Mullvad Browser
Tor Browser's anti-fingerprinting protections without routing through the Tor network.
Keep in mind: It does not hide your address on its own, so it needs to be paired with a VPN.
Curated directory
Security and privacy resources
A starting collection of publications, organisations and tools. Every recommendation should be considered in the context of your own needs and risks.
Anonymity tools
Onion Browser
A Tor browser for iPhone and iPad, recommended by the Tor Project.
Keep in mind: All iOS browsers use Apple's WebKit engine, so the protection is weaker than Tor Browser on other platforms. It is not suitable for the highest-risk work.
Qubes OS
An operating system that compartmentalises work into isolated virtual machines.
Keep in mind: The learning curve and hardware requirements are steep. It is proportionate only for the highest-risk threat models, and misconfiguration can leave you worse off than a simpler setup.
Tails
A live operating system that boots from a USB stick, routes everything through Tor and leaves no trace on the computer.
Keep in mind: Nothing is retained between sessions unless persistent storage is configured, and using it means rebooting the machine from a spare USB stick.
Tor Browser
The Tor Project's browser, which routes traffic through three relays so no single point sees both who you are and what you visit.
Keep in mind: Browsing is slower and some sites block Tor. Customising the browser or signing in to a personal account undermines the protection it provides.
Whonix
Two virtual machines that separate network activity from the working environment, for ongoing anonymous work.
Keep in mind: Requires virtualisation software and a computer with enough memory to run two virtual machines at once.
Books and research
Attacks on Tor
A categorised bibliography of published attacks against Tor and how anonymity has failed in practice.
Keep in mind: Community-maintained rather than peer-reviewed, and updated irregularly; verify each cited paper directly.
Extreme Privacy (Michael Bazzell)
A detailed reference on reducing your personal data footprint.
Keep in mind: Heavily oriented to United States services, law and identity documents; much of it needs adapting elsewhere. New editions supersede earlier ones frequently.
Privacy Enhancing Technologies Symposium
Peer-reviewed academic research on privacy technologies, including de-anonymisation studies.
Keep in mind: Academic papers that assume a technical background; findings are often narrower than headline summaries suggest.
The Art of Invisibility (Kevin Mitnick)
An accessible, story-driven introduction to the mindset behind staying private online.
Keep in mind: Published in 2017. The reasoning holds up better than the specific tool recommendations, which are now dated.
Tor: The Second-Generation Onion Router
The original design paper explaining how Tor works and what it was built to defend against.
Keep in mind: Published in 2004; the implementation has changed considerably since, so read it for the design reasoning rather than current behaviour.
Browser privacy
AdBlock
A content-blocking extension for common web browsers.
Keep in mind: Review the product's acceptable-ads programme and privacy policy before choosing it over open-source alternatives.
Arkenfox user.js
A documented configuration file for hardening a standard Firefox installation.
Keep in mind: Intended for people willing to read the documentation; applying it without understanding the settings will break websites.
Brave
A Chromium-based browser that blocks trackers and advertisements by default.
Keep in mind: Bundled rewards and cryptocurrency features are unrelated to privacy and optional; review them before enabling anything.
LibreWolf
A Firefox derivative configured for privacy by default, with telemetry removed.
Keep in mind: Strict defaults break some sites, and releases follow upstream Firefox at a short delay.
Privacy Badger
A browser extension from the EFF that learns to block trackers.
Keep in mind: It complements rather than replaces browser privacy settings or a general-purpose content blocker.
uBlock Origin
An efficient, open-source content blocker for supported browsers.
Keep in mind: Browser support varies, and similarly named extensions may not be the same project. Install only from the project's official links.
Device protection
AVG
Security software for computers and mobile devices.
Keep in mind: Check bundled features, renewal pricing and data collection before installation.
Bitdefender
Commercial security software for computers and mobile devices.
Keep in mind: Check whether the protections already built into your operating system meet your needs before adding another privileged application.
Malwarebytes
Malware detection and removal tools for common platforms.
Keep in mind: Additional security software cannot compensate for unsupported software, unsafe downloads or a compromised account.
Panda Security
Commercial security software for computers and mobile devices.
Keep in mind: Check bundled features, renewal pricing and data collection before installation.
Email privacy
addy.io
An open-source email aliasing service that can also be self-hosted.
Keep in mind: Aliases forward to your real inbox, so the provider knows the connection. Self-hosting moves that trust to you along with the maintenance.
DuckDuckGo Email Protection
A free forwarding address that strips trackers from messages before they reach your inbox.
Keep in mind: Mail is forwarded to your real inbox, so this reduces exposure rather than separating your identity.
Firefox Relay
Email masks from Mozilla that forward to your existing address.
Keep in mind: The free tier covers only a small number of masks, and forwarding means Mozilla knows the connection to your real inbox.
Proton Mail
An encrypted mailbox provider based in Switzerland, with a free tier.
Keep in mind: Encryption protects message contents, not the fact that a message was sent or to whom. An account created with a recovery address or phone number that belongs to you still points back to you.
SimpleLogin
An open-source email aliasing service, part of the Proton group.
Keep in mind: Aliases forward to your real inbox, so the provider knows the connection. They reduce exposure rather than creating a separate identity.
Tuta
An encrypted mailbox and calendar provider based in Germany, with a free tier.
Keep in mind: Encryption protects message contents, not who you correspond with. Encrypted mail to people outside the service works differently from ordinary mail; check how before relying on it.
Help and organisations
Have I Been Pwned
Checks whether an email address appears in known data breaches and can notify you about future exposures.
Keep in mind: A clean result does not prove an account is safe because not every breach is known or public. Point-in-time searches are not stored, but breach notifications require storing a verified email address.
Report Fraud
The UK service for reporting fraud and cybercrime.
Keep in mind: This service is UK-specific. Call emergency services when there is immediate danger or a crime is in progress.
Stay Safe Online
Cybersecurity education from the National Cybersecurity Alliance.
UK National Cyber Security Centre
Official UK guidance for individuals and families.
Learning and training
CPJ Digital Safety Kit
A concise digital safety checklist for reporters, from the Committee to Protect Journalists.
Keep in mind: First published in 2019 and updated periodically; check specific tool advice against a current source.
EFF Surveillance Self-Defense
Guides on threat modelling and protecting yourself from surveillance, from the Electronic Frontier Foundation.
Keep in mind: Written largely from a United States legal perspective; check local law and services where they matter.
Freedom of the Press Foundation — Digital Security
Digital security training material and guidance from the organisation behind SecureDrop.
Keep in mind: Written for journalists and their sources; some material assumes a newsroom context.
Knight Center Journalism Courses
Free online courses, including recurring digital-security courses for journalists.
Keep in mind: The catalogue changes and digital-security courses run to a schedule rather than continuously.
Privacy Guides
A non-commercial, actively maintained collection of privacy tool recommendations and explanations.
Keep in mind: Recommendations change as tools change; check the date on any page before acting on it.
Tor Project support and documentation
The authoritative explanation of how Tor works, what it protects against and how to use it safely.
Totem
Free online courses on digital security and privacy for activists, journalists and human-rights defenders.
Keep in mind: Course availability and language coverage vary over time.
Password managers
1Password
A cross-platform commercial password manager.
Keep in mind: A cloud vault places availability and some metadata trust in the provider. Confirm current pricing, recovery options and platform support.
Bitwarden
An open-source password manager with free and paid plans.
Keep in mind: Cloud-hosted use still depends on the provider's availability and your ability to protect the master password and recovery material.
Dashlane
A commercial password manager with individual and business plans.
Keep in mind: A cloud vault places availability and some metadata trust in the provider. Confirm export and recovery options.
KeePassXC
A free, open-source and offline password manager.
Keep in mind: You are responsible for securely synchronising and backing up the vault; it is less convenient across multiple mobile devices.
LastPass
A cross-platform commercial password manager.
Keep in mind: Review the provider's security-incident history and current architecture before choosing it for a new vault.
Podcasts
Click Here
Reported stories about hackers, surveillance, cyber conflict and the people shaping the digital world.
Keep in mind: This is narrative journalism rather than a practical security course. Follow linked reporting and primary sources for technical detail.
CyberWire Daily
Concise weekday cybersecurity news and analysis with interviews from across the industry.
Keep in mind: Daily coverage moves quickly and cannot provide full context for every story. Check linked advisories and original reporting before taking action.
Darknet Diaries
True stories about hacking, data breaches, cybercrime and the people involved.
Keep in mind: Narrative storytelling can simplify technical detail. Use the episode notes and linked sources when an account affects a security decision.
Hacking Humans
Weekly coverage of phishing, scams, social engineering and the human side of security.
Keep in mind: The focus is awareness and analysis rather than detailed incident response or configuration guidance.
Risky Business
Weekly security news, analysis and interviews for cybersecurity professionals.
Keep in mind: Some episodes and segments feature security vendors. Treat product claims as a starting point and check independent evidence.
Security Now
Long-form weekly discussion of vulnerabilities, privacy, authentication and security news.
Keep in mind: Episodes mix reporting with host analysis and opinion. Check vendor advisories and original research before acting on technical claims.
Smashing Security
A weekly, accessible look at cybercrime, privacy failures and technology mishaps.
Keep in mind: The show prioritises entertaining discussion rather than step-by-step technical guidance. Verify consequential advice against primary sources.
Security publications
CNET Security
Consumer-focused security news and advice.
Keep in mind: Consumer technology coverage is broad and should not replace vendor or government documentation for configuration advice.
Dark Reading
News and analysis for the information security community.
Graham Cluley
Independent computer security news and commentary.
Infosecurity Magazine
Information security news, insight and analysis.
Krebs on Security
In-depth security news and investigations.
Malwarebytes Labs
Research and advice covering malware, scams and online threats.
Keep in mind: This is vendor-published material; product-related claims should be checked against independent evidence.
Schneier on Security
Essays and analysis from security technologist Bruce Schneier.
Securelist
Threat research and analysis from Kaspersky researchers.
Keep in mind: Vendor-published research can reflect the publisher's product focus; corroborate important claims with other primary research.
Sophos News
Security news, research and advice from Sophos.
Keep in mind: This is vendor-published material; product-related claims should be checked against independent evidence.
The Hacker News
Cybersecurity news and technical coverage.
Troy Hunt
Security research and practical commentary from Troy Hunt.
VPNs and DNS
Mullvad VPN
An audited, no-logs VPN that issues account numbers instead of requiring an email address, and accepts cash.
Keep in mind: A VPN moves trust from your internet provider to the VPN company rather than removing it. No-logs claims are a policy, not a technical guarantee.
NextDNS
A configurable encrypted DNS service with filtering and per-device profiles.
Keep in mind: Logging is configurable and enabled by default for the analytics features, so review the settings. The free tier is capped by monthly query volume.
Proton VPN
An audited VPN with a free tier, from the company behind Proton Mail.
Keep in mind: A VPN moves trust from your internet provider to the VPN company. The free tier offers fewer locations and lower speeds.
Quad9
A free encrypted DNS resolver, operated by a Swiss foundation, that also blocks known malicious domains.
Keep in mind: Encrypted DNS hides lookups from the local network and your internet provider, but the resolver itself still sees them.
This page was last reviewed on 26 July 2026
