In 2014, a New York Times reporter named Glenn Greenwald was trying to contact Edward Snowden. Snowden had encrypted files to share and a specific, urgent request: Greenwald needed to set up PGP email encryption before any files would change hands. Greenwald had been too busy to do it. He was, by the standards of a technology reporter at a major newspaper, reasonably sophisticated about security.
He almost missed the biggest national security story in a decade because he didn’t know how to set up basic encrypted email.
That’s the gap this guide addresses. Not the theoretical gap between ordinary people and nation-state surveillance. It’s the practical gap between what most people believe protects them and what actually does, and where that gap matters.
The short answer: There is no single “anonymous” setting. Anonymity is always relative to a specific adversary, so start by naming who you’re hiding from. For most people, the threats are data brokers, advertisers, and stalkers, not the NSA. Tier 1 (a password manager, hardware 2FA, uBlock Origin, broker opt-outs) and Tier 2 (a vetted VPN, email aliases, private DNS) cover almost everyone. Tier 3 (Tor, Tails, Whonix, Monero) is for high-risk work and adds real friction, so only reach for it when your threat model demands it.
Jump to: Choose your threat model · Tier 1: baseline privacy · Tier 2: reduced footprint · Tier 3: strong anonymity · The limits of all of this
Before choosing a tool, choose your threat model
The single biggest mistake in privacy advice is treating anonymity as a binary: you have it or you don’t. In practice, anonymity is always relative to a specific adversary. The question isn’t “am I anonymous?” It’s “who am I hiding from, and what do they have the capability and motivation to do?”
This changes everything. Most people need protection from three things: data brokers selling their purchase history to insurers, advertisers building behavioral profiles, and stalkers or abusive ex-partners. A people-search site can hand any of them a home address. They don’t need to evade NSA signals intelligence. These are fundamentally different problems with different solutions. Conflating them produces security theater: expensive, time-consuming measures that don’t address the actual threat while neglecting simple fixes that would.
A few questions to ask yourself:
Who is most likely to harm you using your digital information? A corporation monetizing your data is different from a harassing ex-partner, which is different from a government. Their tools, their motivations, and their legal constraints are different.
What do you most need to protect? Your location from a stalker. Your identity from a doxxing campaign. Your communications from an employer. Your financial history from an insurance company. Each has a different protection strategy.
What are you willing to give up for privacy? Tor Browser is slow. Tails OS requires rebooting your computer every session. Air-gapping a device means it’s useless for half of what you might need. Trade-offs are real.
With that framing established, here’s what each tier actually gets you.
Tier 1: Baseline privacy — what everyone should already be doing
These measures don’t require any significant inconvenience. Not having them is indefensible for anyone who cares about their own data.
Password manager with unique passwords per site
Most successful account takeovers don’t happen through sophisticated hacking. They happen through credential stuffing: automated attacks that take email and password combinations leaked from one site and try them everywhere else. When LinkedIn leaked 6.5 million password hashes in 2012 (later revealed to be 117 million), anyone who reused that password was exposed everywhere at once. That covered their bank, their email, and their health portal.
A password manager solves this completely. Use a different, randomly generated password for every site. When a breach happens, it’s contained to that site. Bitwarden is open source, audited, and free. 1Password is the well-regarded commercial option. Either one puts this problem behind you.
Hardware security key for two-factor authentication
You’ve been told to enable two-factor authentication. You probably did, with SMS, which sends a code to your phone. Here’s the problem: SMS 2FA is vulnerable to SIM swap attacks. An attacker calls your mobile carrier, claims to be you, claims they got a new phone, and asks for your number to be transferred to their SIM. Carriers have poor verification. This attack is common enough that the FBI issued a warning about it. It has been used to drain cryptocurrency wallets, take over email accounts, and bypass account recovery on social media.
A hardware security key operates on FIDO2/WebAuthn. YubiKey is the dominant brand, and Google’s Titan Key is the main alternative. The key performs a cryptographic operation locally that proves you physically possess the device. There’s no code to intercept. There’s no carrier to social-engineer. Phishing attacks that capture your password don’t help the attacker, because the key also verifies the site’s domain. You can’t be tricked into authenticating on a fake login page.
Use hardware keys on your email, any financial accounts that support them, and your password manager. SMS 2FA is better than nothing. FIDO2 is in a different category.
Encrypted email
ProtonMail and Tuta (formerly Tutanota) both offer end-to-end encrypted email. When you email another ProtonMail user, the content is encrypted between your devices and never readable by Proton’s servers.
But understand what this does and doesn’t protect. End-to-end encryption protects the content of messages. It does not protect metadata: who you emailed, when, how often, and from which IP address. Proton’s servers don’t read your emails, but they do know that your account exchanged messages with another account on a given date. This metadata is often more valuable than content. The NSA’s bulk collection programs focused heavily on metadata for a reason. Behavioral patterns from who-contacts-whom graphs are revealing even without reading a single message.
For journalists, activists, or anyone whose contact network is itself sensitive, metadata is a serious concern. For most people, encrypted email primarily protects against the scenario where a company employee reads your emails or a breach exposes the contents of stored messages. That’s still worth having.
Browser: Firefox or Brave with uBlock Origin
Someone switches from Chrome to Firefox “for privacy.” The most important change isn’t the browser. It’s installing uBlock Origin in that browser. uBlock blocks the tracking pixels, analytics beacons, and ad network scripts that follow you from site to site. Installed in Firefox or Brave, it cuts off most behavioral tracking at the source.
The choice between Firefox and Brave affects browser fingerprinting. But at this baseline level, any browser with uBlock Origin installed is dramatically better than Chrome, which effectively serves as Google’s data collection endpoint.
Don’t use Internet Explorer, Edge, or Opera for privacy-sensitive browsing. Edge phones home to Microsoft by default in ways that aren’t easily disabled. Opera sold a majority stake to a Chinese consortium in 2016 and its privacy practices have been questionable since.
Remove yourself from data broker sites
Data brokers are companies you’ve never heard of that maintain detailed profiles on you. A profile can hold your name, current and past addresses, family members, and phone numbers. It can also hold property records, estimated income, political donations, and purchase history. They sell this data to marketers, background checkers, and insurance companies. They also sell it to people looking for someone’s home address. Sites like Spokeo and Whitepages are the consumer-facing tip of this.
Getting yourself out is unglamorous, repetitive work. There’s no single form to fill. Each broker has its own opt-out process, many of which are designed to be tedious. And they don’t stay removed. Brokers repopulate their databases from public records and resellers, so you have to repeat requests regularly. Google’s results about you tool and services like DeleteMe automate the tracking and re-submission. It costs money but saves time.
Tier 2: Reduced footprint — for the privacy-conscious
These measures suit a specific group. A researcher. A small business owner who doesn’t want competitors tracking their activity. Someone escaping a difficult personal situation. Or anyone who has started thinking seriously about what their digital life looks like to people who don’t mean them well.
VPN — what it does and doesn’t do
A VPN hides your traffic from your ISP. At the sites you visit, it replaces your IP address with the VPN server’s IP. That’s genuinely useful in two situations. First, if you don’t want your ISP logging your browsing (in the US, ISPs can sell this data). Second, if you want to make IP-based tracking across sites harder.
What a VPN does not do: it doesn’t stop fingerprinting, it doesn’t protect you from sites you’re logged into, and it doesn’t defeat tracker pixels. It also doesn’t make you anonymous. It shifts who you’re trusting from your ISP to the VPN provider. If the VPN provider keeps logs and receives a legal request, they hand them over.
This makes the “no logs” audit question critical. Mullvad doesn’t require an email address to sign up — you get an account number, pay with cash if you want, and they have nothing to link to you. They’ve been audited and have proven they can’t produce logs because they don’t have them. IVPN is similar. These matter. A VPN company with unverified “no logs” claims is just another company with your browsing history.
Avoid free VPNs entirely. The product is your traffic.
Compartmentalization
Your “identity” online isn’t a single thing. It’s whatever cross-references advertisers, data brokers, and bad actors can make between different pieces of your online presence. Keeping those pieces apart prevents the cross-references.
At minimum: use separate browsers for separate activities. Shopping in Chrome (where you might be signed into Google) means Google gets your shopping data. Doing political research in the same browser means that data gets added to the same profile. Use Brave for general browsing and a separate Firefox profile for accounts that require a real identity. If the activity matters enough — business operations, activist work, anything you’re serious about separating — use a separate device.
The point isn’t to create an alias. It’s to stop the single data profile from growing into a comprehensive map of your life.
Email aliases
Every time you give a website your email address, you’ve created a permanent link between you and them. When their database leaks — and it will — your real email address is now attached to your name, your account, and whatever else was in that breach. Spam follows. Phishing follows. If you used a variation of your email that reveals your name format, every future breach builds on that.
SimpleLogin and addy.io let you create per-site aliases: a unique address for each signup that forwards to your real inbox. Amazon.com gets one alias. A forum you post in gets another. If any alias starts receiving spam or breach notifications, you know exactly where it came from. You disable that alias without compromising your real address.
This is a low-friction change with significant impact. Breaches still happen. This limits their blast radius.
Privacy-respecting phone number
Many services require a phone number for account verification. Your phone number is one of the most persistent identifiers attached to your real identity — it’s on your ID, linked to your mobile account, associated with your bank. Giving it to every app and service creates a trail back to you.
Google Voice provides a free US number for this purpose, though Google has its own tracking concerns. MySudo gives you multiple phone numbers with separate identities. Hushed and Burner offer virtual numbers for temporary use. For high-sensitivity purposes, consider a prepaid SIM purchased with cash.
DNS privacy
When you type a web address, your device first asks a DNS server to translate that name into an IP address. By default, that request goes to your ISP’s DNS server. Your ISP logs every domain you query — this is separate from HTTPS content encryption and doesn’t require breaking your connection. It’s simply a record of every site you visit, in order.
Cloudflare’s 1.1.1.1 with DNS-over-HTTPS encrypts your DNS queries and sends them to Cloudflare instead of your ISP. NextDNS goes further — it blocks known tracking and malware domains at the DNS level, works on all devices on your network, and logs nothing by default. Either eliminates ISP-level DNS surveillance.
DNS leaks are also a known VPN problem: some VPN configurations still send DNS queries outside the tunnel to your default resolver, defeating the ISP privacy benefit. Confirm your VPN handles DNS inside the tunnel.
Leaving Google’s ecosystem
Google’s core business is the precise targeting of advertising. That requires knowing what you’re interested in, what you’ve searched for, where you’ve been, and what you’re likely to do next. Gmail, Google Search, Google Maps, Chrome, and Android are data collection infrastructure that happens to provide useful services.
Kagi is a paid search engine ($5/month) with no ad model, no tracking, and high-quality results. SearXNG is a self-hosted or public-instance meta-search engine that doesn’t track queries at all. DuckDuckGo is the easiest switch and better than Google from a tracking standpoint, though its Bing results have quality limits.
Request removal from Google’s search index through their removal tools. Revoke location history, app permissions, and ad personalization in your Google account if you’re keeping it. Use Google Maps while signed out if you need it.
Tier 3: Strong anonymity — for high-risk individuals
Journalists working with sensitive sources. Activists in authoritarian countries. Abuse survivors who have reason to believe someone with resources is looking for them. Whistleblowers. Anyone whose physical safety could be harmed by digital exposure. These measures belong here. They are genuinely inconvenient. Reaching for this tier without the threat model to justify it just makes your life harder for little benefit.
Tor Browser
The Tor network routes your traffic through three encrypted relays operated by volunteers worldwide. Your ISP can see you’re connected to Tor, but not what you’re accessing. The website you visit sees the IP address of the exit relay, not yours. Each relay operator sees only the traffic passing through their node. The entry relay knows your IP but not your destination. The exit relay knows your destination but not your IP. No single relay knows both.
What Tor protects against: ISP surveillance of your traffic, site-level IP tracking, and most commercial tracking infrastructure. For journalists accessing sources who use SecureDrop (The New York Times, The Washington Post, The Intercept, and others all run SecureDrop instances accessible only through Tor), it’s the standard tool.
What Tor doesn’t protect: your behavior inside a session. If you log into your real Google account through Tor, you’ve identified yourself. If you fill in a form with your real name, your IP anonymity doesn’t matter. JavaScript fingerprinting can still run inside the browser. Exit nodes — the final relay that connects to regular websites — can see and modify unencrypted HTTP traffic. Most modern HTTPS traffic is protected by the site’s own encryption, but anything over HTTP is exposed at the exit node.
The canonical warning: the Tor Browser Bundle hardens against fingerprinting by standardizing every browser configuration. Don’t install plugins, don’t resize the window, don’t log into any account connected to your real identity. These behaviors create distinguishing characteristics that can be correlated across sessions.
Timing attacks on Tor are a real threat at the nation-state level. If an adversary controls enough of the network’s entry and exit nodes, they can correlate traffic timing to identify users. Law enforcement has successfully de-anonymized Tor users through this method combined with other techniques. Tor doesn’t protect you from the NSA. It does protect you from almost everyone else.
Tails OS
Tails is a live operating system that runs from a USB drive. You boot a computer from the USB — bypassing the installed operating system — and Tails loads into RAM. When you power off, everything that happened in that session is gone. No persistent files, no browser history, no connection between this session and any prior session, nothing stored on the host machine.
Tails routes all internet traffic through Tor by default. It includes tools for encrypted file handling, secure deletion, and metadata removal. It’s designed for use on computers you don’t own or trust.
When you need it: handling a sensitive document on a library computer. Communicating with a source in a situation where your device might be examined. Working from a location where you need zero local trace of your activity.
What it’s not: a daily driver. Booting from USB every time you want to read your email is not sustainable. Use it for specific sessions that require a clean slate.
Whonix
Whonix takes a different approach. It runs as two virtual machines: a “Gateway” that handles Tor routing, and a “Workstation” that you use normally. All network traffic from the Workstation must pass through the Gateway, which routes it through Tor. If an application in the Workstation is compromised and tries to send traffic directly — bypassing Tor — the Gateway blocks it.
Unlike Tails, Whonix is persistent. You can save files, maintain a workflow, use it as part of a regular routine. This makes it suitable for journalists who need to maintain communication with a source over weeks or months without each session being completely ephemeral.
The trade-off is setup complexity and resource use — running two virtual machines simultaneously requires a reasonably capable host machine.
Air-gapped devices
Some operations are genuinely sensitive: managing encryption keys, or working with documents that should never touch the internet. For those, an air-gapped device is a computer that has never been connected to a network and never will be. Data goes in and out on physical media: USB drives, SD cards. Those transfer points are where the risk concentrates. The Stuxnet worm that damaged Iranian nuclear centrifuges was delivered by a USB drive into an air-gapped network.
An air-gapped machine is not for general use. It’s for specific tasks: generating and storing GPG keys, working with highly sensitive documents, anything where the cost of network exposure is too high to risk.
Financial anonymity: cash and Monero
Every credit card transaction you make is logged, retained, and sold. Your purchase history is more revealing than your search history — it shows where you physically were, what you bought, and patterns that combine into a behavioral profile.
Cash eliminates this for physical transactions. For anything that requires online payment, cryptocurrency is the common answer, with important caveats.
Bitcoin is not anonymous. The Bitcoin blockchain is a public ledger. Every transaction is visible to anyone who looks. Blockchain analysis is a service companies like Chainalysis sell commercially. With enough of it, Bitcoin transactions can often be traced back to real identities. That is particularly true where they touch regulated exchanges that required identity verification.
Monero (XMR) is the main privacy-preserving cryptocurrency in practical use. It uses ring signatures, stealth addresses, and confidential transactions to hide sender, recipient, and amount on-chain. No public ledger. No transaction graph. For online purchases that cannot be traced back to an identity, Monero is the tool. Buying Monero privately takes effort. The simplest path is buying Bitcoin through a KYC exchange and converting it through a decentralized exchange. Accept that the conversion point itself is a record.
Physical OPSEC: what your devices leak without your knowledge
Your photos contain EXIF data. GPS coordinates are embedded in images taken on smartphones by default. A photo of a document can include the GPS location of the room where it was photographed. A photo posted publicly with location data embedded is sufficient to determine your home address if enough photos were taken there.
Disable location tagging in your camera app settings. Before sharing any image, strip EXIF data. On Linux, exiftool -all= filename.jpg. On mobile, the Scrambled Exif app for Android or the built-in sharing options on iOS can remove metadata before transmission.
More subtle: printers embed invisible steganographic dots in printed pages that encode the printer’s serial number and the date and time of printing. Documents that should be untraceable to a specific device shouldn’t be printed — or if they must be, printed in a public location on a machine unconnected to you.
Communications: Signal and its limits
Signal provides end-to-end encrypted messaging with perfect forward secrecy. The encryption keys are rotated with each message. So compromising one key doesn’t expose past conversations. Signal’s server stores only your phone number and registration date. It is the gold standard for encrypted communication in 2026 and is used by security professionals, journalists, and government officials in sensitive roles.
Signal requires a phone number for registration, which is a real trade-off. That number is a link to your real identity. For high-risk use, register with a non-attributable number (see Tier 2 on virtual numbers).
WhatsApp uses the Signal protocol for message encryption. Its marketing emphasizes this. The difference: Meta owns WhatsApp. Metadata covers who you message, when, how often, your contacts, and your location when you opened the app. Meta retains all of it. That extends its reach to their advertising ecosystem and to legal requests. The encryption of message content doesn’t change the exposure of the social graph. For metadata-sensitive communication, Signal with a private number is not equivalent to WhatsApp. They are different products with different threat profiles.
The limits of all of this
Behavioral de-anonymization
Your writing style is a fingerprint. Academic researchers have demonstrated stylometric analysis that can identify authors from short text samples with significant accuracy. The same techniques have been used to narrow down Satoshi Nakamoto candidates from Bitcoin forum posts. They have attributed articles to specific journalists. They have de-anonymized academic paper authors who submitted anonymously.
Your typing patterns, time-of-day posting habits, and characteristic phrase choices are consistent across pseudonyms. An adversary with enough samples from your pseudonymous account and your real identity can draw connections that no technical protection prevents.
This is not a hypothetical. Several Tor hidden service operators were identified not through any cryptographic break, but through writing style analysis and behavioral patterns. Posting times matched a suspect’s time zone. Phrasing appeared both on the hidden service and in indexed posts.
If you maintain a pseudonymous identity with serious stakes, it requires consistent behavioral discipline: post at different hours, write differently, avoid phrases you use elsewhere.
Timing correlation attacks
Law enforcement agencies and intelligence services have demonstrated they can de-anonymize Tor users by controlling enough of the entry and exit nodes to correlate traffic timing. Say an adversary sees encrypted traffic entering the Tor network from your location at the same moment that unusual traffic arrives at a target site. Statistical analysis of that timing is enough to link them, even without ever breaking the encryption.
This attack requires significant resources. It is not available to a stalker, a data broker, or most corporate adversaries. It is available to nation-states and some well-resourced law enforcement agencies. If you’re a journalist with sources whose safety depends on identity protection, Tor provides meaningful protection against most adversaries. It doesn’t protect against an adversary who can monitor large portions of internet infrastructure.
Legal compulsion
What governments can demand: In the US, the government can compel disclosure of account metadata under a variety of legal authorities, often without your knowledge. National Security Letters require no court oversight and come with a gag order preventing the recipient from disclosing they received one. GDPR provides meaningful protections in Europe, but law enforcement exemptions are broad. In authoritarian countries, the legal framework is irrelevant — companies operating in those jurisdictions comply with local authorities or face the consequences.
“Warrant canary” programs — where companies note the absence of government demands rather than their presence — have had mixed effectiveness. Some companies have upheld them seriously. Others have abandoned them quietly.
The practical implication: even if a service provider’s technical architecture protects your content, a company operating under a legal obligation will provide what they have. Design your privacy so that what they have isn’t enough to identify you.
Calibrate to your actual adversary
A final, honest note: the single most important principle in this guide is the adversary model at the beginning. Nation-state surveillance — the NSA, GCHQ, China’s MSS — is not a practical threat to most people reading this. Corporations harvesting behavioral data to sell to insurance companies, political campaigns, and anyone willing to pay is a practical threat to essentially everyone.
The privacy measures that matter most for most people are Tier 1 and Tier 2. That means unique passwords, hardware 2FA, and an alias email service. It also means uBlock Origin, a vetted VPN, and opting out of data brokers. These are low-friction, high-impact. They protect against the actual threats people face: credential stuffing, identity theft, stalking enabled by data broker exposure, targeted phishing.
Tor and Tails and air-gapped machines matter for people with specific, high-stakes threat profiles. Using them without that threat model is security theater. It makes your life harder without matching protection against the risks you actually face.
Know who you’re protecting yourself from. Then build accordingly.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.