You don't need a threat model or a tinfoil hat to want better online privacy. You just need an afternoon and this list. Everything below is free (with one exception clearly noted), open-source or otherwise trusted, and installs in ten minutes each.
Work through them in order — the earlier ones are the highest-impact.
1. Bitwarden password manager
The single most important privacy upgrade any human can make in 2026. Bitwarden is open-source, free forever for personal use, and works on every device you own.
Import your passwords from your browser (or from another password manager), turn on the browser extension, and let it autofill everything. The moment you never re-use a password again is the moment 90% of "I got hacked" stories stop being possible for you.
2. Aegis Authenticator (Android) or Raivo OTP (iOS)
Two-factor authentication that isn't tied to your phone number. Both are open-source, both back up your codes encrypted to your own storage, and both are miles better than Google Authenticator or Authy's cloud-lock-in model.
Move every 2FA code out of your SMS or your existing authenticator to one of these. Takes an evening; protects you for years.
3. uBlock Origin
The only browser tracker/ad blocker you need. Install the extension from your browser's store (Firefox, Chrome, Edge — all supported). It blocks ads, trackers, malware domains, and the roughly 200 fingerprinting scripts every average news site loads.
Faster page loads as a nice side effect. Roughly 40% less data usage on typical browsing.
4. Firefox with strict tracking protection
If you're still on Chrome and don't want to think hard about it, at minimum enable Enhanced Tracking Protection → Strict in Firefox and switch. Firefox blocks cross-site cookies, fingerprinters, and known trackers by default at the Strict level.
Bonus: Firefox is the only major browser not built by an ad company or dependent on ad revenue.
5. DuckDuckGo (or Kagi if you'll pay)
Replace Google as your default search engine. DuckDuckGo is free, doesn't track you, and returns roughly the same results as Google for 95% of searches. For the 5% of highly-specific queries where you want Google's index, type !g your query in DuckDuckGo and it forwards you.
If you'll pay $10/month for search that's genuinely better, Kagi is our team's pick — no ads, no tracking, and results that actually respect your query.
6. 1.1.1.1 or Quad9 DNS
Change your device's (or router's) DNS to Cloudflare's 1.1.1.1 or Quad9's 9.9.9.9. Both are free, both are faster than your ISP's DNS in most regions, and both drop the browsing history harvesting that many ISPs sell to advertisers.
Quad9 additionally blocks known malicious domains at the DNS level — an extra layer of protection for the whole household.
7. Signal for messaging
Move every conversation you can from SMS, iMessage, or WhatsApp to Signal. End-to-end encrypted by default, open-source, no ads, no metadata harvesting, and now supports usernames so you don't have to share your phone number.
8. Proton Mail (free tier)
If your existing inbox is Gmail or Outlook, both companies are scanning your mail for ads or analytics purposes even if that's dressed up as "improving your experience". Proton Mail free tier gives you 1 GB, end-to-end encryption for Proton-to-Proton mail, and no scanning.
Won't fully replace Gmail if you're deep in it, but great as your "new signups" and "important accounts" mailbox.
9. Have I Been Pwned monitoring
Sign up for haveibeenpwned.com notifications with your primary email addresses. Free. You'll get an email the moment your address appears in a data breach so you know exactly which account to change first.
10. Privacy Badger (browser extension)
From the EFF. Automatically learns which third-party trackers follow you across sites and blocks them. Runs alongside uBlock Origin — they cover different domains and reinforce each other.
11. Rethink DNS (mobile firewall)
Android only, and it's brilliant. Rethink is a free app that acts as a local VPN + firewall + DNS resolver, letting you block specific trackers, apps, or IP addresses from calling home. See exactly which app on your phone is making requests, and to where.
The reveal of how many trackers your "free" flashlight app is talking to is genuinely educational.
Rule of thumb: you don't need to be perfectly private, you just need to be a harder target than the person next to you. Twelve free tools installed correctly puts you comfortably in the top 5% of internet users for privacy.
12. The one paid tool worth every penny
Mullvad VPN, $5/month, no email required to sign up, accepts cash payments. Not because you're doing anything shady — because you don't want your ISP, your Wi-Fi hotspot host, or advertisers logging every request you make.
Mullvad publishes its full server infrastructure list, has been independently audited multiple times, and runs no logs. Set it up once on your laptop and phone; the peace of mind is worth $60 a year.
Setup order
If you only have an afternoon:
- Bitwarden (step 1) — 45 min including moving all passwords
- Aegis/Raivo (step 2) — 30 min including moving 2FA codes
- uBlock Origin + Firefox strict (steps 3, 4) — 10 min
- DNS change (step 6) — 5 min
- Have I Been Pwned (step 9) — 2 min
That's the top 80% of the privacy uplift in under 90 minutes. Everything else can be added at your leisure over the following weeks.
Need help?
If installing a password manager and moving passwords feels overwhelming, book a 30-minute session and we'll walk you through it live. From $29 flat, once, and you're set for years.
How we tested for privacy recommendations
Every tool recommended here was set up on real devices and used in real workflows for a minimum of 30 days. For each password manager, VPN, browser extension, or backup service, we specifically checked: what data the service actually collects, how transparent their business model is, whether they've been independently audited, and what happens if the company goes under.
We reviewed audit reports where available (Cure53, iVerify, Trail of Bits are the auditors we weight most heavily) and read the actual privacy policies — not just the marketing summary. A product doesn't make our recommended list unless we're comfortable with a family member using it long-term.
Related privacy guides
- 12 free privacy tools you can set up in one rainy afternoon — the full weekend setup.
- 7 best password managers for families — the honest ranking.
- 5 VPN services worth paying for — plus the three to skip.
- The complete backup guide — because privacy without backups is fragile.
Common privacy questions we get
Am I paranoid for wanting more privacy?
No. Privacy tools are just seatbelts — you're not expecting a crash, but you'd rather have them. The barrier for the vast majority of attacks is low; a password manager and 2FA alone puts you in the safest 5% of internet users.
Isn't switching to privacy-focused tools a big commitment?
The initial migration takes an afternoon. After that, most privacy tools are set-and-forget — you use them the same way you used the tracker-heavy alternative, just without the data leak.
What's the single most impactful privacy upgrade?
A password manager (Bitwarden free tier, if budget is zero). Second: 2FA on your critical accounts. Third: privacy-friendly search + browser (DuckDuckGo, Firefox with Enhanced Tracking Protection strict).