Privacy for Beginners
First Steps
Ten steps, in an order that puts your core accounts first.
Before you start: check your email
Visit Have I Been Pwned and enter an email address you use. It checks whether that address appears in breaches already known to the service, helping you decide which accounts to secure first. Use the official site; you do not need to enter your account password.
If a breach is listed, change exposed or reused passwords at the affected service and anywhere else you reused them. Enable multi-factor authentication where available. A clean result does not prove an account has never been compromised: the service only knows about breaches in its database. You can also sign up there for future breach notifications.
Service plans and policies change. Check the linked providers before choosing a tool. No single tool guarantees anonymity.
Most privacy advice gives you a list of tools and no order to use them in. People end up with a VPN and a dozen browser extensions while they still reuse one password and sign up everywhere with their real email and phone number. This guide puts the steps in sequence instead. It starts with the accounts everything else depends on, moves to browsing and network traffic, then separates your identity and payments, and ends with the slower cleanup work.
Each entry covers what the tool does, why it helps, and where it falls short. None of them makes you invisible, so you should know what each one leaves exposed. You don't need to finish in a weekend. If you stop partway, the earlier steps, which protect what everything else depends on, stay in place.
Phase 1: Accounts and passwords
1. Password manager
A password manager creates a unique password for every account and remembers them for you, so the only one you memorize is the master password. That matters because reuse turns one breach into many: when a site leaks your credentials, attackers try the same pair against your email, bank, and shopping accounts. With a different password everywhere, the leak stays at the site that lost it. Autofill adds protection against phishing, since it fills credentials only on the exact domain where they were saved and gives a lookalike page nothing. Most reputable managers, Bitwarden among them, are zero-knowledge: your vault is encrypted on your device before it syncs, so the company holds only ciphertext.
Limits: Everything rides on the master password. In the 2022 LastPass breach, attackers copied customers' encrypted vaults and could try to crack the weaker master passwords offline. Malware on your device can read passwords once you unlock the vault, which bypasses the encryption. KeePassXC keeps the vault in a local file, so no company's server is involved, but syncing and backups become your job.
2. Proton Mail
Proton Mail is an encrypted email service based in Switzerland. Messages between Proton users are end-to-end encrypted, and message bodies and attachments are stored with zero-access encryption. Email metadata, such as subject lines and addresses, has different protections. The free tier shows no ads, and Proton earns its money from paid plans. Start here because your email address is the recovery point for nearly every other account you own. A compromised inbox exposes all of them.
Limits: End-to-end encryption covers Proton-to-Proton mail and messages you password-protect. Mail to a Gmail or Outlook address is protected by TLS in transit, then sits readable in the recipient's provider. Subject lines are not end-to-end encrypted even between Proton users; Proton says this keeps it compatible with the OpenPGP standard. Sender and recipient addresses are visible too, since delivery requires them. The free plan caps storage and daily messages, which matters if this becomes your main inbox.
Proton Mail · Encryption explained
Phase 2: Browsing and network traffic
3. Hardened browser
A stock browser tells every site a lot about you: screen size, installed fonts, time zone, graphics hardware, language. Together those details form a fingerprint that can identify you without a single cookie. Trackers pair the fingerprint with third-party cookies and embedded scripts to follow you from site to site and build a profile of your habits. A hardened browser blocks most of those trackers by default, resists fingerprinting, and sends less data back to its own developer. Mullvad Browser, Brave, and LibreWolf are three options.
Limits: A hardened browser doesn't hide your IP address from the sites you visit; the VPN in step 5 covers that. Strict settings also break some sites, usually their layout or login flow.
Mullvad Browser · Brave · LibreWolf
4. Ad blocker
Most online ads load through networks that log each visit to build a profile of you. An ad blocker stops those requests, so the tracking scripts bundled with the ads never run. Pages load faster, and you avoid malicious ads, which attackers have used to deliver malware through legitimate sites. uBlock Origin is a widely used open-source option.
Limits: A blocker works from filter lists, so a tracker that isn't on a list gets through. Some sites detect a blocker and refuse to load until you turn it off. It does nothing about your IP address or your fingerprint. Browser support varies; use a supported browser and check the official installation guidance.
5. VPN
A VPN encrypts your traffic and routes it through the provider's server. Your ISP, and anyone sharing your network at a coffee shop or airport, can see that you're connected to the VPN but not which sites you visit. The sites see the VPN server's IP address instead of your home one, which makes your home IP address less visible to those sites. Other signals can still reveal your identity or location. You have moved your trust from the ISP to the VPN company, which can observe connection metadata. HTTPS still encrypts the contents of HTTPS connections between your browser and the destination.
Limits: A VPN doesn't make you anonymous. If you log into an account with your name on it, the site knows who you are whatever your IP address says. Fingerprinting and tracking cookies also pass straight through. The provider's logging practices decide whether the tool is worth using, so look for a no-logs claim that an independent audit has tested; speed and server count matter less.
6. Quad9 DNS
Every site you visit starts with a DNS lookup, which turns a domain name into an address. By default your ISP's resolver handles those lookups and can log them. Quad9 is a free public resolver you point your devices or router at (9.9.9.9) instead. The Quad9 Foundation, a Swiss nonprofit, runs it and blocks domains that appear on threat-intelligence feeds for malware, phishing, and botnets. Quad9 says it doesn't store client IP addresses to disk, requires no account, and operates under Swiss privacy law. It also supports encrypted lookups (DNS over TLS, DNS over HTTPS, and DNSCrypt), which hide your queries from the local network.
Limits: The no-logging claim is Quad9's own, and I found no independent audit. Its policy makes an exception for clients it believes are attacking its services, whose IP addresses and queries it may send to a central system. Quad9 still sees the domains you request, and your ISP still sees the IP addresses you connect to, so this reduces exposure without providing anonymity. The blocklist occasionally catches a legitimate site. Encryption isn't automatic either; you have to turn it on in your device or router settings.
Quad9 · Data and privacy policy
Phase 3: Separating identity and payments
7. Privacy.com virtual cards
Privacy.com issues virtual cards that stand in for your real card number, so a merchant sees a card tied to your account and never your bank details. You can lock a card to the first merchant that charges it, which makes every other merchant decline, or make it single-use. If a number leaks in a breach, it is useless to whoever took it, and closing a card can block future charges to that number. It does not cancel a subscription or any payment obligation. Every new site you pay is a new exposure, and this removes it without touching your bank account.
Limits: Privacy.com requires identity verification and a funding source. Review its current signup requirements and privacy policy, including how verification data is handled and retained. Virtual cards shield your underlying card or bank details from merchants; Privacy.com still processes transaction information.
8. MySudo
MySudo lets you create separate identities, called Sudos, each with its own phone number, email address, and handle. Give one to a classifieds site, another to a delivery app, and keep your real number for people you know. You can call, text, and email anyone, not only other MySudo users, and communication between MySudo users is end-to-end encrypted. Your phone number is almost as central as your email to account recovery and verification. A breach at one service then leaks a throwaway number instead of your main one.
Limits: Phone numbers require a paid plan (SudoGo, SudoPro, or SudoMax) and are available only in the US, Canada, and the UK. Messages to people outside the app are not end-to-end encrypted. The privacy claims come from the company, and I found no independent audit.
Phase 4: Data removal and further reading
9. Operation Privacy
Operation Privacy (operationprivacy.com) is a do-it-yourself dashboard that lists more than 400 tasks, including data broker opt-outs, credit freezes, alias emails, and device and home privacy, and tracks your progress with a privacy score. It doesn't act on your behalf. You complete each task yourself, so removal requests go out under your own name instead of through a paid service that then holds your data. Check the current site for task counts, access tiers, and pricing. If you don't know where to begin with data removal, the checklist supplies an order.
Limits: The site says it stores no IP addresses, device fingerprints, or sign-in logs, shows no ads or trackers, and deletes accounts after 400 days without a login. Those statements come from the operator, and I found no independent audit. The work is manual, so your result depends on how many tasks you finish.
10. Extreme Privacy by Michael Bazzell
Extreme Privacy: What It Takes to Disappear, is a self-published manual by Michael Bazzell covering how to start over completely: ghost addresses, nomad residency, legal structures, vehicles, housing, and payments, laid out as one ordered sequence rather than scattered tips. It's worth having on the shelf as a reference for anyone who needs privacy well beyond the everyday, with document templates included.
Limits: even the author flags some of the strategies as extreme and not meant for everyone, and earlier editions lean US-focused, so some tactics may not carry over elsewhere.