Recommended tools
Tools we’d actually use, with a plain note on what each is for. Where a free or do-it-yourself route is just as safe, we point to it first.
Passwords & signing in
Spread your eggs across baskets. Keep your email, your password manager, your two-step app and your backups with different companies, so one account being breached cannot reach all of them at once. In particular keep your two-step app separate from your password manager: if both sit behind the same login, a single compromise hands over the password and the code together. Open-source two-step apps like Ente Auth or Aegis keep that second factor in different hands from your vault.
Free, open-source and works everywhere - the easy pick for most people.
Plan: Set up a password manager →Visit site (opens in a new tab)Good if you're already in Proton - but see the note above about keeping your 2-step app separate from your vault.
Plan: Set up a password manager →Visit site (opens in a new tab)Paid and not open-source, but independently audited and very polished - a fair choice if you'll pay for it.
Plan: Set up a password manager →Visit site (opens in a new tab)A physical key - the strongest second factor for the accounts that matter most.
Plan: Add passkeys or a security key →Visit site (opens in a new tab)YubiKey's cheaper sibling: passkeys and 2-step, none of the extras.
Plan: Add passkeys or a security key →Visit site (opens in a new tab)A budget security key - fine for passkeys and 2-step if money's tight.
Plan: Add passkeys or a security key →Visit site (opens in a new tab)An open-source hardware key - the same job as a YubiKey, if you'd rather the design were open to inspection.
Plan: Add passkeys or a security key →Visit site (opens in a new tab)Open-source FIDO2 keys - passkeys and two-step, with open hardware and firmware.
Plan: Add passkeys or a security key →Visit site (opens in a new tab)Free and open-source, on every platform, with an encrypted backup of your codes. A good default, and from a different company than your password manager.
Plan: Turn on two-step sign-in where it matters →Visit site (opens in a new tab)Free and open-source, Android only. A long-standing favourite if you are on Android.
Plan: Turn on two-step sign-in where it matters →Visit site (opens in a new tab)Staying private
German, end-to-end encrypted and open-source, with a free tier. A private mailbox that keeps your email separate from your password manager and VPN.
Visit site (opens in a new tab)Swiss, end-to-end encrypted, no ads; the free tier is plenty to start. If you already use Proton for passwords or VPN, see the note above about not putting everything behind one login.
Visit site (opens in a new tab)Audited, no-logs, has a free tier. Its NetShield blocker also filters trackers and malware at the DNS level while you're connected. A VPN only hides your traffic from the network you're on - it doesn't fix anything else, which is why it isn't a step in your plan. As with Proton Mail, if you already use Proton for email or passwords, see the note above about not putting everything behind one login.
Visit site (opens in a new tab)Flat price, no email or account needed, properly anonymous - the purist's pick. Has built-in DNS blocking of ads, trackers and malware when connected.
Visit site (opens in a new tab)No software does the UK bits well. Do it yourself for free with our guide - it covers the opt-outs a paid overseas service simply can't file for you.
Stopping malware & bouncing back
On backup, the thing that matters most is who holds the key. We lean toward zero-knowledge options - where the backup is encrypted on your own device, so the provider can't read it - over convenience-first services that hold your key for you.
Your device's built-in protection is enough for most people; Malwarebytes' free scan is a handy on-demand second opinion.
Visit site (opens in a new tab)End-to-end encrypted backup and storage - the key stays with you, so Proton can't read your files. Swiss, with open-source apps. The friendly zero-knowledge pick. If you already use Proton for email or passwords, see the note above about not putting everything behind one login.
Plan: Set up backups you've actually tested →Visit site (opens in a new tab)Open-source backup built into most Linux desktops - scheduled, encrypted and simple. The easy pick if you're on Linux.
Plan: Set up backups you've actually tested →Visit site (opens in a new tab)Open-source, zero-knowledge backup: it encrypts on your own machine before anything leaves, then stores to cheap space like rsync.net or Backblaze B2. Command-line - for the technical and the high-risk.
Plan: Set up backups you've actually tested →Visit site (opens in a new tab)Blocks trackers and malicious domains at the DNS level, with a generous free tier. Most useful when you're not on a VPN, or to cover your whole home at the router - if you're always on Proton VPN (NetShield) or Mullvad's blocker, you already have this.
Visit site (opens in a new tab)Free and open-source - the single best thing to add to your browser.
Visit site (opens in a new tab)Email & domain safety
Optional. The SPF/DKIM/DMARC setup itself is free and in our guide - your email provider usually walks you through it. EasyDMARC's free tier just lets you read the DMARC reports to see who's trying to send as you.
Plan: Protect your email domain →Visit site (opens in a new tab)A registrar with free WHOIS privacy, keeping your name off the public domain record.
Visit site (opens in a new tab)For small organisations
Staff scam-awareness at scale. The free kernel - a self-test, Have I Been Pwned, a policy template and the habit of reporting - covers most of it for a small team.
Visit site (opens in a new tab)Checking & reporting
Free. Check whether your email has turned up in a breach - a good first move.
Visit site (opens in a new tab)Report to 7726
Forward a scam text to 7726, free of charge.
Counter-surveillance & device hardening
Free and open-source - the default for private messaging.
Visit site (opens in a new tab)Free tripwires by Thinkst: a file or link that quietly pings you if someone opens it.
Visit site (opens in a new tab)Checks a phone for signs of spyware; paid, aimed at higher-risk people.
Visit site (opens in a new tab)Amnesty's spyware forensics - free, advanced, for when there's a real concern.
Visit site (opens in a new tab)Free and open-source - the hardened phone for high-risk users.
Plan: Move to a hardened OS →Visit site (opens in a new tab)A gentler de-Googled Android, if GrapheneOS is a step too far.
Plan: Move to a hardened OS →Visit site (opens in a new tab)A compartmentalised desktop OS - serious kit for high-threat work.
Visit site (opens in a new tab)An amnesic live OS routed through Tor; leaves no trace on the machine.
Visit site (opens in a new tab)A friendly, mainstream Linux if you'd like off Windows or macOS.
Visit site (opens in a new tab)