Browse the web anonymously | Staying Safe Online

Anonymity is not a product you install. It is the result of matching the right tools to a specific question: who are you trying to hide from, and what happens if they find you? That is your threat model, and it decides everything else. Someone who wants advertisers to stop profiling them needs a different setup from a journalist protecting a source.

This guide is organised in three tiers. Read the threat-model section first, choose your tier, and resist over-engineering. Complexity you do not understand usually makes you less safe, not more.

Define your threat model

Answer these four questions before installing anything:

What do you want to keep private? Your identity, your location, or the fact that you visited a site at all?
Who do you want to keep it from? Advertisers and data brokers, your internet provider, your employer, or a government?
How much effort can they spend to find you? An advertiser will not subpoena your internet provider. A state adversary will.
What happens if they succeed? Annoyance, or genuine danger?

Your honest answers map to a tier below. Most people are Tier 1. Be honest about whether you need more, because mis-scoping in either direction is the classic mistake. The personal security plan guide covers this process in more depth, and the three-question router on the Start here page will suggest a tier for you.

Tier 1: Everyday privacy

For: stopping advertisers, trackers and data brokers from profiling you across the web, reducing what your internet provider can see, and general privacy hygiene.

Not for: hiding from an adversary who can compel your internet provider or VPN service to hand over logs.

Suggested setup:

Browser. Use a privacy-focused browser as your daily one. Brave blocks trackers by default and is the easiest starting point; LibreWolf or a hardened Firefox suits people who prefer a non-Chromium, open-source option.
VPN. A reputable, audited, no-logs VPN hides your address from the sites you visit and your destinations from your internet provider. It moves your trust from the provider to the VPN company rather than removing it. See Configure a VPN safely for setup and verification.
Encrypted DNS. Set your resolver to DNS-over-HTTPS so lookups do not travel in plaintext.
Search. Use a search engine that does not build a profile from your queries.
Extensions. Add a content blocker if your browser does not already block at that level. Resist installing more. Every extension makes your browser more identifiable.

What this does not do. Your VPN provider still knows your real address. This is privacy from commercial surveillance, not anonymity from a serious investigator.

Tier 2: Serious anonymity

For: sensitive research that should not be linked back to you, where your internet provider, your employer and the destination site should all be unable to identify you.

Suggested setup:

Browser. Tor Browser, set to the Safest security level. Tor routes traffic through three relays, so no single point sees both who you are and what you are visiting.
No add-ons, no customisation, no resizing the window. Part of Tor’s protection is that every user looks identical. Each change separates you from the crowd and makes you more trackable.
Never sign in to an account tied to your real identity during an anonymous session. Doing so immediately links that browsing to you, and it is the most common way people expose themselves.
Mullvad Browser is a useful companion. It provides Tor Browser’s anti-fingerprinting without routing through the Tor network, which helps when a site blocks Tor or you need more speed. It does not hide your address on its own, so pair it with a VPN.

If a service at this tier requires an email address or a payment, read Set up anonymous email and payments before you sign up.

Trade-offs. Tor is slower, some sites block it and streaming is impractical. That friction is the cost of the protection. If it is unacceptable, you are probably in the wrong tier.

Tier 3: High-risk

For: journalists, whistleblowers, activists, and anyone for whom discovery carries real personal danger. If this is you, read the primary sources in full rather than relying on this summary.

Suggested setup:

Tails is a live operating system that boots from a USB stick, routes everything through Tor and leaves no trace on the computer once you shut down. It suits discrete, occasional high-risk sessions.
Whonix runs in two virtual machines that separate network activity from your working environment, so compromising one does not unmask the other. It suits ongoing anonymous work.
Qubes OS, optionally with Whonix, compartmentalises the whole system for state-level adversaries. The learning curve is steep and it is only worth it if your threat model genuinely demands it.

At this tier the tools are the easy part. Operational security is what keeps you safe, and mistakes can carry serious consequences. Seek training and read the primary sources rather than relying on a web guide alone.

The habits that matter more than the tools

Most people who are de-anonymised are not defeated by weak software. They are undone by their own behaviour. A tool is only as good as the discipline around it.

Never mix identities. Do not sign in to a personal account, check personal email or reuse a username during an anonymous session. One crossover links everything.
Compartmentalise. Keep separate browsers, profiles or machines for separate identities and purposes, and do not let them touch.
Assume metadata betrays you. When you are active, how you write, and the time zone recorded in a document’s properties have all exposed people whose content was clean.
Open downloaded files carefully. A document that contacts a server when opened can reveal your real address, bypassing Tor entirely.
Keep everything updated. Outdated privacy software is a liability; unpatched flaws are how these tools fail.
Fewer changes mean more anonymity. Every customisation makes you more distinctive. The goal is to blend into the crowd.
No tool fixes unsafe behaviour. No browser protects you from signing in to your real account or telling someone who you are.

How people get caught works through three documented cases where exactly these habits, not the software, decided the outcome.

Common mistakes

Believing a VPN alone provides anonymity. It relocates trust; it does not erase you.
Using Tor and then signing in to a real account.
Loading Tor Browser with extensions and custom settings that make it uniquely identifiable.
Adopting Tier 3 tooling you do not understand, and making errors that a simpler setup would have avoided.
Treating a single forum thread as authoritative. Verify against primary sources.

Privacy myths, busted covers the assumptions behind these mistakes in more detail. If you use AI assistants during sensitive research, Use AI assistants privately explains where those tools fit. Your phone deserves the same attention as your computer, which Browse privately on your phone covers.

Check your own browser

Once your setup is in place, test what your browser reveals. It reports the signals a site can read from your browser without any cookie, and links to the server-based tests that check your address and DNS.

Sources and further reading

This field changes quickly. Re-verify tool recommendations against the sources above before relying on them.