Privacy
- Protects
- What you say and do online
- Against
- Advertisers, your ISP, app vendors
- Tools
- VPN, encrypted DNS, blockers, E2EE messengers and mail
Privacy Arsenal · checked 18 Oct 2026
Privacy tools, sorted by who you have to trust
An engineering reference for phishing researchers, SOC and IR analysts, investigative journalists, developers, and anyone cleaning up after a breach. Every tool is rated by what you must trust for it to work, not by its license.
- Tools
- 108
- Trust tiers
- 4
- Affiliate links
- 0
- Paid placements
- 0
Trust tierYou rely on
T1
MathYour keys, open client, no operator needed
T2
Code you can checkE2EE, open native apps, audits
T3
The operator’s claimsE2EE, but code they serve or keep closed
T4
Policy and jurisdictionNo encryption from you, only a promise
Scope
This page is for people who fight scams and for the people scams hit. It is not a guide to hiding from anyone.
- Researchers who publish reports and get the backlash: doxxing, DDoS, swatting, threats. The PhishDestroy team deals with this.
- Analysts who must not link a research profile to their personal one, or leak their own infrastructure while preserving evidence.
- Journalists, developers, and ordinary people recovering after a leak or account takeover.
Everything listed here is legal software. Laws differ by country, so check yours. Misuse is outside what this project is for.
Most scammers don’t bother
In our data, a large share of phishing operations run without a VPN and reuse servers, wallets and page templates across campaigns. That reuse is exactly how they get tracked and taken down.
Good operational hygiene is hard and tedious. That asymmetry works in favour of defenders, which is why we publish this.
Start here
Three goals, three different toolsets
Tor, Mullvad VPN and VeraCrypt solve different problems. Pick the goal first, then the tool.
Identity separation
- Protects
- The link between your profiles
- Against
- Correlation, doxxing, retaliation
- Tools
- Tor Browser, Tails, Whonix, Qubes, aliases, work profiles
Seizure resistance
- Protects
- Data on your devices
- Against
- Theft, loss, being forced to unlock
- Tools
- Full-disk encryption, encrypted vaults, hidden volumes
A VPN is privacy, not anonymity.
It swaps one observer for another: your ISP stops seeing your traffic and the VPN operator starts. Useful, but you have not disappeared.
The trust model
Four tiers: who do you have to trust?
License tags say who may read the code. Tiers say what happens if the company behind a tool turns hostile, gets hacked or receives a court order.
You trust math
The keys are yours, the client is open, and the operator is unnecessary or replaceable. A compromised server gets nothing.
VeraCryptCryptomatorageKeePassXCSyncthing
You trust code you can check
End-to-end encryption, open native clients, often reproducible builds and audits. The operator still sees some metadata.
SignalSimpleXBitwardenTuta appsProton apps
You trust the operator’s claims
Encryption exists, but the code comes from their server as JavaScript or is closed, so they could serve a targeted build.
Proton webMEGASync.comTresoritiCloud ADP
You trust policy and jurisdiction
No encryption under your control, only a promise and a legal environment.
Every VPNEvery public DNSSearch engines
A tier is not a quality score. A T4 VPN can be an excellent product. The tier only says that you cannot verify what it claims.
Routes
Four routes through the arsenal
Step-by-step setups for the most common situations. Each chip jumps to the tool card.
For everyone. One afternoon, and most account takeovers and drive-by tracking stop working on you.
- Use a password manager
Unique passwords everywhere; let the manager fill them so it refuses look-alike domains.
- Passkeys or a security key on email and money
They cannot be phished. Use TOTP where passkeys are not offered, never SMS if you can avoid it.
- Harden the browser
Firefox or Brave with uBlock Origin covers most tracking and malvertising.
- Filtering DNS
Blocks known malware and phishing domains for every app on the device.
- Signal for anything sensitive
Default end-to-end encryption with minimal metadata.
- Check what already leaked
Then change those passwords first.
- Encrypt your disks
Phones are encrypted by default; on laptops turn it on.
Scam operators retaliate: doxxing, DDoS, swatting, threats. Keep your research identity and infrastructure from ever touching your personal life.
- A separate research identity
Its own email aliases and its own password vault. Never reuse personal accounts.
- A separate browser for scam infrastructure
Never open phishing kits in your daily browser. Tor Browser for high-risk lookups, Mullvad Browser with a VPN for routine work.
- Isolate the environment
Disposable VMs for live kits and attachments; Tails for one-off sessions.
- Never from your home IP
A commercial VPN for routine research, Tor for anything that could trace back.
- Split the phone
A work profile for research apps, or a separate hardened device.
- Clean evidence before you publish
Strip metadata from screenshots and PDFs; crop out anything showing your own accounts.
- Shrink your public footprint
Remove old accounts and data-broker entries; pay for research tools without your name where it matters.
Order matters. Rotating passwords on an infected machine just hands the new ones to the attacker.
- Find out what leaked
Breach lists and infostealer logs.
- Clean the device first
If an infostealer is possible, reinstall before you change anything, or use a different clean device.
- Rotate passwords and sessions
Email first, then money, then everything else. Sign out all sessions.
- Lock the doors behind you
Passkeys or hardware keys; check email forwarding rules and connected apps.
- Crypto was involved?
Follow the emergency guide and revoke token approvals.
- Report it
Police and national CERT reports help banks and exchanges act.
Own your filtering, sync and remote access. Remember the trade-off: control over the data, but no crowd to hide in.
- Filter DNS at home
AdGuard Home or Pi-hole, with Unbound as a recursive resolver behind it.
- Reach home securely
A WireGuard tunnel or a self-hosted mesh. No port forwarding of admin panels.
- Run your own vault
Vaultwarden with off-site backups.
- Files without a vendor
Sync between your own devices, or encrypt before any cloud.
- Search without a profile
A SearXNG instance for yourself or your team.
- Know the limit
Your VPS is your identity on the internet. Use a commercial VPN or Tor when you need a crowd.
The arsenal
108 tools with their trust tier
Each card lists what the operator can see, where they are based, who audited the code, whether builds are reproducible and whether you can pay without a card. Missing rows mean we could not verify it.
108 tools
TierGoal
Browsers and search
Pick the browser by goal. Tor Browser and Mullvad Browser make you look like every other user of them; a hardened Firefox makes you hard to track but still unique.
Routes traffic through three Tor relays and makes every user look the same. The default for touching scam infrastructure without exposing your IP.
- Audit
- Radically Open Security, 2023 · Cure53, 2023
- Reproducible build
- Yes
Tor Browser’s anti-fingerprinting without the Tor network. Pair it with a VPN so you blend in with other users of the same browser.
- Reproducible build
- Yes
Open-source browser with total cookie protection and full extension support. Good daily driver once hardened.
- Operator sees
- Technical/interaction telemetry and a daily usage ping unless switched off in settings
- Jurisdiction
- United States
Arkenfox user.js
github/arkenfox/user.jsMaintained Firefox hardening config: telemetry off, fingerprinting resistance on, with every setting documented.
Firefox fork with hardening and uBlock Origin out of the box, no telemetry.
Chromium with built-in tracker blocking and fingerprint randomisation. Turn off the crypto and AI extras you don’t need.
- Operator sees
- No browsing history; some features process your IP; anonymous product analytics on unless disabled
- Jurisdiction
- United States
Ungoogled Chromium
github/ungoogled-software/ungoogled-chromiumChromium with Google services and background requests removed. You handle updates yourself.
- Reproducible build
- No
Search without a profile tied to you. Results mostly come from Bing.
- Operator sees
- IP and browser info, used only transiently to serve results and stop bots; no search history stored
- Jurisdiction
- United States
FreeOpen
Search on its own independent index, no profiling.
- Operator sees
- Your query (stored de-identified); IP deleted within seconds
- Jurisdiction
- United States
FreeOpen
Google results fetched on your behalf, so Google never sees your IP. Owned by an ad-tech group; weigh that.
- Operator sees
- Your query, stripped of IP before being forwarded; IPs recorded only for detected bots
- Jurisdiction
- Netherlands
FreeOpen
Small UK engine with its own crawler and no tracking.
- Operator sees
- Access logs (time, requested page) with the IP replaced by a two-letter country code
- Jurisdiction
- United Kingdom
FreeOpen
SearXNG
docs.searxng.orgSelf-hosted metasearch that queries many engines for you. Alone on your own server it is a crowd of one; public instances spread you out.
- Operator sees
- The instance admin can see and log your IP and queries; upstream engines see the instance
Browser extensions
Fewer is better. Every extra extension changes your fingerprint, and inside Tor Browser or Mullvad Browser it makes you stand out.
uBlock Origin
ublockorigin.comWide-spectrum blocker for ads, trackers and malicious domains. Full version on Firefox; since August 2026 Chrome users only get uBO Lite.
EFF extension that learns to block trackers as it sees them and sends Global Privacy Control.
Serves common libraries locally instead of from CDNs that log every page you visit. A fork of Decentraleyes covering more libraries.
Blocks JavaScript per site. Strong against drive-by attacks, at the cost of breaking many pages.
Privacy route only. Do not add it to Tor Browser or Mullvad Browser: they already ship and tune it, and any change to extensions makes your fingerprint unique.
Fakes canvas, audio and WebGL readouts in Firefox so fingerprinting scripts get noise.
Never in Tor Browser or Mullvad Browser. Randomised readouts make you different from every other user there, which is the opposite of what those browsers do.
Messengers
All of these encrypt content. What separates them is the metadata: which identifier you must hand over and what the servers can see.
The reference for end-to-end encryption, with sealed sender and minimal server data. Registration still needs a phone number; a username lets you chat without sharing it.
- Operator sees
- Phone number, account creation date and last connection date; sealed sender hides the sender of most messages
- Jurisdiction
- United States
- Reproducible build
- Partial
Hardened Signal fork for Android: encrypted local database with a passphrase, and a FOSS build without Google services.
- Operator sees
- Same as Signal (Molly uses Signal's servers): phone number, account creation date, last connection date
- Jurisdiction
- United States
- Reproducible build
- Yes
SimpleX Chat
simplex.chatNo user IDs at all, not even random ones. Each contact gets separate one-way queues, so servers can’t build your contact graph.
- Operator sees
- No user IDs: relays see only anonymous per-connection queue keys; by default private routing hides your IP from your contacts' servers
- Jurisdiction
- United Kingdom
- Audit
- Trail of Bits, 2024 · Trail of Bits, 2022
- Reproducible build
- Partial
Peer-to-peer over Tor, or over Bluetooth and Wi-Fi when the internet is down. No servers to subpoena. In maintenance mode (security fixes only) since July 2026.
- Audit
- Cure53, 2017
- Reproducible build
- Yes
No phone number; messages travel over an onion-routed node network. No forward secrecy yet: a stolen key exposes past messages until protocol v2 ships.
- Operator sees
- No phone/email; onion requests mean no single node knows both sender and recipient; nodes hold encrypted messages for up to 14 days
- Jurisdiction
- Switzerland
- Audit
- Quarkslab, 2021
- Pay without card
- No: card only
Matrix client with E2EE rooms and federation. Your homeserver sees who talks to whom and when; self-host it to own that data.
- Operator sees
- Your homeserver: Matrix ID, devices, IPs and room activity; usernames, display names and (encrypted) messages are copied to every server in the room
- Jurisdiction
- United Kingdom
- Audit
- Least Authority, 2022
- Reproducible build
- Partial
What each messenger still reveals
Content encryption is table stakes. The difference is the identifier you hand over and what the servers can log about who talks to whom.
| Messenger | You must provide | What the servers can see | Good for |
|---|---|---|---|
| Signal | A phone number. A username lets you chat without sharing it; number-free sign-up is only in Android beta | That an account exists, when it registered and last connected. Sealed sender hides who sent a message. | Daily private messaging |
| Molly | Same as Signal (it uses Signal’s servers) | Same as Signal; adds a passphrase-encrypted local database | Signal on a device that might be seized |
| SimpleX | Nothing: no number, username or random ID | Relays see anonymous message queues, not a contact graph. Use Tor to hide your IP from them. | Contacts you must not be linked to |
| Briar | Nothing; contacts are added in person or by link | No central server. Peers connect over Tor, Bluetooth or Wi-Fi. Maintenance mode since July 2026. | High-risk contacts, network shutdowns |
| Session | Nothing; a public-key Session ID | Messages are onion-routed through community-run nodes. No forward secrecy in the current protocol | Messaging without a phone number |
| Element | An account on a Matrix homeserver | The homeserver sees rooms, members and timestamps; federation copies that to other servers | Teams and communities; self-host for control |
Email and aliases
Email was never built to be private. Encrypted providers protect stored mail; aliases stop one leaked address from linking all your accounts.
Encrypts the subject line as well as the body, plus calendar and contacts. Locked to its own apps.
- Operator sees
- Sender/recipient email addresses and dates; subject, body, attachments and names are encrypted; IP addresses not logged by default
- Jurisdiction
- Germany
- Audit
- SySS GmbH, 2014
- Pay without card
- Bitcoin (gift card), Monero (gift card), Cash (gift card)
End-to-end encrypted between Proton users, with open-source native apps and a Bridge for IMAP clients. Subject lines are not end-to-end encrypted.
- Operator sees
- Sender/recipient addresses, subject lines, attachment names, send/receive times and the IP an incoming message came from
- Jurisdiction
- Switzerland
- Audit
- Securitum, 2021
- Pay without card
- Cash, Bitcoin
German provider with standard IMAP/SMTP and a built-in PGP option. Server-side by default: the provider can read unencrypted mail.
- Operator sees
- A standard IMAP provider: metadata, plus content of mail that is not PGP-encrypted
- Jurisdiction
- Germany
- Pay without card
- Cash
PaidOpen
Small German provider with anonymous sign-up and optional encryption of stored mail with your password.
- Operator sees
- Mail content unless crypto mail storage or PGP/S-MIME is enabled; no IP addresses linked to accounts; signup needs no personal data
- Jurisdiction
- Germany
- Audit
- Cure53, 2017 · Cure53, 2015
- Pay without card
- Cash
PaidOpen
Open-source desktop client with built-in OpenPGP. Lets you encrypt with your own keys on any provider that offers IMAP.
A different forwarding address for every account; reply through the alias without revealing your inbox. Owned by Proton.
- Operator sees
- Sender/recipient addresses, subject, the IP an incoming message came from, and send/receive times
- Jurisdiction
- Switzerland
- Audit
- Securitum, 2022 · Securitum, 2022
- Pay without card
- Bitcoin, Monero
Alias forwarding (formerly AnonAddy) that can encrypt forwarded mail with your own PGP key.
- Operator sees
- Your real address and alias list; forwarded mail passes through (optionally encrypted with your own GPG key)
- Jurisdiction
- United Kingdom
- Audit
- Securitum, 2023
- Pay without card
- Crypto
Free alias forwarding on 50+ domains with no account: you confirm the alias by email. Run by Haltman.io, independent hackers from Brazil, and listed by The Hacker’s Choice. Stores no messages, but adds no encryption either: the forwarder sees your mail in transit.
- Operator sees
- Your real address, the alias and every forwarded message in full; mail is relayed, not stored
Tuta or Proton?
Both encrypt stored mail so the provider cannot read it, and both are good choices. They differ in what they encrypt and how open they are to other software.
Tuta
- End-to-end encrypts the subject line too. Proton stores subjects encrypted but not end-to-end: the key difference between them.
- TutaCrypt: hybrid post-quantum encryption (X25519 plus ML-KEM/Kyber-1024), the default for new accounts since March 2024.
- Encrypted calendar and contacts; open-source apps, also on F-Droid.
- Minus: no IMAP/SMTP and no OpenPGP. No Thunderbird, no PGP correspondents, harder migration.
- Jurisdiction: in 2020 a German court ordered Tuta to hand over future unencrypted mail of one mailbox in a blackmail case; end-to-end encrypted mail stayed out of reach.
Proton Mail
- Native apps are open source: T2. The web app is open source too, but it is JavaScript served by Proton on each visit and you can’t easily check which build you got: T3.
- Subject lines are not end-to-end encrypted. Opt-in post-quantum encryption arrived in May 2026.
- Speaks OpenPGP and works with Thunderbird through Proton Bridge.
- Swiss jurisdiction; Proton has handed over account metadata such as recovery emails and IP logs under Swiss court orders.
- For anything sensitive, encrypt the file yourself with age or GnuPG before sending.
Passwords, 2FA and passkeys
Passkeys and hardware keys stop phishing at the root: they will not sign in on a fake domain. TOTP codes can still be typed into a phishing page.
Offline password database. You hold the file and the key; sync it any way you like.
- Operator sees
- Nobody: runs locally, keys stay with you
- Audit
- ANSSI (CSPN security visa; evaluation lab Synacktiv), 2025 · Zaur Molotnikov (independent consultant), 2023
KeePassDX
keepassdx.comOpen-source Android app for the same KeePass files.
- Operator sees
- Nobody: runs locally, keys stay with you
- Reproducible build
- Partial
End-to-end encrypted vault that syncs everywhere. Bitwarden stores ciphertext and knows which account owns it.
- Operator sees
- Account email, name if given, device IDs, billing data; vault contents end-to-end encrypted (org event logs include IPs)
- Jurisdiction
- United States
- Audit
- Cure53, 2025 · Applied Cryptography Group, ETH Zurich, 2025
- Pay without card
- Bitcoin
Vaultwarden
github/dani-garcia/vaultwardenSelf-hosted server for Bitwarden apps. Same clients, but the metadata stays on your server. Back it up.
- Operator sees
- You are the operator
- Audit
- BSI (German Federal Office for Information Security) with mgm security partners, CAOS 3.0 project, 2024 · ERNW Enno Rey Netzwerke, 2024
Passkeys
passkeys.devPhishing-resistant logins bound to the real domain. Store them in your password manager or on a hardware key and turn them on wherever offered.
FreeOpen
Android TOTP app with an encrypted vault and plain encrypted backups you control.
- Operator sees
- Nobody: runs locally, keys stay with you
- Reproducible build
- Partial
TOTP app for every platform with end-to-end encrypted sync between devices.
- Operator sees
- Account email, IP address, device and user-agent info, server logs; 2FA secrets end-to-end encrypted
- Jurisdiction
- United States
- Audit
- Cure53 (with Dr. Nadim Kobeissi), 2025 · Cure53 with Symbolic Software, 2023
- Reproducible build
- No
Free TOTP app for iOS and Android with a browser extension for one-tap codes.
- Operator sees
- No accounts; secrets stay on the device; optional crash reports and push messages go through Firebase
- Jurisdiction
- United States
Android authenticator formerly called Authenticator Pro, with encrypted backups.
- Operator sees
- Nobody: runs locally, keys stay with you
Hardware key for FIDO2 passkeys, U2F and OpenPGP. The private key never leaves the device.
- Jurisdiction
- Sweden
- Reproducible build
- No
- Pay without card
- No: card, PayPal or bank only
PaidOpen
Hardware security keys with open-source firmware, made in Germany.
- Jurisdiction
- Germany
- Audit
- Cure53 (sponsored by Open Technology Fund), 2015
- Pay without card
- Bitcoin, Cash
Affordable FIDO2 keys and programmable TOTP tokens from Switzerland.
- Jurisdiction
- Switzerland
- Audit
- Compass Security Schweiz AG, 2024
Bitwarden, Vaultwarden or KeePassXC?
They look interchangeable but sit in different places on the trust map.
| Option | Tier | Who holds the vault | What leaks if the server is breached |
|---|---|---|---|
| KeePassXC / KeePassDX | T1 | You: a local file you sync yourself | Nothing; there is no server |
| Vaultwarden + Bitwarden apps | T2 | Your own server | Encrypted vault and account metadata, on a box you control |
| Bitwarden cloud | T2 | Bitwarden | Encrypted vault plus account email, devices and IPs |
Rule of thumb: passkeys or a hardware key on email, banking and crypto accounts first. They will not authenticate on a look-alike domain, which TOTP codes cannot promise.
Encryption and cloud storage
Cheap, dumb storage plus your own encrypted container beats any “private cloud”, because the vendor never holds a key.
Client-side encrypted vaults on top of Google Drive, Dropbox, OneDrive or WebDAV. Encrypts file names too.
- Operator sees
- Nobody: runs locally, keys stay with you
- Jurisdiction
- Germany
- Audit
- Cure53, 2017 · Tim McLean (engaged by Connect2id), 2016
Encrypted volumes and full-disk encryption. Hidden volumes protect data if a device is stolen or you are forced to unlock it.
- Operator sees
- Nobody: runs locally, keys stay with you
- Audit
- Fraunhofer SIT (for German BSI), 2020 · Quarkslab (funded by OSTIF), 2016
gocryptfs
nuetzlich.netPer-file encrypted filesystem for Linux and macOS, made for syncing through any cloud.
- Operator sees
- Nobody: runs locally, keys stay with you
- Audit
- Taylor Hornby (Defuse Security), funded by 23andMe, 2017
Encrypts files before rclone uploads them to any of 70+ storage backends. File-name encryption is a setting.
- Operator sees
- Nobody: runs locally, keys stay with you
age
age-encryption.orgSmall, modern file encryption with short keys. Encrypt a file before it leaves your machine.
- Operator sees
- Nobody: runs locally, keys stay with you
OpenPGP for encrypting and signing files and mail. Still the lingua franca with PGP-using correspondents.
- Operator sees
- Nobody: runs locally, keys stay with you
Picocrypt
github/Picocrypt/PicocryptTiny portable file encryption (XChaCha20, Argon2id), audited in 2024. Archived by its author in September 2025: the last release still works but gets no fixes.
- Operator sees
- Nobody: runs locally, keys stay with you
- Audit
- Radically Open Security, 2024
Simple command-line file encryption and signing on libsodium; can encrypt file names. Not audited, and quiet since early 2025.
- Operator sees
- Nobody: runs locally, keys stay with you
Standard Linux full-disk encryption (cryptsetup). Turn it on at install.
- Operator sees
- Nobody: runs locally, keys stay with you
Windows full-disk encryption. Closed source, and the recovery key often ends up in your Microsoft account; check where it is stored.
- Reproducible build
- No
FreeOpen
Peer-to-peer sync between your own devices with no cloud in the middle.
- Operator sees
- Discovery server: device ID to IP mapping; relays: device IDs. Neither sees file contents
Self-hosted files, calendar and contacts. You are the operator, so your server security is the privacy.
- Operator sees
- Whoever runs the server sees all files and metadata unless the E2EE app is used (Nextcloud treats admins as 'ultimately trusted')
- Audit
- Triop (commissioned by Sunet for Sunet Drive), 2024
End-to-end encrypted storage. Proton can’t read files but sees structure and metadata, and the web app is served by Proton.
- Operator sees
- Account details and encrypted file sizes; not file contents, file/folder names or thumbnails
- Jurisdiction
- Switzerland
- Audit
- Securitum, 2022 · Securitum, 2021
- Pay without card
- Cash, Bitcoin
Business-focused E2EE storage from Switzerland, majority-owned by Swiss Post. ETH Zurich (2024) rated it the most robust of five E2EE clouds, but a compromised server could still serve fake sharing keys.
- Operator sees
- File sizes, types, timestamps and who created/shared what (unencrypted metadata); not file contents
- Jurisdiction
- Switzerland
- Audit
- Unnamed 'internationally renowned' third-party firm, 2025 · CCLab, 2023
- Pay without card
- No: card, PayPal or bank only
PaidOpen
Zero-knowledge storage from Canada with closed clients. In 2024 ETH Zurich showed a malicious server could swap in its own keys and read later uploads; Sync said fixes were under way.
- Operator sees
- File sizes, types, timestamps and share-creator metadata (unencrypted); not file contents
- Jurisdiction
- Canada
- Pay without card
- No: card, PayPal or bank only
Free tierOpen
Client-side encrypted storage with a generous free tier.
In 2022 ETH Zurich researchers showed that a malicious or compromised MEGA server could recover keys, decrypt and plant files. MEGA patched the key-recovery chain, not every attack. Add Cryptomator on top.
- Operator sees
- Email, IP/device logs, file sizes and folder tree, contacts and chat metadata; not file contents
- Jurisdiction
- Hungary
- Pay without card
- Bitcoin, Cash
Dumb storage plus your own container beats a “private cloud”
If you encrypt before upload, it no longer matters whose cloud it is. That removes the vendor from the trust question entirely.
| Setup | Tier | What the operator sees |
|---|---|---|
| Google Drive, as is | T4 | Everything |
| MEGA | T3 | Claims nothing; ETH Zurich showed server-side attacks in 2022 |
| Proton Drive | T3 | Not the content; folder structure and metadata, yes |
| iCloud with Advanced Data Protection | T3 | Not the content, but the protection itself can be withdrawn by law: Apple pulled ADP for UK users in 2025 after a government order |
| Any storage + Cryptomator | T1 | Ciphertext, file sizes, access times |
What still leaks
- File names: Cryptomator encrypts them; rclone crypt only if you choose that mode.
- File sizes and how often you open things.
- Zero leakage does not exist. The aim is that the operator learns nothing useful.
Simple setup
- Laptop: Cryptomator vault inside any cloud folder.
- Servers and scripts: rclone crypt or gocryptfs.
- One-off files: age or Picocrypt.
Metadata and file transfer
Screenshots and documents carry GPS, device and author data. Strip it before you publish evidence or a report.
Reads and removes metadata from nearly any file format. Run it on screenshots and PDFs before publishing.
- Operator sees
- Nobody: runs locally, keys stay with you
MAT2
github/jvoisin/mat2Metadata Anonymisation Toolkit: one command cleans images, PDFs and office documents. Ships with Tails.
- Operator sees
- Nobody: runs locally, keys stay with you
Share files, host a drop box or chat through a temporary Tor onion service. Nothing sits on a third-party server.
- Operator sees
- Nobody: runs locally, keys stay with you
- Audit
- Cure53, 2024 · Radically Open Security, 2021
croc
github/schollz/crocSend a file between two computers with a short code phrase. End-to-end encrypted with PAKE; the relay only sees ciphertext.
- Operator sees
- Nobody: runs locally, keys stay with you
Magic Wormhole
github/magic-wormhole/magic-wormholeThe original code-phrase transfer tool. Short human-readable codes, strong PAKE encryption.
- Operator sees
- Nobody: runs locally, keys stay with you
VPN services
Every VPN is T4: you move trust from your ISP to the operator and cannot verify their claims. What you can check is the evidence behind them.
Account is a random number, no email. WireGuard with DAITA against traffic analysis. Flat price.
- Operator sees
- Your real IP and traffic in transit while connected; stores only account number, WireGuard public key + tunnel IP, payment records
- Jurisdiction
- Sweden
- Audit
- X41 D-Sec, 2025 · Cure53, 2024
- Reproducible build
- Partial
- Pay without card
- Cash, Monero, Bitcoin
Account ID without email, open-source apps and regular audits.
- Operator sees
- Your real IP and traffic in transit while connected; stores account ID, payment record, live simultaneous-connection count
- Jurisdiction
- Gibraltar
- Audit
- Cure53, 2024 · Cure53, 2023
- Pay without card
- Cash, Monero, Bitcoin
Swiss VPN with open-source apps, a no-logs audit history and a usable free tier.
- Operator sees
- Your real IP and traffic in transit while connected; stores Proton account (username/email) and payment data
- Jurisdiction
- Switzerland
- Audit
- Securitum, 2026 · Securitum, 2025
- Pay without card
- Cash, Bitcoin
Riseup VPN
riseup.netFree, donation-funded VPN from a Seattle activist collective. No account; OpenVPN with obfs4 for filtered networks.
- Operator sees
- Your real IP and traffic in transit while connected; says it does not log IP addresses
- Jurisdiction
- United States
Feature-rich VPN with a free tier and no-email sign-up.
- Operator sees
- Your real IP and traffic in transit while connected; stores username, 30-day bandwidth total, last-activity time
- Jurisdiction
- Canada
- Audit
- Packetlabs, 2024 · Leviathan Security Group, 2022
- Pay without card
- Cash, Monero, Bitcoin
What backs up each VPN’s promise
You can’t verify a VPN’s no-logs claim. You can check how much it knows about you in the first place, who has audited it, and what happened when someone came for its servers.
| VPN | Account | Public audits | Servers | Tested in practice | Cash / Monero |
|---|---|---|---|---|---|
| Mullvad | Random number, no email | X41 D-Sec 2025 (backend), Cure53 2024 (servers) | RAM-only since 2023 | 2023: Swedish police arrived with a warrant for customer data and left with nothing | Cash, Monero |
| IVPN | Account ID, no email | Cure53 2024 and 2023 (security); last no-logs audit 2019 | Not stated | No public case | Cash (1–3-yr plans), Monero |
| Proton VPN | Email; may ask for email or SMS verification | Securitum no-logs audits every year, 2022–2026 | Encrypted disks, not RAM-only | No public VPN case | Cash with username; no Monero |
| Windscribe | Username, email optional | Packetlabs 2024 (servers), Leviathan 2022 (apps) | RAM-only (company claim) | 2021: two Ukrainian servers seized unencrypted with a server key; 2026: one Dutch server seized | Cash (1-yr Pro, with username), Monero |
| Riseup VPN | None | None found | Not stated | No public case | Free; donations by mail or crypto |
Reading the table: Mullvad and IVPN let you pay cash or Monero with no email at all, and Mullvad’s “no data” claim survived a police search. That is the strongest evidence a T4 service can offer. It is still evidence, not proof.
Public DNS resolvers, ready to copy
Copy the address from here, not from a search result: fake “DNS setup” guides are a real attack. Every address below was checked against the operator’s own documentation on 18 Oct 2026. dns0.eu closed in October 2025; Mullvad DNS shuts down on 2 November 2026.
Swiss non-profit resolver that blocks known malicious domains and says it does not record user IPs. No account. Mullvad now sponsors it and sends its DNS users here.
- Operator sees
- Every queried domain; your IP is held only in memory while answering, not recorded (per policy)
- Jurisdiction
- Switzerland
Malware blocking + DNSSECRecommended
- IPv4
9.9.9.9149.112.112.112- IPv6
2620:fe::fe2620:fe::9- DoH
https://dns.quad9.net/dns-query - DoT
dns.quad9.net
Malware blocking + ECSSends part of your subnet to sites for better CDN routing
- IPv4
9.9.9.11149.112.112.11- IPv6
2620:fe::112620:fe::fe:11- DoH
https://dns11.quad9.net/dns-query - DoT
dns11.quad9.net
No blocking, no DNSSECQuad9 marks it for experts only
- IPv4
9.9.9.10149.112.112.10- IPv6
2620:fe::102620:fe::fe:10- DoH
https://dns10.quad9.net/dns-query - DoT
dns10.quad9.net
Addresses from quad9.net, checked 18 Oct 2026
FreeOpen
Very fast public resolver; Cloudflare commits to purging query logs within 25 hours. The family variants add malware and adult-content blocking.
StandardNo filtering
- IPv4
1.1.1.11.0.0.1- IPv6
2606:4700:4700::11112606:4700:4700::1001- DoH
https://cloudflare-dns.com/dns-query - DoT
one.one.one.one
Blocks malware1.1.1.1 for Families
- IPv4
1.1.1.21.0.0.2- IPv6
2606:4700:4700::11122606:4700:4700::1002- DoH
https://security.cloudflare-dns.com/dns-query - DoT
security.cloudflare-dns.com
Blocks malware + adult content1.1.1.1 for Families
- IPv4
1.1.1.31.0.0.3- IPv6
2606:4700:4700::11132606:4700:4700::1003- DoH
https://family.cloudflare-dns.com/dns-query - DoT
family.cloudflare-dns.com
Addresses from developers.cloudflare.com, checked 18 Oct 2026
FreeOpen
EU-backed protective DNS, free for individuals, no account. Court-ordered blocks apply to every variant, including the unfiltered one.
- Operator sees
- Your IP and every queried domain; says queries are anonymised and not sold or profiled
- Jurisdiction
- Czech Republic
ProtectiveBlocks malware, phishing and C2. The default
- IPv4
86.54.11.186.54.11.201- IPv6
2a13:1001::86:54:11:12a13:1001::86:54:11:201- DoH
https://protective.joindns4.eu/dns-query - DoT
protective.joindns4.eu
Protective + ad blockingSome sites detect ad blocking
- IPv4
86.54.11.1386.54.11.213- IPv6
2a13:1001::86:54:11:132a13:1001::86:54:11:213- DoH
https://noads.joindns4.eu/dns-query - DoT
noads.joindns4.eu
Child protectionAdds adult, violence and drug content
- IPv4
86.54.11.1286.54.11.212- IPv6
2a13:1001::86:54:11:122a13:1001::86:54:11:212- DoH
https://child.joindns4.eu/dns-query - DoT
child.joindns4.eu
Child protection + ad blocking
- IPv4
86.54.11.1186.54.11.211- IPv6
2a13:1001::86:54:11:112a13:1001::86:54:11:211- DoH
https://child-noads.joindns4.eu/dns-query - DoT
child-noads.joindns4.eu
UnfilteredCourt-ordered blocks still apply
- IPv4
86.54.11.10086.54.11.200- IPv6
2a13:1001::86:54:11:1002a13:1001::86:54:11:200- DoH
https://unfiltered.joindns4.eu/dns-query - DoT
unfiltered.joindns4.eu
Addresses from joindns4.eu, checked 18 Oct 2026
FreeOpen
Free public resolver that blocks ads and trackers by default, with DoH, DoT and DNS-over-QUIC. Run by AdGuard (Cyprus).
- Operator sees
- Public servers: your IP and queries (keeps an anonymous 24-hour domain list); private DNS: query logs tied to your account
- Jurisdiction
- Cyprus
DefaultBlocks ads and trackers
- IPv4
94.140.14.1494.140.15.15- IPv6
2a10:50c0::ad1:ff2a10:50c0::ad2:ff- DoH
https://dns.adguard-dns.com/dns-query - DoT
dns.adguard-dns.com
Family protectionAdds adult content and Safe Search
- IPv4
94.140.14.1594.140.15.16- IPv6
2a10:50c0::bad1:ff2a10:50c0::bad2:ff- DoH
https://family.adguard-dns.com/dns-query - DoT
family.adguard-dns.com
Non-filteringNo blocking at all
- IPv4
94.140.14.14094.140.14.141- IPv6
2a10:50c0::1:ff2a10:50c0::2:ff- DoH
https://unfiltered.adguard-dns.com/dns-query - DoT
unfiltered.adguard-dns.com
Addresses from adguard-dns.io, checked 18 Oct 2026
Configurable DNS firewall with logs, profiles and threat-intel lists. Free for 300,000 queries a month, then it resolves without filtering. Your profile ID ties every query to your account.
- Operator sees
- Your IP and every query, tied to your profile ID/account; stored logs only if you enable them
- Jurisdiction
- United States
Your profileReplace <profile ID> with the ID from your dashboard. Plain IPv4 only applies your settings once your IP is linked there
- IPv4
45.90.28.045.90.30.0- IPv6
2a07:a8c0::2a07:a8c1::- DoH
https://dns.nextdns.io/<profile ID> - DoT
<profile ID>.dns.nextdns.io
Addresses from github/nextdns/nextdns, checked 18 Oct 2026
Free tierOpen
What encrypted DNS does, and what it doesn’t
DoH and DoT do
- Hide your lookups from the ISP and whoever runs the Wi-Fi.
- Stop on-path tampering with answers, such as redirects to fake sites.
They don’t
- Hide the site you visit: the domain still travels in plain text in the TLS SNI field unless Encrypted Client Hello (ECH) is used. Firefox and Chrome turn ECH on by default, but it only helps when DNS is encrypted too, and almost every site that supports it sits behind Cloudflare.
- Hide the destination IP. A site on its own IP is identified without any DNS at all.
- Encrypt anything with DNSSEC: that proves answers are authentic, it does not hide them.
- Remove trust. It moves from your ISP to the resolver, which is T4 whichever you pick.
| Setup | Who sees your queries | When it fits |
|---|---|---|
| AdGuard Home + Unbound (recursive) | Nobody sees all of them; each authoritative server sees its own piece, plus your IP | You want control of logs and filtering |
| AdGuard Home → DoT upstream | The upstream you choose | Simpler, and authoritative servers don’t see your IP |
| Quad9 or DNS4EU | The operator, without an account | No sign-up, shared crowd, malware filtering. The sensible default for a phone |
| NextDNS | NextDNS, linked to your profile ID | You need fine-grained filters, logs and per-device profiles |
| Mullvad DNS | Mullvad | Was the classic no-account pick; Mullvad shuts it down on 2 November 2026 and points users to Quad9 |
No-account resolver or NextDNS? Both are fine. A no-account resolver such as Quad9 keeps you in a shared crowd. NextDNS does more, but the profile ID ties every query to you. A sensible split for a researcher: NextDNS on the work machine for logs and filtering, Quad9 on the phone.
Gotchas
- Self-hosting alone is a crowd of one. Great for filtering, counter-productive if you want to be indistinguishable.
- On a VPN, use the VPN’s resolver. A third-party DoH server inside the tunnel is a second observer and a correlation point.
- On Tor, leave DNS alone. Lookups go through the Tor SOCKS proxy; Tails and Whonix handle it for you.
- Leaks: Windows “smart multi-homed name resolution”, IPv6 bypassing the tunnel, the browser’s Secure DNS overriding the system resolver, and Android or smart-TV apps with a hard-coded 8.8.8.8. Block port 53 and known DoH endpoints on the router.
- Remote access to AdGuard Home only through WireGuard or Tailscale, never a forwarded port.
Self-hosted DNS and filters
Encrypted DNS hides lookups from your ISP and stops tampering. It does not hide which sites you visit, and whoever resolves for you becomes the new observer.
Self-hosted DNS filter with DoH/DoT/DoQ, per-client rules and query logs you control.
Network-wide DNS blocking on a small home server. Add Destroylist as a blocklist.
Recursive resolver: asks the authoritative servers directly so no single upstream sees all your lookups.
- Audit
- X41 D-Sec, 2019
Android app combining an encrypted-DNS client and a per-app firewall. Stops apps with hard-coded resolvers from bypassing you.
- Operator sees
- Resolver: your queries and IP pass through Rethink's servers on Cloudflare (sky) / Fly.io (max); policy says no request logs
- Jurisdiction
- India
__DNS__
Self-hosted networking
Your own VPN server protects you on public Wi-Fi and from your ISP. It does not make you anonymous: you are its only user.
Modern VPN protocol in a few thousand lines of code, built into Linux.
wg-easy
github/wg-easy/wg-easyWireGuard server with a web UI in one Docker container.
Algo VPN
github/trailofbits/algoTrail of Bits scripts that deploy a hardened WireGuard/IPsec server to a cloud VPS.
Easy self-hosted VPN based on Shadowsocks, built to work on filtered networks. Started at Jigsaw, now run by the non-profit Outline Foundation.
WireGuard mesh with zero config. Traffic is end-to-end encrypted, but Tailscale runs the coordination server that admits devices.
- Operator sees
- Device names, OS, hostnames, IPs, public keys, user identity and connection logs/stats; not traffic content
- Jurisdiction
- USA
Headscale
github/juanfont/headscaleOpen-source replacement for Tailscale’s coordination server, so the control plane is yours too.
Open-source WireGuard mesh with its own management server you can self-host.
- Operator sees
- Cloud management service holds user identity, peer list, WireGuard public keys and network config; signal/relay cannot read traffic
- Jurisdiction
- Germany
WireGuard fork that disguises the handshake so DPI on filtered networks cannot fingerprint and drop it.
Your own server is not anonymity
On a VPS you rent, you are the only user, so its IP points straight at you. That is great against a hostile local network, public Wi-Fi or your ISP, and useless against correlation. A commercial VPN gives the opposite: you dissolve in a crowd, at the price of trusting the operator. These are different jobs.
Why people pay for VPNs on top of a free protocol
- WireGuard has no built-in rotation: the server keeps each client’s latest IP in memory until the peer is removed or the interface restarts, and keys never change on their own.
- Providers add layers on top. Mullvad drops idle peers after 10 minutes and rotates keys every other week; IVPN drops them after 3 minutes and rotates keys daily. Mullvad’s DAITA pads every packet to one size and adds cover traffic against timing and size analysis.
Filtered networks
- A WireGuard handshake has a fixed, easy-to-spot signature, so DPI systems can identify and drop it.
- AmneziaWG randomises those fields so the tunnel keeps working. Outline solves the same problem with Shadowsocks.
- Reach home services through WireGuard, Headscale or NetBird. Never forward an admin panel’s port to the internet.
Domains and hosting for researchers
For legal work: publishing research, hosting evidence, running a project. Registrar privacy and domain resilience are different things, and often opposite.
Domains at registry cost with no markup. It requires Cloudflare’s own nameservers, so you cannot use another DNS provider and registrar and DNS fail together.
- Jurisdiction
- United States
PaidOpen
Icelandic hosting, VPS, free DNS and domain registration, running since 2006. In our abuse work it answers on substance.
- Jurisdiction
- Iceland
PaidOpen
Web hosting, VPS, dedicated servers and DDoS protection. In our abuse work it answers on substance.
- Jurisdiction
- Servers in Iceland, Finland, the Netherlands and Romania
PaidOpen
Registers the domain in its own name, so your details never reach the registry. That also makes Njalla the legal holder of your domain: you are a tenant, not the registrant.
We do not recommend it for research projects. A proxy registrant cuts the chain of responsibility both ways: abuse reports reach nobody accountable, and if the proxy ever drops your domain, you are not a party to anything.
- Operator sees
- Your email or XMPP address and payments; it is the registrant of record
- Jurisdiction
- Costa Rica
- Pay without card
- Bitcoin, Monero
PaidOpen
Registrar privacy is not domain resilience
A registrar does not protect you from legal process. Major registrars follow court orders, including ones issued without your participation, disclose data and transfer domains. Your choice decides how carefully that happens and whether you get time to react, not whether it happens.
UDRP: losing a domain you never got to defend
- If your domain contains someone else’s brand, the owner can file a UDRP complaint with an arbitration provider such as WIPO. If you miss the notice, which is easy behind a proxy, the panel decides without you.
- The registrar implements a transfer ten business days after the decision unless you file a lawsuit. Your email, logins and links on that domain go with it.
- A research or criticism purpose rarely saves a domain that is just the brand name: WIPO panels treat
<brand>.tldas impersonation even for genuine non-commercial speech. - Publish on your own domain, not on someone else’s name.
IP reputation: the address had a life before you
- Fresh IPv4 addresses ran out years ago, so the one you are given was used before. If it hosted phishing or a botnet, you inherit the blocklists: mail does not arrive, some networks refuse you, and scans and DDoS aimed at the previous tenant keep coming.
- Before renting, check the IP and its subnet in Spamhaus and AbuseIPDB and look at its passive-DNS history. Our infrastructure tools cover all of this.
| Goal | What to use | Why |
|---|---|---|
| Ordinary project, blog, service | Cloudflare Registrar | At-cost pricing and sound basic security. Registrar and DNS are one provider, which is fine for most projects. |
| OSINT, security research, journalism | An independent registrar in a stable European jurisdiction (Germany, Iceland, Austria, Switzerland), with Cloudflare only as DNS and shield | Separate points of failure, and room for a legal defence where the registrar sits. |
| Keeping your name out of WHOIS | The privacy option of a normal registrar: redaction or a privacy service where you stay the registered holder | You remain the registrant and a party to any dispute. That is stronger than a proxy that registers the domain in its own name. |
About “bulletproof” jurisdictions: they are a bet that a seizure needs a local court. In practice the outcome depends on who shows up and with what. If you are doing something genuinely bad, no option survives; only the effort differs. A provider like that can, however, easily disappear along with your domain.
The abuse dead end
- When a domain sits behind a proxy registrant, the registrar can truthfully say the registrant is someone else, and the proxy can stay silent. Every party follows procedure; nobody is accountable.
- xmrwallet.com, a Monero wallet that took users’ keys for ten years, lived in that gap: the public record named only a registrar-run privacy service, and the registrar contacted the operator and published his story instead of acting. The investigation.
- For a researcher this cuts both ways. Domains behind such intermediaries live longer and come down slower, so plan your timelines. And an intermediary that does not answer people who complain may not answer you either. It is the registrant, not you.
- More on how registrars handle abuse: registrar accountability.
Where we stand: PhishDestroy files abuse reports with registrars and hosts every day. Some answer on substance, some with form letters, some appear in the logs of attacks against us. These assessments come from that experience, which is one-sided by definition: we see providers from the abuse side. We are not paid by anyone listed here.
Operating systems and mobile
Isolation beats tweaks. Separate environments keep a research session from ever touching your personal accounts.
Live system that boots from USB, sends everything through Tor and forgets the session at shutdown.
- Audit
- Radically Open Security, 2024 · Radically Open Security, 2023
- Reproducible build
- Yes
Two virtual machines: the workstation can only reach the internet through a Tor gateway, so malware can’t leak your real IP.
- Reproducible build
- No
Desktop OS built on compartments: work, personal and disposable VMs for opening phishing kits and attachments.
- Reproducible build
- Partial
Hardened Android for Pixel phones: sandboxed Google Play, per-app network and sensor permissions, separate user profiles.
- Jurisdiction
- Canada
- Reproducible build
- Yes
CalyxOS
calyxos.orgPrivacy-focused Android with microG instead of Google services. Back from a 2025 hiatus; version 8 rolling out since October 2026.
- Jurisdiction
- United States
Store for free and open-source Android apps, built from source by F-Droid.
- Jurisdiction
- Netherlands
- Audit
- Radically Open Security (funded by Open Technology Fund), 2018
- Reproducible build
- Partial
Obtainium
github/ImranR98/ObtainiumInstalls and updates Android apps straight from their GitHub, GitLab or F-Droid releases.
Shelter
github/PeterCxy/ShelterPuts apps into Android’s isolated work profile: separate storage, contacts and accounts, freezable in one tap.
Island
github/oasisfeng/islandAnother work-profile manager for isolating and freezing apps on Android.
Shows the trackers and permissions inside an Android app before you install it.
- Jurisdiction
- France
Check and shrink your exposure
Find out what already leaked, then cut the public trail that makes doxxing easy after you publish a report.
Have I Been Pwned
haveibeenpwned.comWhich breaches include your email. Password checks use k-anonymity, so the password never leaves your device.
- Operator sees
- The email address or phone number you search (search results not explicitly stored, per privacy policy)
- Jurisdiction
- Australia
FreeOpen
Hudson Rock free tools
hudsonrock.comChecks whether an email or domain appears in infostealer logs. If it does, clean the device before rotating passwords.
- Operator sees
- The email, username, domain or app name you search
- Jurisdiction
- Israel
FreeOpen
JustDeleteMe
justdeleteme.xyzDirect links to delete accounts on hundreds of sites, rated by difficulty.
EasyOptOuts
easyoptouts.comAutomated opt-out requests to people-search and data-broker sites (US). Shrinks what a doxxer can find.
- Operator sees
- The personal data you submit for opt-outs: full and previous names, emails, current/past addresses, phone numbers, birth date, relatives' names
- Jurisdiction
- United States
- Pay without card
- No: card, PayPal or bank only
PaidOpen
Paying for protection without your name
For paying for a VPN, server or domain used in research without tying it to the researcher’s identity. Not a guide to dodging KYC.
Cryptocurrency with private-by-default transfers. Accepted by Mullvad, IVPN and some hosting providers.
- Operator sees
- Nobody: runs locally, keys stay with you
- Audit
- zkSecurity, 2026 · Veridise, 2025
- Reproducible build
- Yes
Open-source mobile wallet for Monero and Bitcoin.
- Reproducible build
- No
Lightweight open-source Monero desktop wallet.
- Reproducible build
- Yes
Mullvad (any plan) and IVPN (1–3-year plans) take cash in an envelope with no name. Proton VPN and Windscribe also accept cash, but it must carry your username.
FreeOpen
No tools match these filters.
Help people on censored networks: run Snowflake
Snowflake turns your browser into a temporary bridge into the Tor network for users whose access is blocked. It relays a small amount of encrypted traffic and needs no setup beyond a browser extension.
It only helps while it runs: the extension works while your browser is open, and the web version only while its tab stays open. Close the tab and you stop being a bridge.
We have probably forgotten someone
This list is what we have used and checked, not the whole market. If a privacy tool is missing, or a card here has the wrong tier, jurisdiction or audit, tell us. Listing is free; we do not take paid placements.
Keep going
Related on PhishDestroy
Tools for fighting phishing225 tools to check links, report sites and trace scams.
Security checklistStep-by-step hardening for accounts, devices and wallets.
Emergency responseWhat to do in the first hour after a hack or wallet drain.
Crypto security guideWallets, signatures and drainer red flags.
No ads, no affiliate links, no paid placements. Links and facts checked 18 Oct 2026; details such as audits and free-tier limits change, so confirm on the vendor’s site before you rely on them. Anti-phishing and OSINT tools now live in Tools for fighting phishing.