The best privacy tools in 2026: one pick for each job, and the evidence behind it

What to install first

The order matters more than the brands. If you only do three things this week, do them in this order:

1. A password manager, and a unique password for every account. For most people, a reused password is a bigger and more immediate risk than surveillance, because one leak opens every account that shares it. It's dull, and it's the most important step.
2. Signal for the conversations that matter. Ask the two or three people you talk to most to install it. A private messenger is no use if nobody you know uses it.
3. A better browser and search engine. This takes ten minutes, and it cuts down the tracking that follows you from site to site.

A VPN and a new email address come after these. Both are worth having, but both take longer to move to, and neither helps much if you're still using the same password everywhere.

Passwords: Bitwarden or KeePassXC

Bitwarden is the pick for most people. It syncs across every device you own, the free plan does what most people need, and its security record is unusually public. Cure53 audited it in 2018, and has done source-code audits every year from 2021 to 2025. In 2025, the Applied Cryptography Group at ETH Zurich audited its core cryptography on the assumption that Bitwarden's own server was fully malicious. That's the right question to ask of any cloud password manager: what happens if the company itself turns against you?

Bitwarden's code is published under the AGPL and the Bitwarden License. If you'd rather not trust its cloud, you can run your own server. Bitwarden Lite is a single Docker container meant for personal use. Premium costs $19.80 a year, and you don't need it to get started.

KeePassXC is for people who want nothing in the cloud. Your passwords live in one encrypted file on your own disk, and no data is stored on remote servers. You can sync that file yourself if you want to. An independent audit of version 2.7.4, completed in January 2023, found "no major problems". Version 2.7.9 later received a security Visa from ANSSI, France's national cybersecurity agency. The cost is convenience. There's no automatic sync, and if you lose the file and have no backup, the passwords are gone.

Choose Bitwarden if

you use a phone and a computer and want your passwords on both without thinking about it.

Choose KeePassXC if

you mainly work on one computer, you already keep backups, or your threat model rules out any third-party server.

Messaging: Signal, and when to look further

Signal is the default for a reason you can check. In 2016 a US federal court subpoenaed it, and all Signal could produce was the date and time an account registered and the last date it connected. Its 2026 response to a grand jury subpoena says the same thing more broadly: messages, contacts, groups and call logs are data it never had.

The weak spot is the phone number. Signal still needs one to register, but you can set a username so your contacts don't see the number. If you can't give a number at all, or you need a messenger that works on desktop without a phone, there are real alternatives with different trade-offs. Our secure messenger comparison sets Signal against Session, SimpleX, Threema, Matrix and others, desktop clients included.

Email: Proton Mail or Tuta

Both encrypt your stored mail so the company can't read it. They differ in how far the encryption goes, and in which country's courts can order them to do something.

The legal record is where they really differ, and both companies publish it.

Proton can be ordered by a Swiss court to start logging a particular account. In 2021, Proton received a legally binding order from Swiss authorities in the case of a French climate activist, with "no possibility to appeal". In its own words, a company like Proton "can be legally compelled to log your IP address" if you're under Swiss criminal investigation. No messages were handed over, because Proton couldn't decrypt them. In 2025 Proton received 9,301 legal orders, contested 988 and complied with 8,313. Swiss law forbids it from giving data directly to foreign authorities. Proton's advice is the useful part: reach it through its onion site if your privacy needs are high, so there's no real IP for anyone to log.

Tuta operates under a similar rule in Germany. After a valid German court order for real-time monitoring, unencrypted emails that arrive from then on can be delivered in plain text, and IP addresses can be recorded for that one account. Mail already stored, and mail sent end-to-end encrypted between Tuta users, stays unreadable. Tuta doesn't record IP addresses by default. Between January and June 2026 it received 12 requests for real-time content and released data in 6.

Our pick is Proton for most people, because PGP works with the rest of the world and the onion address solves the IP problem for anyone who needs it to. Choose Tuta if you want your subject lines, calendar and contacts covered too, and you rarely send encrypted mail to people who use other providers. Tuta has also been rolling out post-quantum encryption to its accounts since March 2024, which protects stored mail against future decryption.

VPN: which one you can trust, and what the proof is

Mullvad is the VPN to pay for. Privacy Guides recommends three providers and tells you not to trust a no-logs sentence on its own: Mullvad, Proton VPN and IVPN. Mullvad is the one that collects the least at signup, charges one price, and has already had the police in the office.

Swedish police's National Operations Department searched the Gothenburg office on 18 April 2023. At least six officers had a warrant for computers holding customer data. They left with nothing, and Mullvad says it was the first search of the office in more than 14 years. An account is a generated number and the time left on it. There is no email and no username, and the policy says traffic, DNS requests, connection times, IP addresses and bandwidth are not stored against that number.

The outside review is narrower than the word "audited" suggests. In October 2025 X41 D-Sec read the API and the backend that handles payments, devices and WireGuard keys. Five vulnerabilities, none critical or high. The relays, in that report, hold a list of allowed keys and do not know which account a key belongs to. That is evidence about the account system. It is not someone inspecting the live VPN servers for log files. €5 a month, the figure Mullvad says it has charged since 2009, including if you pay cash or Monero.

Proton VPN is the free plan from a company with a longer paper trail on the servers themselves. Securitum has reviewed the infrastructure every year, and 2026 was the fifth year. Proton's transparency report shows 59 VPN orders in 2025 and 59 denials. You sign up with an email address, which Mullvad never asks for. IVPN is the third: Gibraltar, no email at signup, cash and Monero, owned by its founder. Less has been published about a warrant.

What each audit left out, the free plan's limits, and why the ads lead with NordVPN: the best VPN for privacy. A VPN moves trust from your internet provider to the VPN company. It does not make you anonymous. Tor vs VPN is who can see you if you combine them. A Mullvad co-founder's donation in 2026, and the Tor Project's answer, is separate from the warrant: the news note says what changed.

Browser: everyday private browsing, and when to use Tor Browser

Mullvad Browser is the most private everyday browser you can install. Mullvad describes it as "developed together with the Tor Project", which you could call "a Tor Browser without the Tor Network". It's built so that all its users look alike, which defeats fingerprinting, the tracking that identifies you by your browser's settings rather than by cookies. You don't need Mullvad's VPN to use it, but it works best with a VPN, because then you also share IP addresses with other users.

For a browser you keep logged in to your accounts, Privacy Guides recommends Brave if you need Chromium compatibility and Firefox if you want a familiar alternative to Chrome. Both have usage reporting you can switch off. Brave lets you switch off its product analytics in Settings, and Firefox lets you untick "Allow Firefox to send technical and interaction data to Mozilla". Do it on day one. On Firefox, also add uBlock Origin. It's the one extension Privacy Guides recommends for blocking trackers and ads, and Mullvad Browser already ships with it built in.

Phones are more limited. Mullvad Browser is desktop only: Linux, macOS and Windows. On Android, Brave is the everyday choice and Tor Browser the anonymous one. On an iPhone, Apple makes every browser use its own engine, so Privacy Guides recommends Safari itself with a content blocker, plus Onion Browser when you need Tor. Onion Browser doesn't get Tor Browser's full protections on iOS, as our Tor Browser guide explains.

None of these is anonymous. "If you need to browse the internet anonymously, you should use Tor instead." If your real name, location or source must stay out of it, use Tor Browser. Our Tor Browser guide covers installing and verifying it properly.

Search and DNS: which search engine has its own index

Two of the three private search engines Privacy Guides recommends take most of their results from Bing or Google. That's fine for privacy, since each anonymises your search, but it means the same results with a different logo. Of the engines Privacy Guides recommends, only Brave Search is listed with an independent index. DuckDuckGo runs its own crawler but says its traditional links "largely" come from Bing. Startpage takes its results from Google and Bing.

Brave Search is our pick because it's the one that doesn't depend on Big Tech's index. For thin results, Brave offers an optional fallback that checks Google anonymously, and you can leave it off. If you prefer DuckDuckGo's results, it's a perfectly good choice. It logs searches to improve the product, but not your IP address.

DNS is the less visible half. Every site you visit starts with a DNS lookup, and by default your ISP sees all of them. Quad9 is a non-profit run from Zürich that does not collect or record user IP addresses and holds them in memory only for the milliseconds it takes to answer. Plain 9.9.9.9 is unencrypted, so your ISP can still watch the lookups. Quad9 offers DNS over HTTPS at https://dns.quad9.net/dns-query and DNS over TLS at dns.quad9.net. Put one of those in your browser's secure-DNS setting or in a router that supports it. Mullvad runs a public DNS resolver as well, and its policy says it doesn't log DNS requests in any way.

Operating systems: phones and computers

On a phone, the biggest step is GrapheneOS, and only on a Pixel. Locked and updated, it is the OS Cellebrite's own support sheets list as not exploitable. It recommends a Pixel 8 or newer, it does not include Google Play as part of the system, and it still runs ordinary Android apps. The sheets, the limits, and which model to buy are on the GrapheneOS page. If you will not reinstall a phone, a current iPhone or Pixel with updates on is the realistic baseline.

On a computer, the question is what you're defending against. For a machine you can't trust, or a session that must leave no trace, Tails runs from a USB stick. For keeping a separate identity isolated from your real one, Whonix or Qubes is the tool. Our Tails vs Whonix comparison matches each one to a situation.

Are free privacy tools good enough?

For most of this list, yes, and free is not a downgrade. Bitwarden's free plan covers passwords on your apps and devices. Signal, Mullvad Browser, Brave, Firefox, KeePassXC and Quad9 cost nothing. Proton says its free email accounts have the same encryption as its paid plans. KeePassXC has no paid tier at all. Its own pitch is "No cloud, no ads, no subscriptions."

The VPN is the exception. Running VPN servers costs money, so a free VPN is paid for by something: your data, ads, or a paid tier that subsidises it. Proton VPN's free tier is the clear case of the third. It allows one device, on servers in ten countries the app chooses for you. Proton says the no-logs policy applies equally on every plan. What the yearly audit actually looked at is on the VPN page. If a free VPN can't tell you which of those three is paying for it, assume it's your data.

Who owns these companies, and does it matter?

It matters because ownership decides which courts can give orders and who can change the product. The Proton and Tuta cases above show the mechanism: each was ordered by its own country's courts, under its own country's law.

• Proton AG, Swiss, behind Proton Mail and Proton VPN. Proton says Swiss law currently puts no logging requirement on its VPN.
• Mullvad VPN AB, Swedish, based in Gothenburg. Swedish accounting law makes it keep some card and bank payment records for seven years. Pay in cash or crypto if that bothers you.
• Tuta, German, with its own servers in Germany.
• KeePassXC is open source under GPLv3, and your file lives with you. There's no account on anyone's server for a court to order handed over.

A sale is the thing to watch for, because the brand name usually stays the same after one. ExpressVPN, for example, officially joined Kape Technologies in December 2021, while saying it would keep running as a separate service under British Virgin Islands jurisdiction. That's not proof of anything wrong. It does mean "who owns this now?" is worth checking every year or two for the tools you rely on.

How these were picked, and whether anyone pays for them

Nobody pays for a place on this page, and none of the links earn us anything. Each pick rests on evidence a reader can open: an audit report, a court or police record, a licence, a provider's own published policy. Where that evidence is narrower than the marketing, we say so, as with Mullvad's audit, which covered its account system and not its servers. How tools are scored is set out on our methodology page.

Picks change when the evidence does: a new audit, a court case, a change of owner, a feature that ships or gets dropped.

What no privacy tool can protect you from

Every tool here protects one stretch of the path. None of them protects you from yourself, and none fixes a device that's already compromised.

• Logging in as yourself. A VPN and a private browser hide where you are. The moment you sign in to an account with your real name, the site knows who you are.
• Malware on your device. If your phone or laptop is compromised, the attacker reads your messages before Signal encrypts them and your passwords as Bitwarden fills them in.
• The other person. End-to-end encryption ends at the recipient's screen. A screenshot, a forwarded message or a seized phone on their side is out of your control.
• Metadata you hand over. Your email provider still sees who you write to and when, and Signal still needs a phone number. Payment records name you unless you pay in cash.
• A court in the provider's country. As the Proton and Tuta cases show, a provider can be ordered to start watching one account from now on. Encryption protects what's already stored, not what you do next.

Work out who you're actually hiding from, whether that's advertisers, your ISP, a stalker or a government, and choose tools for that. A stack built for a government-level adversary is exhausting to live with if your real problem is ad tracking.