How TorWatch picks privacy tools, and what each verdict rests on
Every tool verdict on TorWatch rests on a document you can open yourself: an independent audit report, a court or police record, a published licence and source code, or the provider's own written policy. Those four don't carry equal weight, and the verdict says which one it leans on. There are no star ratings or scores out of ten. Each job, from passwords to messaging to VPNs, gets one pick for most people and a named alternative for a different threat, with the reason the alternative wins in that case.
The four kinds of evidence, strongest first
| Evidence | What it shows | What it doesn't show |
|---|---|---|
| A court or police record | What the provider actually handed over when it was legally forced to. Signal's published response to a District of Columbia grand jury subpoena, dated 6 March 2026, covers 37 phone numbers: seven accounts did not exist, Signal had nothing responsive for 24, and for the other six it provided the account-creation and last-connection times that were asked for. | What the provider could be ordered to collect from now on. A record shows the past, under that country's law. |
| An independent audit | That a named firm examined a named part of the product, in a named year, and what it found. Bitwarden lists a 2025 audit of its core cryptography by the Applied Cryptography Group at ETH Zurich, carried out on the assumption of a fully malicious server. | Anything outside the audit's scope. X41 D-Sec's audit of Mullvad, a source review in October 2025, covered its API and the backend services that handle payments, customer devices and WireGuard key distribution. It is evidence about Mullvad's account system, and it is cited as that. |
| Published source code and a licence | That anyone can read what the software does, and under what terms. Bitwarden's repositories are published under the AGPL v3.0 and the Bitwarden License v1.0. | That anyone has read it carefully, or that the server you connect to runs the published code. |
| The provider's own policy or post | What the company commits to in writing, and therefore what it can be held to. | That the commitment is kept. On its own, this is the weakest of the four. |
Popularity, app-store ratings and a "military-grade encryption" badge are not on the list. A tool used by millions can still hold your contact list on its server, and only the evidence above tells you whether it does.
The questions asked of every tool
The evidence above answers these, in roughly this order of importance:
- Who can see what? The content, the metadata (who talks to whom, when, from where), and the account itself. A messenger that encrypts messages but stores your contact list on its server answers this differently from one that never has the list.
- What can the provider be forced to hand over, and by which courts? This is where the company's country and owner matter. The ownership section of the privacy tools page lists the jurisdictions behind the main picks.
- Has anyone outside the company checked the claim? Which firm, which year, which part of the product.
- What does it cost, and if it's free, what pays for it? A free password manager or messenger can be a full product. A free VPN has to be paid for by something, and the page says what.
- Can an ordinary person actually live with it? A tool that is secure on paper and abandoned in a week protects nobody. Where the safest option is hard to run, the page names it as the option for a higher threat and gives most readers the one they'll keep using.
One pick for most people, and who should choose differently
A single "best" rarely fits everyone, because the right tool depends on who you're hiding from: an advertiser, your internet provider, someone with access to your phone, or a government with legal powers over the provider. Each job on the privacy tools page leads with the tool most readers should use and then says plainly when that changes, such as Bitwarden for people who want passwords on every device and KeePassXC for people who want nothing on anyone's server.
The secure messengers comparison works the same way at more depth: Signal for almost everyone, and the specific situations where Session, SimpleX or Threema is the better answer, with what each one still exposes.
The VPN comparison is the same job for one category: Mullvad for most people who will pay, Proton VPN if you need the free plan or a yearly look at the servers, IVPN if you want a founder-owned company in Gibraltar.
When the sources disagree
Sources disagree more often than comparison charts admit. A provider's FAQ can lag behind its own blog. A project's comparison table can score a rival's release from years ago. A news report can carry a figure the official document doesn't contain. When that happens, the page shows both versions, says which one is more recent or closer to the fact, and bases the verdict on that one.
Whether Session has forward secrecy is the clearest case on the site. The answer depends on whether you read the shared library or the app you can install, and the page separates the two.
Dates, and when a pick changes
A verdict is true as of the documents behind it. Pages that rely on a version number, an audit or a usage figure give the date it was checked, and dated events such as audits, subpoenas and ownership changes carry their own dates in the sentence.
A pick changes when the evidence does:
- a new audit, or an old one that turns out to have covered less than claimed;
- a court order or subpoena response that shows what the provider actually holds;
- a sale or change of ownership, which can move the company under different courts while the brand name stays the same;
- a feature that ships, or one that is quietly dropped.
If you find one of those before the page reflects it, send the document through the contact page. A newer audit report or court filing is exactly what moves a verdict. No pick is paid for, and the about page says who the site is independent of.