed picture of where you live, work and travel. A privacy-respecting maps app keeps navigation on your device, works offline, and collects nothing about you.
Accessibility software like screen readers, dictation and voice input often runs in the cloud, sending everything you say or read to a remote server. Privacy-respecting alternatives keep this processing on your device, so your input never leaves it.
Vocalinux - Offline system-wide voice dictation for Linux (X11 and Wayland). Uses local models (whisper.cpp, Whisper, or VOSK) so microphone audio never leaves the device. Tray app with hotkeys; GPLv3. Currently…A virtual machine (VM) is a sandboxed operating system, running within your current system. Useful for compartmentalisation and safely testing software, or handling potentially malicious files
Xen Project - Open source virtual machine monitor intended to serve as a type-1 hyperviser for multiple operating systems using the same hardware - very useful for servers, as it allows for fully independent virtua…
UTM - Open source, feature rich, powerful type 2 hypervisor for Mac, can emulate x86-64 OSes on Apple Silicon Macs. There's also an iOS version (so you can run Windows on your iPhone!)…QEMU is a virtual hardware emulation tool, meaning it is less appropriate for creating fully independant sandboxes, but performance is considerable better than that of a traditional virtual machine.
VMWare is popular in the enterprise world, it is not open source, and although there is a free version, a license is required to access all features. VMWare performs very well when running on a server, with hundreds of hosts and users.
For Mac users, Parallels is a popular option which performs really well, but again is not open source.
For Windows users, there's Hyper-V, which is a native Windows product, developed by Microsoft.
Tools for signing, verifying, encrypting and decrypting text and files using GnuPG standard
SeaHorse - Application for managing encryption keys and passwords, integrated with the GNOME Keyring.
Kleopatra - Certificate manager and a universal crypto GUI. It supports managing X.509 and OpenPGP certificates in the GpgSM keybox and retrieving certificates from LDAP servers.
GPG4Win - Kleopatra ported to Windows.
GPG Suite - Successor of MacGPG. Plays nice with MacOS apps, including Finder, Appple Mail, Keychain and Spotlight. Makes encrypting files, emails, and messages / data very easy. As well as GUI for generating key…
PGP Everywhere - iOS app for encrypting/ decrypting text. Has native keyboard integration, keychain support and app integrations which makes it quick to use in any app.
FlowCrypt - Browser extension for using PGP within Gmail, for Chrome and Firefox. Mobile version supported on Android and iOS.Exif/ Metadata is "data about data", this additional information attached to files can lead us to share significantly more information than we intended to.
For example, if you upload an image of a sunset to the internet, but don't remove the metadata, it may reveal the location (GPS lat + long) of where it was taken, the device is was taken on, precise camera data, details about modifications and the picture source + author. Social networks that remove metadata from your photos, often collect and store it, for their own use. This could obviously pose a security risk, and that is why it is recommended to strip out this data from a file before sharing.
ExifCleaner - Cross-platform, open source, performant EXIF meta data removal tool. This GUI tool makes cleaning media files really easy, and has great batch process support. Created by @szTheory, and uses ExifTool.
ImageOptim - Native MacOS app, with drag 'n drop image optimization and meta data removal.It's possible (but slower) to do this without a third-party tool. For Windows, right click on a file, and go to:
Properties --> Details --> Remove Properties --> Remove from this File --> Select All --> OK.Alternatively, with ImageMagic installed, just run
convert -strip path/to/image.pngto remove all metadata.If you have GIMP installed, then just go to
File --> Export As --> Export --> Advanced Options --> Uncheck the "Save EXIF data" option.Often you need to perform meta data removal programmatically, as part of a script or automation process.
Simply deleting data, does not remove it from the disk, and recovering deleted files is a simple task.
Therefore, to protect your privacy, you should erase/ overwrite data from the disk, before you destroy, sell or give away a hard drive.
Eraser - Allows you to completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.
OW Shredder - File, folder and drive portable eraser for Windows. Bundled with other tools to scan, analyze, and wipe, and other traces that were left behind. Includes context menu item, recycle bin integration.There's no need to use a third-party tool. You can boot into a UNIX-based system, mount the disk you need to erase, and use a command to write it with arbitrary data. For best results, this process should be repeated several times. This is a good way to wipe a disk, before selling or destroying it, to protect your data.
Such as the
ddcommand, is a tool to convert and copy files, but runningsudo dd if=/dev/zero of=/dev/sdX bs=1Mwill quickly overwrite the whole disk with zeros. Or badblocks which is intended to search for all bad blocks, but can also be used to write zeros to a disk, by runningsudo badblocks -wsv /dev/sdd.An effective method of erasing an SSD, it to use hdparm to issue a secure erase command, to your target storage device, for this, see step-by-step instructions via: wiki.kernel.org.
Finally, srm can be use to securely remove files or directories, just run
srm -zsv /path/to/filefor a single pass over.
If you are an Android user, your device has Google built-in at its core. Google tracks you, collecting a wealth of information, and logging your every move.
A custom ROM, is an open source, usually Google-free mobile OS that can be flashed to your device.
GrapheneOS - GrapheneOS is an open source privacy and security focused mobile OS with Android app compatibility. Developed by Daniel Micay. GrapheneOS is a young project, and currently only supports Pixel devices,…
LineageOS - A free and open-source operating system for various devices, based on the Android mobile platform - Lineage is light-weight, well maintained, supports a wide range of devices, and comes bundled with P…
CalyxOS - An open source, de-Googled Android OS focused on privacy and security, with optional microG, a built-in firewall and encrypted backups. Runs on select Google Pixel, Fairphone and Motorola devices, and…It is not recommended to root, or flash your device with a custom ROM if you are not an advanced user. There are risks involved
- Although the above ROMs omit Google, they do open up other security issues: Without DM-verity on the system partition, the file system could be tampered with, and no verified boot stack, the kernel/initramfs also could be edited. You should understand the risks, before proceeding to flash a custom ROM to your device
- You will need to rely on updates from the community, which could be slower to be released - this may be an issue for a time-urgent, security-critical patch
- It is also possible to brick your device, through interrupted install or bad software
- Finally, rooting and flashing your device, will void your warranty
Replicant OS is a fully-featured distro, with an emphasis on freedom, privacy and security.
OmniRom, Resurrection Remix OS and Paranoid Android are also popular options.
Alternatively, Ubuntu Touch is a Linux (Ubuntu)- based OS. It is secure by design and runs on almost any device, - but it does fall short when it comes to the app store.
To install apps on the Play Store without using the Play Store app see Aurora Store. For Google Play Service see MicroG
Windows and MacOS have many features that violate your privacy. Microsoft and Apple are able to collect all your data (including, but not limited to: keystrokes, searches and mic input, calendar data, music, photos, credit card information and purchases, identity, passwords, contacts, conversations and location data). Microsoft Windows is also more susceptible to malware and viruses, than alternative systems.
Switching to Linux is a great choice in terms of security and privacy - you don't need necessarily need to use a security distro, any well-maintained stable distro is going to be considerably better than a proprietary OS
Septor is a Debian-based distro with the KDE Plasma desktop environment, and Tor baked-in. Designed for surfing the web anonymously, and completing other internet-based activities (with Thunderbird, Ricochet IM, HexChat, QuiteRSS, OnionShare). Septor is light-weight, but comes bundled with all the essential privacy + security utilities (including: Gufw, Ark, Sweeper, KGpg, Kleopatra, KWallet, VeraCrypt, Metadata Anonymisation Toolkit and more).
Subgraph OS is designed to be an adversary resistant computing platform, it includes strong system-wide attack mitigations, and all key applications run in sandbox environments. Subgraph is still in beta (at the time of writing), but still is well tested, and has some nice anonymization features
For defensive security, see Kali and BlackArch, both are bundled with hundreds of security tools, ready for pretty much any job (not reccomended as a daily driver!)
Other security-focused distros include: TENS OS, Fedora CoreOS, Kodachi and IprediaOS (Avoid systems that are not being actively maintained)
If you do not want to use a specalist security-based distro, or you are new to Unix - then just switching to any well-maintained Linux distro, is going to be significantly more secure and private than Windows or Mac OS. Since it is open source, major distros are constantly being audited by members of the community. Linux does not give users admin rights by default - this makes is much less likely that your system could become infected with malware. And of course, there is no proprietary Microsoft or Apple software constantly monitoring everything you do.
Some good distros to consider would be: Fedora, Debian, or Arch- all of which have a large community behind them. Manjaro (based of Arch) is a good option, with a simple install process, used by new comers, and expers alike. POP_OS and PureOS are reasonably new general purpose Linux, with a strong focus on privacy, but also very user-friendly with an intuitive interfac and install process. See Detailed Comparison.
BSD systems arguably have far superior network stacks. OpenBSD is designed for maximum security — not just with its features, but with its implementation practices. It's a commonly used OS by banks and critical systems. FreeBSD is more popular, and aims for high performance and ease of use.
Two alternative options for Windows users are Windows 10 AME (ameliorated) project and the LTSC stream.
After installing your new operating system, or if you have chosen to stick with your current OS, there are a couple of things you can do to improve security. See: Windows 10 security guide, Mac OS security guide or Linux security guide.
SysWarden - Open-source, host-local Linux security orchestrator combining nftables enforcement, system telemetry, threat-intelligence feeds, out-of-band WAAP log analysis and a terminal dashboard. It requires Lin…SecTools.org is a directory or popular Unix security tools.
ShutUp10 - A portable app that lets you disable core Windows features (such as Cortana, Edge) and control which data is passed to Microsoft. (Note: Free, but not open source).
WPD - Portable app with a GUI, that makes it really easy to safely block key telemetry features, from sending data to Microsoft and other third parties (It uses the Windows API to interact with key features…
GhostPress - Anti low-level keylogger: Provides full system-wide key press protection, and target window screenshot protection.
KeyScrambler - Provides protection against software keyloggers. Encrypts keypresses at driver level, and decrypts at application level, to protect against common keyloggers.
SafeKeys V3.0 - Portable virtual keyboard. Useful for protecting from keyloggers when using a public computer, as it can run of a USB with no administrative permissions.
RKill - Useful utility, that attempts to terminate known malware processes, so that your normal security software can then run and clean your computer of infections.
IIS Crypto - A utility for configuring encryption protocols, cyphers, hashing methods, and key exchanges for Windows components. Useful for sysadmins on Windows Server.
BleachBit - Clears cache and deletes temporary files very effectively. This frees up disk space, improves performance, but most importantly helps to protect privacy.
USBFix - Detects infected USB removable devices.
ScreenWings - Blocks malicious background applications from taking screenshots.
Win11Debloat - Open-source PowerShell script that removes bloatware, disables telemetry and pre-installed apps for Windows 10 and 11, with whitelists/blacklists reversion support. It heavily modifies the OS, so a re…(The above software was last tested on 01/05/20). Many of the above tools are not necessary or suitable for beginners, and can cause your system to break - only use software that you need, according to your threat model. Take care to only download from an official/ legitimate source, verify the executable before proceeding, and check reviews/ forums. Create a system restore point, before making any significant changes to your OS (such as disabling core features).
From a security and privacy perspective, Linux may be a better option.
See also these lists:
LuLu - Free, open source macOS firewall. It aims to block unknown outgoing connections, unless explicitly approved by the user.
Stronghold - Easily configure macOS security settings from the terminal.Cross-platform, open source malware detection and virus prevention tools
ClamAV - An open source cross-platform antivirus engine for detecting viruses, malware & other malicious threats. It is versatile, performant and very effective. VirusTotal - Web-based malware scanner, that inspects files and URLs with over 70 antivirus scanners, URL/domain services, and other tools to extract signals and determine the legitimacy.For Microsoft Windows, Windows Defender provides totally adequate virus protection in most cases. These tools are intended for single-use in detecting/ removing threats on an infected machine, and are not recommended to be left running in the background, use portable editions where available.
Many anti virus products have a history of introducing vulnerabilities themselves, and several of them seriously degrade the performance of your computer, as well as decrease your privacy. Never use a free anti-virus, and never trust the companies that offer free solutions, even if you pay for the premium package. This includes (but not limited to) Avast, AVG, McAfee and Kasperky. For AV to be effective, it needs intermate access to all areas of your PC, so it is important to go with a trusted vendor, and monitor its activity closely.
For 1-off malware scans on Windows, MalwareBytes is portable and very effective, but not open source
SourceHut - Git and mercurial code hosting, task management, mailing lists, wiki hosting and Alpine-based build pipelines. Can be self-hosted, or used through the managed instance at sr.ht.
Codeberg - A fully-managed instance of Forgejo.
VSCodium - Free and open source binaries of VS Code, built without Microsoft branding and with community-driven defaults. Extension compatibility can differ from Microsoft's official VS Code build.
Alacritty - Fast, GPU-accelerated terminal emulator focused on simplicity, performance, and extensive keyboard-driven workflows.
gitGost - Push to GitHub anonymously: add gitGost as a git remote and it opens a pull request with your name, email and commit metadata stripped, optionally over Tor. Anonymity isn't perfect, and the hosted ser…Google Assistant, Alexa and Siri don't have the best reputation when it comes to protecting consumers privacy, there have been many recent breaches.
For that reason it is recommended not to have these devices in your house. The following are open source AI voice assistants, that aim to provide a human voice interface while also protecting your privacy and security
⚠️ This section is still a work in progress ⚠️
Check back soon, or help us complete it by submitting a pull request
If you are building your own assistant, you may want to consider a hardware-switch for disabling the microphone. Keep tabs on issues and check the code, to ensure you are happy with how it works, from a privacy perspective.
Mycroft and Kalliope removed, as no longer active.
If you choose to continue using Google Home/ Alexa, then check out Project Alias. It's a small app that runs on a Pi, and gives you more control over your smart assistants, for both customisation and privacy.
For a desktop-based assistant, see Dragonfire for Ubuntu, and Jarvis for MacOS.
LinTO, Jovo and Snips are private-by-design voice assistant frameworks that can be built on by developers, or used by enterprises.
Jasper, Stephanie and Hey Athena are Python-based voice assistant, but neither is under active development anymore. See also OpenAssistant.
Gladys Assistant - An open source privacy-respecting Home Assistant, compatible with a wide range of devices including Raspberry Pi, desktop computers, or NAS systems. Actively developed, with good french community and…
Secluso - An open source, end-to-end encrypted home security camera solution (Pi Zero 2W). Easy to setup with GUI deploy tool. Fully E2EE remote access (live streaming & smart motion alerts) via mobile app and…
Gadgetbridge - Open source Android app that connects smartwatches and fitness trackers to your phone without the vendor app or cloud account. Supports 30+ brands (Mi Band, Amazfit, Pebble, Huawei), though feature pa…Not all cryptocurrencies are anonymous, and without using a privacy-focused coin, a record of your transaction will live on a publicly available distributed ledger, forever. If you send of receive multiple payments, ensure you switch up addresses or use a mixer, to make it harder for anyone trying to trace your transactions. Cryptocurrencies that allow private and public transactions may reveal meta data about your transactions and balances when funds are moving from private to public addresses which can compromise your privacy with methods similar to a knapsack problem.
Always store private keys somewhere safe, but offline
Note: Cryptocurrency prices can go down. Storing any wealth in crypto may result in losses. If you are new to digital currencies - do your research first, don't invest more than you can afford to loose, and be very weary crypto-related scams are very common. as is and cryptocurrency-related malware.
This is NOT financial advice
Other privacy-focused cryptocurrencies include: PIVX, Verge, and Piratechain.
It is still possible to use currencies that have a public ledger 'privately', but you will need to take great care not to cause any transactions to be linked with your identity or activity. For example, avoid exchanges that require KYC, and consider using a service such as Local Bitcoins. If you use a Bitcoin ATM, then take care to not be physically tracked (CCTV, phone location, card payments etc)
Wasabi Wallet - An open source, native desktop wallet for Windows, Linux, and MacOS. Wasabi implements trustless CoinJoins over the Tor network. Neither an observer nor the participants can determine which output bel…
Trezor - Open source, cross-platform, offline, crypto wallet, compatible with 1000+ coins. Your private key is generated on the device, and never leaves it, all transactions are signed by the Trezor, which ens…Avoid using any online/ hot-wallet, as you will have no control over the security of your private keys.
Offline paper wallets are very secure, but ensure you store it properly - to keep it safe from theft, loss or damage.
Vultisig is a seedless, self-custodial wallet. It uses MPC threshold signatures to split your key across several devices you own, so there's no seed phrase to write down or leak. It adds no on-chain privacy, and chain queries default to Vultisig's own endpoints unless you set a custom RPC.
Metamask (Ethereum and ERC20 tokens) is a bridge that allows you to visit and interact with distributed web apps in your browser. Metamask has good hardware wallet support, so you can use it to swap, stake, sign, lend and interact with dapps without you're private key ever leaving your device. However the very nature of being a browser-based app means that you need to stay vigilant with what services you give access to.
For traders, BaseFEX doesn't require ID and has a good privacy policy.
BitMex has more advanced trading features, but ID verification is required for higher value trades involving Fiat currency.
For buying and selling alt-coins, Binance has a wide range of currencies,
and ID verification is not needed for small-value tradesbut ID verification is required in most countries.Cunicula is a curated directory of no-KYC and privacy-first services, including crypto exchanges, swap services, P2P markets, and non-custodial wallets. Each entry is tagged with its KYC level, jurisdiction, supported payment methods, and a trust score reflecting audit history and known incidents.
Umbra - Umbra is a stealth address protocol on the EVM. It allows users to send payments to a one-time address controlled by a recipient without their interaction, promoting unlinkability (if proper hygiene i…Virtual card
Truncated — view the full README on GitHub.
(top 24 of 47)
3,232 followers · starred Jul 2022
112 followers · starred Jul 2024
690 followers · starred Mar 2024
249 followers · starred Feb 2025
🦄 A curated list of privacy & security-focused software and services
See the codeA curated list of privacy-respecting apps, software, and providers
[CodeBerg Mirror] | [Submit an Addition] | [Raw data & API]
Large data-hungry corporations dominate the digital world but with little, or no respect for your privacy. Migrating to open-source applications with a strong emphasis on privacy and security will help stop corporations, governments, and hackers from logging, storing or selling your personal data.
[!CAUTION] Remember that no software is perfect, and it is important to follow good security practices
📋 Contents
- Essentials
- Password Managers (8)
- 2-Factor Authentication (12)
- File Encryption (3)
- Browsers (5)
- Search Engines (6)
- Communication
- Encrypted Messaging (4)
- P2P Messaging (4)
- Encrypted Email (4)
- Email Clients (6)
- Mail Forwarding (4)
- Email Security Tools (3)
- VOIP Clients (2)
- Virtual Phone Numbers (8)
- Team Collaboration (5)
- Security Tools
- Browser Extensions (21)
- Mobile Apps (22)
- Online Tools (17)
- Networking
- Virtual Private Networks (7)
- Self-Hosted Network Security (8)
- Anonymity Networks (3)
- Proxies (2)
- DNS Providers (3)
- DNS Clients (5)
- Firewalls (14)
- Ad Blockers (7)
- Host Block Lists (5)
- Router Firmware (2)
- Network Analysis (3)
- Intrusion Detection (5)
- Cloud Hosting (4)
- Domain Registrars (2)
- DNS Hosting (1)
- Mail Servers (3)
- Productivity
- Digital Notes (9)
- Calendar (4)
- Scheduling (2)
- Task Management (3)
- Backup and Sync (4)
- Cloud Productivity Suites (4)
- Encrypted Cloud Storage (6)
- Secret Sharing (3)
- File Drop (2)
- Browser Sync (4)
- Habit Trackers (1)
- Secure Conference Calls (2)
- Maps & Navigation (1)
- Accessibility (1)
- Utilities
- Virtual Machines (3)
- PGP Managers (8)
- Metadata Removal (3)
- Data Erasers (8)
- Operating Systems
- Mobile Operating Systems (3)
- Desktop Operating Systems (5)
- Linux Defenses (7)
- Windows Defences (17)
- Mac OS Defences (2)
- Anti-Malware (2)
- Development
- Code Hosting (5)
- IDEs (1)
- Terminal Emulators (1)
- Developer Tools (3)
- Smart Home & IoT
- Smart Home (1)
- Security Cameras (1)
- Wearables & Health (1)
- Finance
- Cryptocurrencies (2)
- Crypto Wallets (6)
- Crypto Exchanges (2)
- Crypto Tools (1)
- Virtual Credit Cards (2)
- Other Payment Methods (3)
- Secure Budgeting (7)
- Social
- Social Networks (4)
- Video Platforms (2)
- Blogging Platforms (6)
- News Readers (1)
- Proxy Sites (4)
- Media
- Gaming (1)
- Video Players (1)
- Photo Management (2)
- Podcast Players (1)
- Torrent Downloaders (1)
- File Converters (2)
- Creativity
- Image Editors (8)
- Video Editors (7)
- Audio Editors & Recorders (1)
- Casting & Streaming (1)
- Screenshot Tools (1)
- 3D Graphics (2)
- Animation (1)
KeePass - Hardened, secure and offline password manager. Does not have cloud-sync baked in, deemed to be gold standard for secure password managers. KeePass clients: Strongbox (Mac & iOS), KeePassium (Mac & iOS)… AliasVault - End-to-end encrypted open source password and alias manager with built-in email server. AliasVault protects your privacy by creating alternative identities, passwords and email addresses for every web… PaperVault - Store secrets and passwords on encrypted paper with distributed keys. Designed to last generations. Open source, client-side only, works offline.
- Password Safe - An offline, open source password manager designed by Bruce Schneier, with native applications for Windows, Linux, MacOS, Android and iOS, and support for YubiKey. The UI is a little dated, and there is no official browser extension, making is slightly less convenient to use compared with other options
- PassBolt - A good option for teams. It is free, open source, self-hosted, extensible and OpenPGP based. It is specifically good for development and DevOps usage, with integrations for the terminal, browser and chat, and can be easily extended for custom usage, and deployed quickly with Docker
- 1Password - (proprietary) A fully-featured cross-platform password manager with sync. Free for self-hosted data (or $3/ month hosted). Be aware that 1Password is not fully open source, but they do regularly publish results of their independent security audits, and they have a solid reputation for transparently disclosing and fixing vulnerabilities
Other Open Source PM: Buttercup, Clipperz, Pass, Padloc, TeamPass, PSONO, UPM, Gorilla, Seahorse (for GNOME), GNOME Keyring, KDE Wallet Manager.
If you are using a deprecated PM, you should migrate to something actively maintained. This includes: Firefox Lockwise, Encryptr, Mitro, Rattic, JPasswords, Passopolis, KYPS, Factotum.
2FAS - Free, secure and open source authenticator app for both iOS and Android. Supports creating encrypted backups and syncing between devices without the need for an account. Aegis - Free, secure and open source authenticator app for Android. Has a backup/ restore feature and a customisable UI with dark mode Stratum - Free and open-source two factor authentication app for Android. It features encrypted backups, icons, categories and a high level of customisation. It also has a Wear OS companion app Tofu - An easy-to-use, open-source two-factor authentication app designed specifically for iOS Authenticator - Simple, native, open source 2-FA Client for iOS, which never connects to the internet - built by @mattrubin.me Authenticator CC - Authenticator Extension is an in-browser One-Time Password (OTP) client, supports both Time-Based One-Time Password (TOTP, specified in RFC 6238) and HMAC-Based One-Time Password (HOTP, specified in RFC 4226… Ente Auth - Free, open source TOTP authenticator for mobile, desktop and web. Works fully offline, or with an Ente account to sync codes across devices with end-to-end encrypted backups. Codes can be imported fro… Bitwarden Authenticator - Bitwarden Authenticator is a free and open-source app which stores and generates time-based codes for multi-factor authentication. It can be used with an online account to backup and sync your tokens… Proton Authenticator - Proton Authenticator is free, open source, and available for both iOS and Android. A Proton account is required to use Proton Authenticator. Existing 2FA codes can be imported from other popular apps… Chronos Authenticator - Chronos Authenticator is a free, open-source two-factor authentication app for iOS, designed to provide robust security and reliable backup options. Autheris - Open-source 2FA authenticator for iPhone, iPad, Mac and Apple Watch. Secrets stay in the device Keychain, with no account, no analytics and optional iCloud SyncOTPClient (Linux), gauth (Self-Hosted, Web-based), Etopa (Android)
For KeePass users, TrayTop is a plugin for managing TOTP's - offline and compatible with Windows, Mac and Linux.
Check which websites support multi-factor authentication: 2fa.directory
Cryptomator - Open source client-side encryption for cloud files - Cryptomator is geared towards using alongside cloud-backup solutions, and hence preserves individual file structure, so that they can be uploaded.… age - 
age is a simple, modern and secure CLI file encryption tool and Go library. It features small explicit keys, no config options, and UNIX-style composabilityWhere possible, choose a cross-platform and well established encryption method, so that you are never faced with not being able to access your files using your current system.
Although well-established encryption methods are usually very secure, if the password is not strong, then an adversary may be able to gain access to your files, with a powerful enough GPU. If your system is compromised, then the password may also be able to be skimmed with a keylogger or other similar malware, so take care to follow good basic security practices
- AES Crypt - A light-weight and easy file encryption utility. It includes applications for Windows, Mac OS, BSD and Linux, all of which can be interacted with either through the GUI, CLI or programatically though an API (available for Java, C, C# and Python). Although it is well established, with an overall positive reputation, there have been some security issues raised recently.
- CryptSetup - is a convenient layer for use on top of dm-crypt. EncFS is a cross-platform file-based encryption module, for use within user local directories. geli is a disk encryption subsystem included with FreeBSD.
- BitLocker - is popular among Microsoft Windows and enterprise users, and provides fast, efficient and (if correctly configured) reasonably secure full drive encryption. However it is not open source, has poor compatibility with other operating systems, and has some very dodgy defaults, which could lead to your system being compromised. Similarly, Apple's FileVault on MacOS is easy and secure, but again, the source code is proprietary.
- DiskCryptor - Windows-only, open source, file and volume encryption solution, that makes a good alternative to BitLocker.
LibreWolf - An independent fork of Firefox hardened for privacy by default. No telemetry, uBlock Origin bundled, anti-fingerprinting, strict settings Brave Browser - Chromium-based browser with strong built-in ad, tracker and fingerprint blocking, and timely Chromium security updates. Note that Brave does bundle potentially unwanted features, like crypto, rewards… Firefox - The main independent browser, on Mozilla's own Gecko engine rather than Chromium. Reliable, long-standing, with frequent security updates, broad extension support and strong customization. However tel… Tor Browser - Tor provides an extra layer of anonymity, by encrypting each of your requests, then routing it through several nodes, making it near-impossible for you to be tracked by your ISP. While excellent for a… Mullvad Browser - A Firefox-based browser maintained in collaboration between the Tor Project and Mullvad. With strong anti-fingerprinting (so users look alike), no telemetry and uBlock Origin bundledNew vulnerabilities are being discovered and patched all the time - use a browser that is being actively maintained, in order to receive these security-critical updates.
Even privacy-respecting browsers, often do not have the best privacy options enabled by default. After installing, check the privacy & security settings, and update the configuration to something that you are comfortable with. 12Bytes maintains a comprehensive guide on Firefox Configuration for Privacy and Performance
- Cromite - Chromium fork and successor of Bromite. Adds built-in ad and tracker blocking, removes Google service calls, and disables several fingerprinting vectors. Note that patches often lag several weeks behind upstream> - WaterFox - Firefox fork with telemetry, studies and data collection removed. The legacy Classic line retains support for XUL/NPAPI extensions; the current Quantum-based release does not.> - PaleMoon - Independent Firefox-derived browser using its own Goanna engine. Disables telemetry and retains support for legacy XUL extensions. Lagging support for modern web-platform features (e.g. CSP) has led to incidents of Cloudflare blocking the browser.> - Iridium - Chromium fork with telemetry, background pings and most Google service integrations stripped out or made opt-in.> - SeaMonkey - All-in-one internet suite (browser, mail, IRC, HTML editor) derived from the Mozilla Application Suite. Receives security fixes but lags upstream Firefox on features.> - Ungoogled-Chromium - Chromium with all Google web service integrations, binary blobs and background calls removed. Tries to retain the default Chromium experience as closely as possible. No built-in auto-updates; relies on third-party rebuilds for security patches.> - Basilisk Browser - Firefox/UXP-based fork originally created by Moonchild Productions and independently maintained since 2022. Retains NPAPI plugin and XUL extension support dropped by mainline Firefox.> - IceCat - GNU's fully-free Firefox fork. Removes proprietary components such as DRM and EME, and bundles LibreJS to block non-free JavaScript. Tracks Firefox ESR, but release cadence lags upstream and can delay security fixes.
12Bytes maintains a list of privacy & security extensions.
DuckDuckGo - DuckDuckGo is a user-friendly and fast secure search engine. While it doesn't use trackers or cookies, there are search-related ads. It's also highly customisable, with theming, languages, bangs and p… Brave Search - Brave Search is a privacy-focused search engine that does not track users or their searches, does not use secret algorithms or user profiling, and is based on its own search index. Mojeek - British search engine providing independent and unbiased search results using its own crawler. Has a zero tracking policy (it is not open source) Uruky - Uruky is an ad-free, private search engine focused on personalization. It uses, among other providers, Mojeek and Marginalia. It is EU-based and does not keep or track any personal data (it is not 100… PriEco - PriEco is an independent web search engine with growing index. It is EU-based and 100% open source. It allows customization via Goggles.
- Qwant - French search engine, running on Bing results and the new European Search Perspective. Contains contextual, non-tracking ads. Privacy policy is out-dated, and Qwant does track users despite claiming not to. See full review for more info.
- MetaGear
- YaCy
- Searx - Self-hostable search engines that use the results of multiple other engines (such as Google and Bing) at the same time. They're open source and self-hostable, although using a public instance has the benefit of not singling out your queries to the engines used. A fork of the original Searx.
Signal - Probably one of the most popular, secure private messaging apps that combines strong encryption (see Signal Protocol) with a simple UI and plenty of features. It's widely used across the world, and ea… SimpleX - Simplex is gaining popularity as a secure and private messaging app renowned for its robust encryption protocol without user IDs or phone numbers and this improves your privacy. Simplex offers instant… XMPP - XMPP, also known as Jabber, is an open standard for decentralized messaging that has been widely used for decades. It has actually been the basis upon which WhatsApp, Facebook's Chat and Google's Talk…Many messaging apps claim to be secure, but if they are not open source, then this cannot be verified - and they should not be trusted. This applies to Telegram, Cypher, Wickr, Silent Phone and Viber, to name a few - these apps should not be used to communicate any sensitive data. Wire has also been removed, due to a recent acquisition
- Chat Secure
- KeyBase - Allows encrypted real-time chat, group chats, and public and private file sharing. It also has some nice features around cryptographically proving social identities, and makes PGP signing, encrypting and decrypting messages easy. However, since it was acquired by Zoom in 2020, it has no longer been receiving regular updates.
- OpenPGP - can be used over existing chat networks (such as email or message boards). It provides cryptographic privacy and authentication, PGP is used to encrypt messages.
Note/ Issues with PGP PGP is not easy to use for beginners, and could lead to human error/ mistakes being made, which would be overall much worse than if an alternate, simpler system was used. Do not use 32-bit key IDs - they are too short to be secure. There have also been vulnerabilities found in the OpenPGP and S/MIME, defined in EFAIL, so although it still considered secure for general purpose use, for general chat, it may be better to use an encrypted messaging or email app instead.- Threema - A paid, business-focused Swiss messenger. The apps are open source, but the server is proprietary.
With Peer-to-Peer networks, there are no central server, so there is nothing that can be raided, shut-down or forced to turn over data. There are P2P networks available that are open source, E2E encrypted, routed through Tor services, totally anonymous and operate without the collection of metadata.
Briar - Tor-based Android app for P2P encrypted messaging and forums. Where content is stored securely on your device (not in the cloud). It also allows you to connect directly with nearby contacts, without i… Ricochet Refresh - Desktop instant messenger, that uses the Tor network to rendezvous with your contacts without revealing your identity, location/ IP or meta data. There are no servers to monitor, censor, or hack so Ri… Jami - P2P encrypted chat network with cross-platform GNU client apps. Jami supports audio and video calls, screen sharing, conference hosting and instant messaging. Tox & qTox client - Open source, encrypted, distributed chat network, with clients for desktop and mobile - see supported clients. Clearly documented code and multiple language bindings make it easy for developers to int…Email is not secure - your messages can be easily intercepted and read. Corporations scan the content of your mail, to build up a profile of you, either to show you targeted ads or to sell onto third-parties. Through the Prism Program, the government also has full access to your emails (if not end-to-end encrypted) - this applies to Gmail, Outlook Mail, Yahoo Mail, GMX, ZoHo, iCloud, AOL and more.
For a more details comparison of email providers, see email-comparison.as93.net
ProtonMail - An end-to-end encrypted anonymous email service. ProtonMail has a modern easy-to-use and customizable UI, as well as fast, secure native mobile apps. ProtonMail has all the features that you'd expect… Tuta - Free and open source email service based in Germany. It has a basic intuitive UI, secure native mobile apps and desktop email clients, anonymous signup, and an encrypted calendar. Tuta has a full-feat… Mailfence - Mailfence supports OpenPGP so that you can manually exchange encryption keys independently from the Mailfence servers, putting you in full control. Mailfence has a simple UI, similar to that of Outloo… MailBox.org - A Berlin-based, eco-friendly secure mail provider. There is no free plan, the standard service costs €12/year. You can use your own domain, with the option of a catch-all alias. They provide good acco…
- When using an end-to-end encryption technology like OpenPGP, some metadata in the email header will not be encrypted.
- OpenPGP also does not support Forward secrecy, which means if either your or the recipient's private key is ever stolen, all previous messages encrypted with it will be exposed. You should take great care to keep your private keys safe.
Email clients are the programs used to interact with the mail server. For hosted email, then the web and mobile clients provided by your email service are usually adequate, and may be the most secure option. For self-hosted email, you will need to install and configure mail clients for web, desktop or mobile. A benefit of using an IMAP client, is that you will always have an offline backup of all email messages (which can then be encrypted and archived), and many applications let you aggregate multiple mailboxes for convenience. Desktop mail clients are not vulnerable to the common browser attacks, that their web app counterparts are.
Mozilla Thunderbird - Free and open source email application developed and backed by Mozilla -it's secure, private easy and customizable. As of V 78.2.1 encryption is built in, and the TorBirdy extension routes all traffic… SnappyMail - Simple, modern, fast web-based mail client. This is an IMAP-only fork of RainLoop that mitigates a severe RainLoop vulnerability and adds several new features.… RoundCube - Browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an email client, including MIME support, address book, folder manipulatio… FairEmail - Open source, fully-featured and easy mail client for Android. Supports unlimited accounts and email addresses with the option for a unified inbox. Clean user interface, with a dark mode option, it is… K-9 Mail - K-9 (or Thunderbird for Android) is open source, very well supported and trusted - k9 has been around for nearly as long as Android itself! It supports multiple accounts, search, IMAP push email, mult…One disadvantage of mail clients, is that many of them do not support 2FA, so it is important to keep your device secured and encrypted
Revealing your real email address online can put you at risk. Email aliasing allows messages to be sent to [anything]@my-domain.com and still land in your primary inbox. This protects your real email address from being revealed. Aliases are generated automatically, the first time they are used. This approach lets you identify which provider leaked your email address, and block an alias with 1-click.
Addy - An open source anonymous email forwarding service, allowing you to create unlimited email aliases. Has a free plan. Firefox Private Relay - Developed and managed by Mozilla, Relay is a Firefox addon, that lets you make an email alias with 1 click, and have all messages forwarded onto your personal email. Relay is totally free to use, and… Forward Email - Catch-all email forwarding service with unlimited aliases and custom domains, configured via DNS records. Self-hostable; the hosted version has a limited free plan, with paid plans (from $3/month) add…Some full email providers include aliasing or catch-all addresses as a built-in (usually premium) feature. For example, Proton (catch-all, plus hide-my-email aliases via Proton Pass), StartMail, mailbox.org and Posteo all offer this.
DKIM Verifier - Verifies DKIM signatures and shows the result in the e-mail header, in order to help spot spoofed emails (which do not come from the domain that they claim to). Paperweight - Paperweight scans your inbox to map your digital footprint, then helps you take back control and delete your data.If you are using ProtonMail, then the ProtonMail Bridge enables you to sync & backup your emails to your own desktop mail client. It works well with Thunderbird, Microsoft Outlook and others
Mumble - Open source, low-latency, high quality voice chat software. You can host your own server, or use a hosted instance, there are client applications for Windows, MacOS and Linux as well as third-party ap… Linphone - Open source audio, video and IM groups with E2E encryption and built-in media server. SIP-based evolving to RCS. Native apps for Android, iOS, Windows, GNU/Linux and MacOS.… SMSPool - Don't feel comfortable giving out your phone number? Protect your online identity by using our one-time-use non-VoIP phone numbers. We support over 50+ countries and support over 300+ services. Silent.link - Anonymous eSIM for sending / receiving SMS, incoming calls and 4G / 5G internet + world-wide roaming. No data is required at sign-up. Affordable pricing, with payments and top-ups accepted in BTC. Req… Crypton.sh - Physical SIM card in the cloud, for sending + receiving SMS messages. Messages are encrypted using your chosen private key. Includes a web interface, as well as an API for interacting with it from any… Jmp.chat - Phone number for incoming + outgoing calls and messages, provided by Soprani. Works with Jabber, Matrix, Snikket, XMPP or any SIP client. Pricing starts at $4.99 / month. Only available in the US and… MoneroSMS - Anonymous SMS service able to activate accounts. Accessible over web, CLI, or email. Pricing starts at $3.60 / month. The service is in beta as of 2022. PikaSim - Privacy-focused eSIM provider for 170+ countries, with instant eSIM delivery. No account, ID, email needed, and accepts crypto via a self-hosted BTCPay Server. Narayana - Anonymous physical SIMs, eSIMs, VoIP phone numbers, and other advanced features. Inbound/outbound calls, SMS and roaming internet. Very private, has a Tor mirror, accepts crypto, doesn't KYC and you c…Now more than ever we are relying on software to help with team collaboration. Unfortunately many popular options, such as Slack, Microsoft Teams, Google for Work and Discord all come with some serious privacy implications.
Typical features of team collaboration software includes: instant messaging, closed and open group messaging, voice and video conference calling, file sharing/ file drop, and some level or scheduling functionality.
Rocket.Chat - Easy-to-deploy, self-hosted Slack alternative with polished cross-platform apps. End-to-end encryption is supported, but off by default - without it, workspace admins can read all messages. Usage stat… Element - Privacy-focused messenger using the Matrix protocol. The Element client allows for group chat rooms, media sharing, voice and video group calls. End-to-end encryption by default for message content, b… Mattermost - Self-hostable Slack alternative with native desktop, mobile and web apps, and many integrations. There's no end-to-end encryption, so the server can read all messages, and telemetry is on by default.… Zulip - Open source team chat organized around topic-based threading, which keeps busy conversations easier to follow than channel-only tools. Can be self-hosted, or used as a paid cloud service. The threadin… Xeres - A decentralized, encrypted P2P friend-to-friend app for chat, forums, channels, boards, voice calls and anonymous file sharing. Best for trusted contacts, as it isn't anonymous unless you route it thr…Some chat platforms allow for cross-platform group chats, voice and video conferencing, but without the additional collaboration features. For example, Tox, Mumble and Jami.
IRC is decentralized, easy to self-host and has a wide choice of clients, making it a good fit for open community channels and public project support. But there's no end-to-end encryption - TLS only protects the connection to the server, so operators can read all messages, and your IP may be exposed unless the network supports host cloaking. Avoid it for private or confidential team communication.
For Conferences, OSEM is an open source all-in-one conference management tool, providing Registration, Schedules, Live and Recorded Sessions, Paper Submissions, Marketing Pages and Administration.
The following browser add-ons give you better control over what content is able to be loaded and executed while your browsing.
Before installing anything, you should read the Word of Warning section below.
Privacy Badger - Blocks invisible trackers, in order to stop advertisers and other third-parties from secretly tracking where you go and what pages you look at. Less configurable but simpler than uBlock, and focuses o… uBlock Origin - Block ads, trackers and malware sites. Download: Chrome - Firefox… Firefox Multi-Account Containers - Firefox Multi-Account Containers lets you keep parts of your online life separated into color-coded tabs that preserve your privacy. Cookies are separated by container, allowing you to use the web wit… WebRTC-Leak-Prevent - Provides user control over WebRTC privacy settings in Chromium, in order to prevent WebRTC leaks. Download: Chrome. For Firefox users, you can do this through browser settings. Test for WebRTC leaks,… Canvas Fingerprint Blocker - Block fingerprint without removing access to HTML5 Canvas element. Canvas fingerprinting is commonly used for tracking, this extension helps to mitigate this through disallowing the browser to generat… ClearURLs - This extension will automatically remove tracking elements from the GET parameters of URLs to help protect some privacy Download: Chrome - Firefox / Source… Privacy-Oriented Origin Policy - Prevent Firefox from sending Origin headers when they are least likely to be necessary, to protect your privacy Download: Firefox - Source… Decentraleyes - Similar to LocalCDN, Serves up local versions of common scripts instead of calling to 3rd-party CDN. Improves privacy and load times. Works out-of-the-box and plays nicely with regular content blocker… Privacy Essentials - Simple extension by DuckDuckGo, which grades the security of each site. Download: Chrome \ Firefox… User Agent Switcher - Spoofs browser's User-Agent string, making it appear that you are on a different device, browser and version to what you are actually using. This alone does very little for privacy, but combined with… PrivacySpy - The companion extension for PrivacySpy.org - an open project that rates, annotates, and archives privacy policies. The extension shows a score for the privacy policy of the current website. Download:… Skip Redirect - Some web pages use intermediary pages before redirecting to a final page. This add-on tries to extract the final url from the intermediary url and goes there straight away if successful Download: Firefox… Web Archives - View archived and cached versions of web pages on 10+ search engines, such as the Wayback Machine, Archive.is, Google etc Useful for checking legitimacy of websites, and viewing change logs Download:… Flagfox - Displays a country flag depicting the location of the current website's server, which can be useful to know at a glance. Click icon for more tools such as site safety checks, whois, validation etc Download… Netcraft Extension - Notifies you when visiting a known or potential phishing site, and detects suspicious JavaScript (including skimmers and miners). Also provides a simple rating for a given site's legitimacy and securi… LibRedirect - A browser extension that redirects popular sites to alternative privacy friendly frontends Download: Firefox - Chrome… SponsorBlock - Crowdsourced browser extension that skips sponsored segments and other unwanted parts of YouTube videos using community-submitted timestamps. Download: Firefox - Chrome… DeArrow - Crowdsourced browser extension that replaces YouTube video titles and thumbnails using community-submitted versions to stop clickbait. Download: Firefox - Chrome…
- Having many extensions installed raises entropy, causing your fingerprint to be more unique, hence making tracking easier.
- Much of the functionality of the above addons can be applied without installing anything, by configuring browser settings yourself. For Firefox this is done in the user.js
- Be careful when installing unfamiliar browser add-ons, since some can compromise your security and privacy. At the time of writing, the above list were all open source, verified and 'safe' extensions.
- In most situations, only a few of the above extensions will be needed in combination.
- See the arkenfox wiki for more information on the obsolescence and purposelessness of many popular extensions, and why you may only need a very limited set.
- Extension source viewer - A handy extension for viewing the source code of another browser extension, which is a useful tool for verifying the code does what it says
Orbot - System-wide Tor proxy, which encrypts your connection through multiple nodes. You can also use it alongside Tor Browser to access .onion sites. NetGuard - A firewall app for Android, which does not require root. NetGuard provides simple and advanced ways to block access to the internet, where applications and addresses can individually be allowed or den… Island - A sandbox environment, allowing you to clone selected apps and run them in an isolated box, preventing it from accessing your personal data, or device information. Insular - An actively-maintained fork of the Island project with additional enhancements Exodus - Shows which trackers, each of your installed apps is using, so that you can better understand how your data is being collected. Uses data from the Exodus database of scanned APKs. Bouncer - Gives you the ability to grant permissions temporarily, so that you could for example use the camera to take a profile picture, but when you close the given app, those permissions will be revoked. SuperFreezZ - Makes it possible to entirely freeze all background activities on a per-app basis. Intended purpose is to speed up your phone, and prolong battery life, but this app is also a great utility to stop ce… Secure Task - Triggers actions, when certain security conditions are met, such as multiple failed login attempts or monitor settings changed. It does require Tasker, and needs to be set up with ADB, device does not… Cryptomator - Encrypts files and folders client-side, before uploading them to cloud storage (such as Google Drive, One Drive or Dropbox), meaning none of your personal documents leave your device in plain text. Fing App - A network scanner to help you monitor and secure your WiFi network. The app is totally free, but to use the advanced controls, you will need a Fing Box. Blokada - This application blocks ads and trackers, doesn't require root and works for all the apps on your Android phone. Check out how it works here. TrackerControl - Monitor and control hidden data collection in mobile apps about user behavior/ tracking. Get from F-Droid Greentooth - Auto-disable Bluetooth, then it is not being used. Saves battery, and prevent some security risks. Get from F-Droid PrivateLock - Auto lock your phone based on movement force/ acceleration. Get from F-Droid See also PluckLock CamWings - Prevent background processes gaining unauthorized access to your devices camera. Better still, use a webcam sticker. ScreenWings - Prevent background processes taking unauthorized screenshots, which could expose sensitive data. AFWall+ - Android Firewall+ (AFWall+) is an advanced iptables editor (GUI) for rooted Android devices, which provides very fine-grained control over which Android apps are allowed to access the network. Get fro… Catch the Man-in-the-Middle - Simple tool, that compares SHA-1 fingerprints of the the SSL certificates seen from your device, and the certificate seen from an external network. If they do not match, this may indicate a man-in-the… RethinkDNS & Firewall - An open-source ad-blocker and firewall app for Android 6+ (does not require root). F-Droid - F-Droid is an installable catalogue of FOSS applications for Android. The client enables you to browse, install, and keep track of updates on your device. Spectre - A radio frequency scanner app for Android with recon and offensive capabilities.Too many installed apps will increase your attack surface - only install applications that you need. Be sure to check the permissions, and what data an app has access to prior to installation. Only install from official sources.
For more open source security & privacy apps, check out these publishers: The Guardian Project (Play Store, F-Droid), The Tor Project (Play Store, F-Droid), Oasis Feng (Play Store), FairCode (Marcel Bokhorst) (Play Store, F-Droid), SECUSO Research Group (Play Store, F-Droid), and Fossify (Play Store, F-Droid) - all of which are trusted developers or organisations, who've done amazing work.
For offensive and defensive security, see The Kali Nethunter Catalogue of apps
For advanced users, the following tools can be used to closely monitor your devise and networks, in order to detect any unusual activity. [PortDroid] for network analysis, [Packet Capture] to monitor network traffic, [SysLog] for viewing system logs, [Dexplorer] to read .dex or .apk files for your installed apps, and [Check and Test] to check status and details of devices hardware.
A selection of free online tools and utilities, to check, test and protect your security
Have i been pwned - Checks if your credentials (Email address or Password) have been compromised in a data breach. See also Firefox Monitor. εxodus - Checks how many, and which trackers any Android app has. Useful to understand how data is being collected before you install a certain APK, it also shows which permissions the app asks for. Phish.ly - Analyzes emails, checking the URLs and creating a SHA256 and MD5 hash of attachments, with a link to VirusTotal. To use the service, just forward a potentially malicious or suspicious email to scan@ph… Redirect Detective - Check where a suspicious URL redirects to (without having to click it). Lets you avoid being tracked by not being redirected via adware/tracking sites, or see if a shortened link actually resolves a l… Blocked.org - Checks if a given website is blocked by filters applied by your mobile and broadband Internet Service Providers (ISP). Virus Total - Analyses a potentially-suspicious web resources (by URL, IP, domain or file hash) to detect types of malware (note: files are scanned publicly). Hardenize - Scan websites and shows a security overview, relating to factors such as HTTPS, domain info, email data, www protocols and so on. Is Legit? - Checks if a website or business is a scam, before buying something from it. 10 Minute Mail - Generates temporary disposable email address, to avoid giving your real details. Site Report - A tool from Netcraft, for analysing what any given website is running, where it's located and information about its host, registrar, IP and SSL certificates.Browsers are inherently insecure, be careful when uploading, or entering personal details.
Mullvad - Mullvad is one of the best for privacy, they have a totally anonymous sign up process, you don't need to provide any details at all, you can choose to pay anonymously too (with Monero, BTC or cash). Azire - Azire is a Swedish VPN provider, who owns their own hardware with physically removed storage and a no logging policy. Pricing starts at €3.25/mo, with crypto (including XMR) supported. Note that they'… IVPN - Independently Security Audited VPN with anonymous signup, no logs, no cloud or customer data stored, open-source apps and website. Strong ethics: no trackers, no false promises, no surveillance ads. A… ProtonVPN - From the creators of ProtonMail, ProtonVPN has a solid reputation. They have a full suite of user-friendly native mobile and desktop apps. ProtonVPN is one of the few "trustworthy" providers that also… Party VPN - Crypto-native VPN with pay-as-you-go pricing. Accepts cryptocurrency only, including Monero. WireGuard and AmneziaWG protocols, no-logs policy, REST API for developers. No subscriptions or credit card… Windscribe - An audited and court-proven VPN with a free 10GB plan, in-RAM servers, browser extensions and open source WireGuard/IKEv2/OpenVPN clients. Supports split tunneling, customizable DNS blocking, MAC spoo…
- A VPN does not make you anonymous - it merely changes your public IP address to that of your VPN provider, instead of your ISP. Your browsing session can still be linked back to your real identity either through your system details (such as user agent, screen resolution even typing patterns), cookies / session storage, or by the identifiable data that you enter. Read more about fingerprinting
- Logging - If you choose to use a VPN because you do not agree with your ISP logging your full browsing history, then it is important to keep in mind that your VPN provider can see (and mess with) all your traffic. Many VPNs claim not to keep logs, but you cannot be certain of this (VPN leaks). See this article for more
- IP Leaks - If configured incorrectly, your IP may be exposed through a DNS leak. This usually happens when your system is unknowingly accessing default DNS servers rather than the anonymous DNS servers assigned by an anonymity network or VPN. Read more: What is a DNS leak, DNS Leak Test, How to Fix a DNS Leak
- Stealth - It will be visible to your adversary that you are using a VPN (usually from the IP address), but other system and browser data, can still reveal information about you and your device (such as your local time-zone, indicating which region you are operating from)
- Many reviews are sponsored, and hence biased. Do your own research, or go with one of the above options
- Using Tor (or another Mix Network) may be a better option for anonimity
If you don't trust a VPN provider not to keep logs, then you could self-host your own VPN. This gives you you total control, but at the cost of anonymity (since your cloud provider, will require your billing info). See Streisand, to learn more, and get started with running a VPN. Digital Ocean provides flexible, secure and easy Linux VMs, (from $0.007/hour or $5/month), Here is a 1-click install scriptfor on Digital Ocean, by Carl Friess. Recently distributed self-hosted solutions for running your own VPNs have become more popular, with services like Outline letting you spin up your own instance and share it with friends and family. Since it's distributed, it is very resistant to blocking, and gives you world-wide access to the free and open internet. And since you have full control over the server, you can be confident that there is no logging or monitoring happening. However it comes at the cost of anonymity, especially if it's only you using your instance.
While choosing a VPN, consider the following: Logging policy (logs are bad), Jurisdiction (avoid 5-eyes), Number of servers, availability and average load. Payment method (anonymous methods such as BTC, Monero or cash are better), Leak protection (1st-party DNS servers = good, and check if IPv6 is supported), protocols (OpenVPN and WireGuard = good). Finally, usability of their apps, user reviews and download speeds.
Fun little projects that you can run on a Raspberry Pi, or other low-powered computer. In order to help detect and prevent threats, monitor network and filter content
Pi-Hole - Network-level advertisement and Internet tracker blocking application which acts as a DNS sinkhole. Pi-Hole can significantly speed up your internet, remove ads and block malware. It comes with a nice… IPFire - A hardened, versatile, state-of-the-art open source firewall based on Linux. Its ease of use, high performance and extensibility make it usable for everyone. PiVPN - A simple way to set up a home VPN on any Debian server. Supports OpenVPN and WireGuard with elliptic curve encryption keys up to 512 bit. Supports multiple DNS providers and custom DNS providers - wor… E2guardian - Powerful open source web content filter. PF Sense - Widely used, open source firewall/router. Zeek - Detect if you have a malware-infected computer on your network, and powerful network analysis framework and monitor. Tor - Tor provides robust anonymity, allowing you to defend against surveillance, circumvent censorship and reduce tracking. It blocks trackers, resists fingerprinting and implements multi-layered encryptio…To provide low-latency browsing, Tor does not mix packets or generate cover traffic. If an adversary is powerful enough, theoretically they could either observe the entire network, or just the victims entry and exit nodes. It's worth mentioning, that even though your ISP can not see what you are doing, they will be able determine that you are using a mix net, to hide this - a VPN could be used as well. If you are doing anything which could put you at risk, then good OpSec is essential, as the authorities have traced criminals through the Tor network before, and made arrests. Don't let Tor provide you a false sense of security - be aware of information leaks through DNS, other programs or human error. Tor-supported browsers may might lag behind their upstream forks, and include exploitable unpatched issues. See #19
Note: The Tor network is run by the community. If you benefit from using it and would like to help sustain uncensored internet access for all, consider running a Tor relay
Tor, I2P and Freenet are all anonymity networks - but they work very differently and each is good for specific purposes. So a good and viable solution would be to use all of them, for different tasks. You can read more about how I2P compares to Tor, here
A proxy acts as a gateway between you and the internet, it can be used to act as a firewall or web filter, improves privacy and can also be used to provide shared network connections and cache data to speed up common requests. Never use a free proxy.
ShadowSocks - Secure socks5 proxy, designed to protect your Internet traffic. Open source, superfast, cross-platform and easy to deploy, see GitHub repo. Privoxy - Non-caching web proxy with advanced filtering capabilities for enhancing privacy, modifying web page data and HTTP headers, controlling access, and removing ads and other obnoxious Internet junk.Malicious Proxies are all too common. Always use open source software, host it yourself or pay for a reputable cloud service. Never use a free proxy; it can monitor your connection, steal cookies and contain malware. VPNs are a better option, better still - use the Tor network.
V2ray-core is a platform for building proxies to bypass network restrictions and protect your privacy. See more TransparentTorProxy is a Linux CLI utility that transparently routes all system traffic through the Tor network.
Without using a secure, privacy-centric DNS all your web requests can be seen in the clear. You should configure your DNS queries to be managed by a service that respects privacy and supports DNS-over-TLS, DNS-over-HTTPS or DNSCrypt.
CloudFlare - One of the most performant options, Cloudflare's DNS supports DoH and DoT, and has a Tor implementation, providing world-class protection. They have native cross-platform apps, for easy set-up. AdGuard - Open-source DNS provider, specialising in the blocking of ads, trackers and malicious domains. They have been independently audited and do not keep logs.Using an encrypted DNS resolver will not make you anonymous, it just makes it harder for third-partied to discover your domain history. If you are using a VPN, take a DNS leak test, to ensure that some requests are not being exposed.
- Quad9 - A well-funded, performant DNS with a strong focus on privacy and security and easy set-up, however questions have been raised about the motivation of some of the financial backers.
- BlahDNS - (Japan, Finland or Germany) is an excellent security-focused DNS> - OpenNIC - NixNet DNS and UncensoredDNS are open source and democratic, privacy-focused DNS
- Unbound - A validating, recursive, caching DNS resolver, designed to be fast and lean. Incorporates modern features and based on open standards
- Clean Browsing - A good option for protecting kids, they offer comprehensive DNS-based Content Filtering
- Mullvad - Mullvads public DNS with QNAME minimization and basic ad blocking. It has been audited by the security experts at Assured. You can use this privacy-enhancing service even if you don't use Mullvad.
DNS Protocols
DNS-over-TLS was proposed in RTC-7858 by the IETF, then 2 years later, the DNS-over-HTTPS specification was outlined in RFC8484 in October '18. DNSCrypt, is a protocol that authenticates communications between a DNS client and a DNS resolver. It prevents DNS spoofing, through using cryptographic signatures to verify that responses originate from the chosen DNS resolver, and haven't been tampered with. DNSCrypt is a well battle-tested protocol, that has been in use since 2013, and is still widely used.
Unbound - Validating, recursive, caching DNS resolve with support for DNS-over-TLS. Designed to be fast, lean, and secure Unbound incorporates modern features based on open standards. It's fully open source, an… Nebulo - Non-root, small-sized DNS changer utilizing DNS-over-HTTPS and DNS-over-TLS. (Note, since this uses Android's VPN API, it is not possible to run a VPN while using Nebulo.) RethinkDNS & Firewall - Free and open source DNS changer with support for DNS-over-HTTPS, DNS-over-Tor, and DNSCrypt v3 with Anonymized Relays. (Note, since this uses Android's VPN API, it is not possible to run a VPN while… Stubby - Acts as a local DNS Privacy stub resolver (using DNS-over-TLS). Stubby encrypts DNS queries sent from a client machine (desktop or laptop) to a DNS Privacy resolver increasing end user privacy. Stubby…A firewall is a program which monitors the incoming and outgoing traffic on your network, and blocks requests based on rules set during its configuration. Properly configured, a firewall can help protect against attempts to remotely access your computer, as well as control which applications can access which IPs.
NetGuard - Provides simple and advanced ways to block access to the internet. Applications and addresses can individually be allowed or denied access to Wi-Fi and/or mobile connection. AFWall+ - Android Firewall+ (AFWall+) is an advanced iptables editor (GUI) for rooted Android devices, which provides very fine-grained control over which Android apps are allowed to access the network. RethinkDNS & Firewall - An open-source ad-blocker and firewall app for Android 6+ (does not require root). SimpleWall - Tool to control Windows Filtering Platform (WFP), in order to configure detailed network activity on your PC. (Windows) LuLu - Free, open source macOS firewall. It aims to block unknown outgoing connections, unless explicitly approved by the user. Little Snitch - A very polished application firewall, allowing you to easily manage internet connections on a per-app basis. (Mac OS) OpenSnitch - Makes internet connections from all apps visible, allowing you to block or manage traffic on a per-app basis. GNU/Linux port of the Little Snitch application firewall. Gufw - Open source GUI firewall for Linux, allowing you to block internet access for certain applications. Supports both simple and advanced mode, GUI and CLI options, very easy to use, lightweight/ low-over…iptables much more easily. IPFire - IPFire is a hardened, versatile, state-of-the-art Open Source firewall based on Linux. Easy to install on a raspberry Pi, since it is lightweight and heavily customizable. BunkerWeb - BunkerWeb is an open-source Next-Generation Web Application Firewall (WAF). It provides easy protection for your web services and is designed to remain secure by default. It integrates seamlessly with… OPNSense - Enterprise firewall and router for protecting networks, built on the FreeBSD system.There are different types of firewalls, that are used in different circumstances. This does not omit the need to configure your operating systems defences. Follow these instructions to enable your firewall in Windows, Mac OS, Ubuntu and other Linux distros.
Even when properly configured, having a firewall enabled does not guarantee bad network traffic can not get through and especially during boot if you don't have root privileges.
There are a few different ways to block ads - browser-based ad-blockers, router-based / device blockers or VPN ad-blockers. Typically they work by taking a maintained list of hosts, and filtering each domain/ IP through it. Some also have other methods to detect certain content based on pattern matching
Pi-Hole - Incredibly powerful, network-wide ad-blocker. Works out-of-the-box, light-weight with an intuitive web interface, but still allows for a lot of advanced configuration for power users. As well as block… Diversion - A shell script application to manage ad-blocking, Dnsmasq logging, Entware and pixelserv-tls installations and more on supported routers running Asuswrt-Merlin firmware, including its forks. hBlock - A POSIX-compliant shell script, designed for Unix-like systems, that gets a list of domains that serve ads, tracking scripts and malware from multiple sources and creates a hosts file (alternative for… RethinkDNS & Firewall - Free and open source ad-blocker and a firewall for Android 6+ (no root required). uBlock Origin - Light-weight, fast browser extension for Firefox and Chromium (Chrome, Edge, Brave Opera etc), that blocks tracking, ads and known malware. uBlock is easy-to-use out-of-the-box, but also has a highly… AdGuard Home - Self-hosted, network-wide DNS server that blocks ads and trackers for every device on your network, comparable to Pi-hole. Open source, with a web dashboard, encrypted DNS, and parental controls. Need…Some VPNs have ad-tracking blocking features, such as TrackStop with PerfectPrivacy.
Private Internet Access, CyberGhost, PureVPN, and NordVPN also have ad-block features. But do not meet security/privact requirements to be included.
Hosts by StevenBlack - Open source, community-maintained consolidated and extending hosts files from several well-curated sources. You can optionally pick extensions to block p0rn, Social Media, gambling, fake news and othe… No Google - Totally block all direct and indirect content from Google, Amazon, Facebook, Apple and Microsoft (or just some). iBlockList - Variety of lists (free and paid-for) for blocking content based on certain topics, inducing: spam, abuse, political, illegal, hijacked, bad peers and more.Installing a custom firmware on your Wi-Fi router gives you greater control over security, privacy and performance
Flashing custom firmware may void your warranty. If power is interrupted mid-way through a firmware install/ upgrade it is possible for your device to become bricked. So long as you follow a guide, and use a well supported system, on a supported router, than it should be safe
Whether you live in a country behind a firewall, or accessing the internet through a proxy - these tools will help you better understand the extent of blocking, deep packet inspection and what data is being analysed
OONI - Open Observatory of Network Interference - A free tool and global observation network, for detecting censorship, surveillance and traffic manipulation on the internet. Developed by The Tor Project, an… Goodbye DPI - Passive Deep Packet Inspection blocker and Active DPI circumvention utility, for Windows.An IDS is an application that monitors a network or computer system for malicious activity or policy violations, and notifies you of any unusual or unexpected events. If you are running a server, then it's essential to know about an incident as soon as possible, in order to minimize damage.
Zeek - Zeek (formally Bro) Passively monitors network traffic and looks for suspicious activity. OSSEC - OSSEC is an Open Source host-based intrusion detection system, that performs log analysis, integrity checking, monitoring, rootkit detection, real-time alerting and active response. Kismet - An 802.11 layer2 wireless network detector, sniffer, and intrusion detection system. Snare - SNARE (System iNtrusion Analysis and Reporting Environment) is a series of log collection agents that facilitate centralized analysis of audit log data. Logs from the OS are collected and audited. Ful…Web, VPS, storage and managed app hosting, from privacy-conscious providers that own and run their own infrastructure
Bunker - French sovereign cloud from France Nuage: managed open-source apps, PostgreSQL and S3-compatible storage in its own datacenters. Source is public but under SSPL-1.0, which is not OSI-approved. ISO 270…The country that your data is hosted in will be subject to local laws and regulations. It is therefore important to avoid a jurisdiction that is part of the 5 eyes and other international cooperatives who have legal right to view your data.
See also: Bahnhof, which offers high-security hosting from its own data centres in Sweden, but takes card and PayPal only. Greenhost runs its own network in Amsterdam, and hosts GlobaLeaks whistleblowing platforms for journalists and NGOs. Exoscale is an ISO 27001 certified Swiss IaaS provider with EU zones, though it is owned by Telekom Austria and colocates rather than owning its data centres. FlokiNET hosts in Iceland, Finland and Romania, needs no personal data and takes Monero, but its network is tracked by threat intelligence feeds for abuse. And Packetra offers hosting in Finland and Switzerland, with no identity documents at signup and payment in Bitcoin or Monero via a self-hosted BTCPay instance, though it is a new provider with no track record yet (see #749 for details).
deSEC - Free DNS hosting provider designed with security in mind, and running on purely open source software. deSEC is backed and funded by SSE. Mail-in-a-box - Easy-to-deploy fully-featured and pre-configured SMTP mail server. It includes everything from webmail, to spam filtering and backups. Docker Mailserver - A full-stack but simple mailserver (smtp, imap, antispam, antivirus, ssl...) using Docker. Very complete, with everything you will need, customizable and very easy to deploy with docker. mailcow - A mail server with everything you need (SMTP, IMAP, webmail, NextCloud support..) using Docker.Self-hosting your own mail server is not recommended for everyone, it can be time consuming to setup and maintain and securing it correctly is critical
Turtle - A secure, collaborative notebook. Self-host it yourself, or use their hosted plan (free edition or $3/ month for premium). Joplin - Cross-platform desktop and mobile note-taking and todo app. Easy organisation into notebooks and sections, revision history and a simple UI. Allows for easy import and export of notes to or from other… Logseq - Privacy-first, open-source knowledge base that works on top of local plain-text Markdown and Org-mode files. Supports lots of different note modes, including task management, PDF annotation, flashcard… Obsidian - A powerful knowledge base that works on top of local plain-text Markdown files. It has a strong community, and a lot of plugins and themes. Generally privacy-respecting, but no encryption out of the b… Cryptee - Private & encrypted rich-text documents. Cryptee has encryption and anonymity at its core, it also has a beautiful and minimalistic UI. You can use Cryptee from the browser, or download native apps. C…If you are already tied into Evernote, One Note etc, then SafeRoom is a utility that encrypts your entire notebook, before it is uploaded to the cloud.
Org Mode is a mode for GNU Emacs dedicated to working with the Org markup format. Org can be thought of as a more featureful Markdown alternative, with support for keeping notes, maintaining todo lists, planning projects, managing spreadsheets, and authoring documents -all in plaintext.
For a simple plain text note taking app, with strong encryption, see Protected Text, which works well with the Safe Notes Android app. Laverna is a cross-platform secure notes app, where all entries are formatted with markdown. Bangle.io is a local-first WYSIWYG Markdown notes PWA, storing notes in browser storage or user-selected folders.
Proton Calendar - The calendar app from the Proton suite. End-to-end encrypted. Supports ICS (not encrypted), colours, recurring events, mail integration, notifications and multiple time zones. Nextcloud Calendar - Calendar app for the self-hosted Nextcloud platform. Uses CalDAV for sync across devices. No E2E encryption support. Fossify Calendar - Fossify Calendar from the family of forked FOSS apps from the discontinued SimpleMobileTools. Simple, customizable, includes widgets. Note that CalDAV support is currently limited (see #921… KashCal - Offline-first Android calendar that syncs with iCloud, CalDAV and device calendars. No account, no telemetry; credentials are stored in the Android Keystore. Events are not end-to-end encrypted, so sy… Tymeslot - Open-source (AGPL-3.0), self-hostable scheduling and calendar platform. Guests book without creating an account; hosts get a full calendar with two-way sync to Google, Outlook and iCloud. A managed cl… Rallly - Open-source & self-hostable scheduling tool that helps you find the best date and time to meet. Create a poll with a few options, share the link, and let your participants vote on when they're availab… Super Productivity - Privacy-respecting, open-source task manager and time tracker. All data is stored locally on your device - no account required, no cloud dependency, and zero telemetry. Supports Jira, GitLab, GitHub,… Mindwtr - A Getting Things Done + Pomodoro productivity system for desktop and mobile. Local-first, no account required, can sync via WebDAV/Dropbox/local file or self-hosted deployment. With a CLI, REST API an… SeaFile - An open source cloud storage and sync solution. Files are grouped into Libraries, which can be individually encrypted, shared of synced. Docker image available for easy deployment, and native clients… Syncthing - Continuous file synchronization between 2 or more clients. It is simple, yet powerful, and fully-encrypted and private. Syncthing can be deployed with Docker, and there are native clients for Windows,… NextCloud - Feature-rich productivity platform, that can be used to backup and selectively sync encrypted files and folders between 1 or more clients. A key benefit the wide range of plug-ins in the NextCloud App… bewCloud - Modern and simpler alternative to Nextcloud/ownCloud crafted with TypeScript. Unifies file management, sync, sharing, notes, RSS, expenses, calendars, contacts, and photos, with MFA, WebDAV, CalDAV, C…You should always ensure that any data stored in the cloud is encrypted. If you are hosting your own server, then take the necessary precautions to secure the server. For hosted solutions - use a strong password, keep your credentials safe and enable 2FA.
Alternatively, consider a headless utility such as Duplicacy or Duplicity. Both of offer an encrypted and efficient sync between 2 or more locations, using the rsync algorithm.
SpiderOak, Tresorit and Resilio are good enterprise solutions, all with solid encryption baked-in
FileRun and Pydio are self-hosted file explorers, with cross-platform sync capabilities.
CryptPad - A zero knowledge cloud productivity suite. Provides Rich Text, Presentations, Spreadsheets, Kanban, Paint a code editor and file drive. All notes and user content, are encrypted by default, and can on… NextCloud - A complete self-hosted productivity platform, with a strong community and growing app store. NextCloud is similar to (but arguably more complete than) Google Drive, Office 365 and Dropbox. Clear UI an… Disroot - A platform providing online services based on principles of freedom, privacy, federation and decentralization. It is an implementation of NextCloud, with strong encryption configured - it is widely us…Backing up important files is essential, and keeping an off-site copy is recommended. But many free providers do not respect your privacy, and are not secure enough for sensitive documents. Avoid free mainstream providers, such as Google Drive, cloud, Microsoft Overdrive, Dropbox.
It is recommended to encrypt files on your client machine, before syncing to the cloud. Cryptomator is a cross-platform, open source encryption app, designed for just this.
An alternative option, is to use a cloud computing provider, and implement the syncing functionality yourself, and encrypt data locally before uploading it - this may work out cheaper in some situations. You could also run a local server that you physically own at a secondary location, that would mitigate the need to trust a third party cloud provider. Note that some knowledge in securing networks is required.
1time.io - 1time.io - Zero-knowledge one-time secret sharing with AES-256-GCM browser-side encryption, HKDF key derivation, CLI tool, and Docker self-hosting. SkySend - Share end-to-end encrypted Markdown notes, files, code and passwords/keys, or request secrets from others. Set a password, expiration time and/or maximum views. No account necessary. Self-hostable and…Instant.io, is another peer-to-peer based solution, using Web Torrent.
For specifically transferring images, Up1 is a good self-hosted option, with client-side encryption.
Finally PsiTransfer is a feature-rich, self-hosted file drop, using streams.
Shiori - Simple bookmark manager written in Go, intended to be a clone of Pocket, it has both a simple and clean web interface as well as a CLI. Shiori has easy import/ export, is portable and has webpage arch…Ymarks is a C-based self-hosted bookmark synchronization server and Chrome extension.
syncmarx uses your cloud storage to sync bookmarks (Chrome and Firefox).
NextCloud Bookmarks has several community browser extensions, inducing FreedomMarks (Firefox) and OwnCloud Bookmarks (Chrome).
Finally, Turtl Notes has excellent link saving functionality built-in
RainDrop is a fully-featured all-in-1 bookmarking and web-snip suite. It has a beautiful UI, good data controls and some very handy integrations and features. Available on desktop, mobile, web and through a browser extension. The catch is that it is not open source, there is a free and premium plan, but no option for self-hosting.
OpenHabitTracker - Free, open source habit tracker. Take notes, plan tasks, and track habits. All data stored locally or self-hosted via Docker. No accounts required.With the many, many security issues with Zoom, and other mainstream options, it becomes clear that a better, more private and secure alternative is required. As with other categories, the "best video calling app" will be different for each of us, depending on the ratio of performance + features to security + privacy required in your situation.
Jami - A free and open source, distributed video, calling and screenshare platform with a focus on security. Jami is completely peer-to-peer, and has full end-to-end encryption with perfect forward secrecy f… Jitsi - Encrypted, free and open source video calling app, which does not require creating an account/ providing any personal details. Available as a web app, and native app for Windows, MacOS, Linux, Android…Apache OpenMeetings provides self-hosted video-conferencing, chat rooms, file server and tools for meetings.
together.brave.com is Brave's Jitsi Fork.
For remote learning, BigBlueButton is self-hosted conference call software, aimed specifically at schools and Universities. It allows for the host/ teacher to have full control over the session, and provides high-quality video streaming, multi-user whiteboards, breakout rooms, and instant chat.
Mainstream mapping apps log your location history, search queries and routes, building a detailed picture of where you live, work and travel. A privacy-respecting maps app keeps navigation on your device, works offline, and collects nothing about you.
Accessibility software like screen readers, dictation and voice input often runs in the cloud, sending everything you say or read to a remote server. Privacy-respecting alternatives keep this processing on your device, so your input never leaves it.
Vocalinux - Offline system-wide voice dictation for Linux (X11 and Wayland). Uses local models (whisper.cpp, Whisper, or VOSK) so microphone audio never leaves the device. Tray app with hotkeys; GPLv3. Currently…A virtual machine (VM) is a sandboxed operating system, running within your current system. Useful for compartmentalisation and safely testing software, or handling potentially malicious files
Xen Project - Open source virtual machine monitor intended to serve as a type-1 hyperviser for multiple operating systems using the same hardware - very useful for servers, as it allows for fully independent virtua… UTM - Open source, feature rich, powerful type 2 hypervisor for Mac, can emulate x86-64 OSes on Apple Silicon Macs. There's also an iOS version (so you can run Windows on your iPhone!)…QEMU is a virtual hardware emulation tool, meaning it is less appropriate for creating fully independant sandboxes, but performance is considerable better than that of a traditional virtual machine.
VMWare is popular in the enterprise world, it is not open source, and although there is a free version, a license is required to access all features. VMWare performs very well when running on a server, with hundreds of hosts and users.
For Mac users, Parallels is a popular option which performs really well, but again is not open source.
For Windows users, there's Hyper-V, which is a native Windows product, developed by Microsoft.
Tools for signing, verifying, encrypting and decrypting text and files using GnuPG standard
SeaHorse - Application for managing encryption keys and passwords, integrated with the GNOME Keyring. Kleopatra - Certificate manager and a universal crypto GUI. It supports managing X.509 and OpenPGP certificates in the GpgSM keybox and retrieving certificates from LDAP servers. GPG4Win - Kleopatra ported to Windows. GPG Suite - Successor of MacGPG. Plays nice with MacOS apps, including Finder, Appple Mail, Keychain and Spotlight. Makes encrypting files, emails, and messages / data very easy. As well as GUI for generating key… PGP Everywhere - iOS app for encrypting/ decrypting text. Has native keyboard integration, keychain support and app integrations which makes it quick to use in any app. FlowCrypt - Browser extension for using PGP within Gmail, for Chrome and Firefox. Mobile version supported on Android and iOS.Exif/ Metadata is "data about data", this additional information attached to files can lead us to share significantly more information than we intended to.
For example, if you upload an image of a sunset to the internet, but don't remove the metadata, it may reveal the location (GPS lat + long) of where it was taken, the device is was taken on, precise camera data, details about modifications and the picture source + author. Social networks that remove metadata from your photos, often collect and store it, for their own use. This could obviously pose a security risk, and that is why it is recommended to strip out this data from a file before sharing.
ExifCleaner - Cross-platform, open source, performant EXIF meta data removal tool. This GUI tool makes cleaning media files really easy, and has great batch process support. Created by @szTheory, and uses ExifTool. ImageOptim - Native MacOS app, with drag 'n drop image optimization and meta data removal.It's possible (but slower) to do this without a third-party tool. For Windows, right click on a file, and go to:
Properties --> Details --> Remove Properties --> Remove from this File --> Select All --> OK.Alternatively, with ImageMagic installed, just run
convert -strip path/to/image.pngto remove all metadata.If you have GIMP installed, then just go to
File --> Export As --> Export --> Advanced Options --> Uncheck the "Save EXIF data" option.Often you need to perform meta data removal programmatically, as part of a script or automation process.
Simply deleting data, does not remove it from the disk, and recovering deleted files is a simple task.
Therefore, to protect your privacy, you should erase/ overwrite data from the disk, before you destroy, sell or give away a hard drive.
Eraser - Allows you to completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns. OW Shredder - File, folder and drive portable eraser for Windows. Bundled with other tools to scan, analyze, and wipe, and other traces that were left behind. Includes context menu item, recycle bin integration.There's no need to use a third-party tool. You can boot into a UNIX-based system, mount the disk you need to erase, and use a command to write it with arbitrary data. For best results, this process should be repeated several times. This is a good way to wipe a disk, before selling or destroying it, to protect your data.
Such as the
ddcommand, is a tool to convert and copy files, but runningsudo dd if=/dev/zero of=/dev/sdX bs=1Mwill quickly overwrite the whole disk with zeros. Or badblocks which is intended to search for all bad blocks, but can also be used to write zeros to a disk, by runningsudo badblocks -wsv /dev/sdd.An effective method of erasing an SSD, it to use hdparm to issue a secure erase command, to your target storage device, for this, see step-by-step instructions via: wiki.kernel.org.
Finally, srm can be use to securely remove files or directories, just run
srm -zsv /path/to/filefor a single pass over.
If you are an Android user, your device has Google built-in at its core. Google tracks you, collecting a wealth of information, and logging your every move.
A custom ROM, is an open source, usually Google-free mobile OS that can be flashed to your device.
GrapheneOS - GrapheneOS is an open source privacy and security focused mobile OS with Android app compatibility. Developed by Daniel Micay. GrapheneOS is a young project, and currently only supports Pixel devices,… LineageOS - A free and open-source operating system for various devices, based on the Android mobile platform - Lineage is light-weight, well maintained, supports a wide range of devices, and comes bundled with P… CalyxOS - An open source, de-Googled Android OS focused on privacy and security, with optional microG, a built-in firewall and encrypted backups. Runs on select Google Pixel, Fairphone and Motorola devices, and…It is not recommended to root, or flash your device with a custom ROM if you are not an advanced user. There are risks involved
- Although the above ROMs omit Google, they do open up other security issues: Without DM-verity on the system partition, the file system could be tampered with, and no verified boot stack, the kernel/initramfs also could be edited. You should understand the risks, before proceeding to flash a custom ROM to your device
- You will need to rely on updates from the community, which could be slower to be released - this may be an issue for a time-urgent, security-critical patch
- It is also possible to brick your device, through interrupted install or bad software
- Finally, rooting and flashing your device, will void your warranty
Replicant OS is a fully-featured distro, with an emphasis on freedom, privacy and security.
OmniRom, Resurrection Remix OS and Paranoid Android are also popular options.
Alternatively, Ubuntu Touch is a Linux (Ubuntu)- based OS. It is secure by design and runs on almost any device, - but it does fall short when it comes to the app store.
To install apps on the Play Store without using the Play Store app see Aurora Store. For Google Play Service see MicroG
Windows and MacOS have many features that violate your privacy. Microsoft and Apple are able to collect all your data (including, but not limited to: keystrokes, searches and mic input, calendar data, music, photos, credit card information and purchases, identity, passwords, contacts, conversations and location data). Microsoft Windows is also more susceptible to malware and viruses, than alternative systems.
Switching to Linux is a great choice in terms of security and privacy - you don't need necessarily need to use a security distro, any well-maintained stable distro is going to be considerably better than a proprietary OS
Septor is a Debian-based distro with the KDE Plasma desktop environment, and Tor baked-in. Designed for surfing the web anonymously, and completing other internet-based activities (with Thunderbird, Ricochet IM, HexChat, QuiteRSS, OnionShare). Septor is light-weight, but comes bundled with all the essential privacy + security utilities (including: Gufw, Ark, Sweeper, KGpg, Kleopatra, KWallet, VeraCrypt, Metadata Anonymisation Toolkit and more).
Subgraph OS is designed to be an adversary resistant computing platform, it includes strong system-wide attack mitigations, and all key applications run in sandbox environments. Subgraph is still in beta (at the time of writing), but still is well tested, and has some nice anonymization features
For defensive security, see Kali and BlackArch, both are bundled with hundreds of security tools, ready for pretty much any job (not reccomended as a daily driver!)
Other security-focused distros include: TENS OS, Fedora CoreOS, Kodachi and IprediaOS (Avoid systems that are not being actively maintained)
If you do not want to use a specalist security-based distro, or you are new to Unix - then just switching to any well-maintained Linux distro, is going to be significantly more secure and private than Windows or Mac OS. Since it is open source, major distros are constantly being audited by members of the community. Linux does not give users admin rights by default - this makes is much less likely that your system could become infected with malware. And of course, there is no proprietary Microsoft or Apple software constantly monitoring everything you do.
Some good distros to consider would be: Fedora, Debian, or Arch- all of which have a large community behind them. Manjaro (based of Arch) is a good option, with a simple install process, used by new comers, and expers alike. POP_OS and PureOS are reasonably new general purpose Linux, with a strong focus on privacy, but also very user-friendly with an intuitive interfac and install process. See Detailed Comparison.
BSD systems arguably have far superior network stacks. OpenBSD is designed for maximum security — not just with its features, but with its implementation practices. It's a commonly used OS by banks and critical systems. FreeBSD is more popular, and aims for high performance and ease of use.
Two alternative options for Windows users are Windows 10 AME (ameliorated) project and the LTSC stream.
After installing your new operating system, or if you have chosen to stick with your current OS, there are a couple of things you can do to improve security. See: Windows 10 security guide, Mac OS security guide or Linux security guide.
SysWarden - Open-source, host-local Linux security orchestrator combining nftables enforcement, system telemetry, threat-intelligence feeds, out-of-band WAAP log analysis and a terminal dashboard. It requires Lin…SecTools.org is a directory or popular Unix security tools.
ShutUp10 - A portable app that lets you disable core Windows features (such as Cortana, Edge) and control which data is passed to Microsoft. (Note: Free, but not open source). WPD - Portable app with a GUI, that makes it really easy to safely block key telemetry features, from sending data to Microsoft and other third parties (It uses the Windows API to interact with key features… GhostPress - Anti low-level keylogger: Provides full system-wide key press protection, and target window screenshot protection. KeyScrambler - Provides protection against software keyloggers. Encrypts keypresses at driver level, and decrypts at application level, to protect against common keyloggers. SafeKeys V3.0 - Portable virtual keyboard. Useful for protecting from keyloggers when using a public computer, as it can run of a USB with no administrative permissions. RKill - Useful utility, that attempts to terminate known malware processes, so that your normal security software can then run and clean your computer of infections. IIS Crypto - A utility for configuring encryption protocols, cyphers, hashing methods, and key exchanges for Windows components. Useful for sysadmins on Windows Server. BleachBit - Clears cache and deletes temporary files very effectively. This frees up disk space, improves performance, but most importantly helps to protect privacy. USBFix - Detects infected USB removable devices. ScreenWings - Blocks malicious background applications from taking screenshots. Win11Debloat - Open-source PowerShell script that removes bloatware, disables telemetry and pre-installed apps for Windows 10 and 11, with whitelists/blacklists reversion support. It heavily modifies the OS, so a re…(The above software was last tested on 01/05/20). Many of the above tools are not necessary or suitable for beginners, and can cause your system to break - only use software that you need, according to your threat model. Take care to only download from an official/ legitimate source, verify the executable before proceeding, and check reviews/ forums. Create a system restore point, before making any significant changes to your OS (such as disabling core features).
From a security and privacy perspective, Linux may be a better option.
See also these lists:
LuLu - Free, open source macOS firewall. It aims to block unknown outgoing connections, unless explicitly approved by the user. Stronghold - Easily configure macOS security settings from the terminal.Cross-platform, open source malware detection and virus prevention tools
ClamAV - An open source cross-platform antivirus engine for detecting viruses, malware & other malicious threats. It is versatile, performant and very effective. VirusTotal - Web-based malware scanner, that inspects files and URLs with over 70 antivirus scanners, URL/domain services, and other tools to extract signals and determine the legitimacy.For Microsoft Windows, Windows Defender provides totally adequate virus protection in most cases. These tools are intended for single-use in detecting/ removing threats on an infected machine, and are not recommended to be left running in the background, use portable editions where available.
Many anti virus products have a history of introducing vulnerabilities themselves, and several of them seriously degrade the performance of your computer, as well as decrease your privacy. Never use a free anti-virus, and never trust the companies that offer free solutions, even if you pay for the premium package. This includes (but not limited to) Avast, AVG, McAfee and Kasperky. For AV to be effective, it needs intermate access to all areas of your PC, so it is important to go with a trusted vendor, and monitor its activity closely.
For 1-off malware scans on Windows, MalwareBytes is portable and very effective, but not open source
SourceHut - Git and mercurial code hosting, task management, mailing lists, wiki hosting and Alpine-based build pipelines. Can be self-hosted, or used through the managed instance at sr.ht. Codeberg - A fully-managed instance of Forgejo. VSCodium - Free and open source binaries of VS Code, built without Microsoft branding and with community-driven defaults. Extension compatibility can differ from Microsoft's official VS Code build. Alacritty - Fast, GPU-accelerated terminal emulator focused on simplicity, performance, and extensive keyboard-driven workflows. gitGost - Push to GitHub anonymously: add gitGost as a git remote and it opens a pull request with your name, email and commit metadata stripped, optionally over Tor. Anonymity isn't perfect, and the hosted ser…Google Assistant, Alexa and Siri don't have the best reputation when it comes to protecting consumers privacy, there have been many recent breaches.
For that reason it is recommended not to have these devices in your house. The following are open source AI voice assistants, that aim to provide a human voice interface while also protecting your privacy and security
⚠️ This section is still a work in progress ⚠️
Check back soon, or help us complete it by submitting a pull request
If you are building your own assistant, you may want to consider a hardware-switch for disabling the microphone. Keep tabs on issues and check the code, to ensure you are happy with how it works, from a privacy perspective.
Mycroft and Kalliope removed, as no longer active.
If you choose to continue using Google Home/ Alexa, then check out Project Alias. It's a small app that runs on a Pi, and gives you more control over your smart assistants, for both customisation and privacy.
For a desktop-based assistant, see Dragonfire for Ubuntu, and Jarvis for MacOS.
LinTO, Jovo and Snips are private-by-design voice assistant frameworks that can be built on by developers, or used by enterprises.
Jasper, Stephanie and Hey Athena are Python-based voice assistant, but neither is under active development anymore. See also OpenAssistant.
Gladys Assistant - An open source privacy-respecting Home Assistant, compatible with a wide range of devices including Raspberry Pi, desktop computers, or NAS systems. Actively developed, with good french community and… Secluso - An open source, end-to-end encrypted home security camera solution (Pi Zero 2W). Easy to setup with GUI deploy tool. Fully E2EE remote access (live streaming & smart motion alerts) via mobile app and… Gadgetbridge - Open source Android app that connects smartwatches and fitness trackers to your phone without the vendor app or cloud account. Supports 30+ brands (Mi Band, Amazfit, Pebble, Huawei), though feature pa…Not all cryptocurrencies are anonymous, and without using a privacy-focused coin, a record of your transaction will live on a publicly available distributed ledger, forever. If you send of receive multiple payments, ensure you switch up addresses or use a mixer, to make it harder for anyone trying to trace your transactions. Cryptocurrencies that allow private and public transactions may reveal meta data about your transactions and balances when funds are moving from private to public addresses which can compromise your privacy with methods similar to a knapsack problem.
Always store private keys somewhere safe, but offline
Note: Cryptocurrency prices can go down. Storing any wealth in crypto may result in losses. If you are new to digital currencies - do your research first, don't invest more than you can afford to loose, and be very weary crypto-related scams are very common. as is and cryptocurrency-related malware.
This is NOT financial advice
Other privacy-focused cryptocurrencies include: PIVX, Verge, and Piratechain.
It is still possible to use currencies that have a public ledger 'privately', but you will need to take great care not to cause any transactions to be linked with your identity or activity. For example, avoid exchanges that require KYC, and consider using a service such as Local Bitcoins. If you use a Bitcoin ATM, then take care to not be physically tracked (CCTV, phone location, card payments etc)
Wasabi Wallet - An open source, native desktop wallet for Windows, Linux, and MacOS. Wasabi implements trustless CoinJoins over the Tor network. Neither an observer nor the participants can determine which output bel… Trezor - Open source, cross-platform, offline, crypto wallet, compatible with 1000+ coins. Your private key is generated on the device, and never leaves it, all transactions are signed by the Trezor, which ens…Avoid using any online/ hot-wallet, as you will have no control over the security of your private keys.
Offline paper wallets are very secure, but ensure you store it properly - to keep it safe from theft, loss or damage.
Vultisig is a seedless, self-custodial wallet. It uses MPC threshold signatures to split your key across several devices you own, so there's no seed phrase to write down or leak. It adds no on-chain privacy, and chain queries default to Vultisig's own endpoints unless you set a custom RPC.
Metamask (Ethereum and ERC20 tokens) is a bridge that allows you to visit and interact with distributed web apps in your browser. Metamask has good hardware wallet support, so you can use it to swap, stake, sign, lend and interact with dapps without you're private key ever leaving your device. However the very nature of being a browser-based app means that you need to stay vigilant with what services you give access to.
For traders, BaseFEX doesn't require ID and has a good privacy policy.
BitMex has more advanced trading features, but ID verification is required for higher value trades involving Fiat currency.
For buying and selling alt-coins, Binance has a wide range of currencies,
and ID verification is not needed for small-value tradesbut ID verification is required in most countries.Cunicula is a curated directory of no-KYC and privacy-first services, including crypto exchanges, swap services, P2P markets, and non-custodial wallets. Each entry is tagged with its KYC level, jurisdiction, supported payment methods, and a trust score reflecting audit history and known incidents.
Umbra - Umbra is a stealth address protocol on the EVM. It allows users to send payments to a one-time address controlled by a recipient without their interaction, promoting unlinkability (if proper hygiene i…Virtual card
Truncated — view the full README on GitHub.
(top 24 of 47)
3,232 followers · starred Jul 2022
112 followers · starred Jul 2024
690 followers · starred Mar 2024
249 followers · starred Feb 2025