Correction, October 7, 2026: This guide replaces unsupported product rankings, blanket surveillance claims and outdated prices. It also corrects the claim that a VPN hides your IP address from your internet provider. The original publication date is retained.
Start with the job, then choose the tool. An account takeover, a tracking link and a photo containing a home address need different responses. Installing ten apps without a plan makes it harder to know what each one is doing.
The EFF security-plan worksheet helps identify the information you need to protect and the people who might seek it. For a short sequence of actions, use our practical privacy guide. This page is a reference for choosing tools, rather than a ranking of products.
1. A password manager for unique account passwords
Bitwarden provides a vault and password generator. KeePassXC uses a database file; you decide how to back it up and whether to sync it through another service. Choose the storage and recovery arrangement you can maintain. Practise recovery before depending on it, and protect the vault itself.
An online strength estimate is not a password manager. Use invented examples in our Password Audit; do not paste an important live password into a website just to get a score.
2. An encrypted messenger for conversations
Signal encrypts messages and calls end to end, while retaining some technical information needed to operate the service. Registration still uses a phone number. That is more precise than saying it collects no metadata. Check the recipient and linked devices, and remember that the person receiving a message can save or share it.
3. A browser with settings you understand
Mullvad Browser is designed to reduce tracking and fingerprinting. It does not make every user indistinguishable in every situation, and a browser choice does not cancel information you submit to a site. Review your current browser’s tracking protections before changing many settings at once. Keep a note of any change so you can diagnose a broken site.
4. An extension review, before another extension
Use your browser’s extension manager to remove add-ons you no longer need. Mozilla’s guidance recommends checking the developer, privacy policy and whether requested access matches the feature. Broad access can have a legitimate purpose, including for a content blocker, but deserves inspection. A store listing is not a safety guarantee.
5. URL Cleaner for links you plan to share
Our URL Cleaner removes recognized tracking parameters in your browser. Review the result before sharing: an unfamiliar parameter may be necessary for the destination to work. Cleaning a link does not inspect the page for malware or prevent tracking after you open it.
6. EXIF Viewer for photo metadata
EXIF Viewer reads supported metadata locally, including location tags when present. Missing tags do not prove a picture is anonymous or authentic. Look at the picture too: street signs, reflections and screens can identify a place or person without a GPS tag.
7. Metadata Wiper for a new image copy
Metadata Wiper re-encodes an image in the browser. Keep your original, then inspect the downloaded copy with the viewer. This workflow does not remove a name printed inside the picture or erase copies already shared. Check the chosen output format and appearance before publishing.
8. Text Sanitizer for a draft containing personal details
Text Sanitizer helps find and replace supported patterns. Review the entire result yourself; names and contextual clues can remain. Invisible characters are not a reliable way to stop scraping or AI use. Our earlier privacy guide incorrectly suggested otherwise.
9. Cryptomator for selected cloud files
Cryptomator’s documented scope includes encrypting file contents and names before cloud storage. Sizes and timestamps remain outside that protection. It also cannot protect an unlocked vault from malware running on the device. Keep recoverable backups and understand which files are actually inside the vault.
10. A VPN when its network role fits your need
The EFF VPN guide explains the shift in trust from a local network or internet provider to a VPN provider. Your internet provider still knows your connection and can see that you connect to a VPN. Websites can still identify a logged-in account. Treat a VPN check as a view of selected connection signals, not an anonymity certificate.
Pick one concrete task and finish it. Save the recovery information, reopen the exported file, or check that the cleaned link still works. That verification is more useful than collecting tools you have not learned to use.