A curated list of privacy & security-focused apps, software, and providers 🔐

⏬ Skip to Content ⏬

Large data-hungry corporations dominate the digital world but with little, or no respect for your privacy. Migrating to open-source applications with a strong emphasis on security will help stop corporations, governments, and hackers from logging, storing or selling your personal data.

Note: Remember that no software is perfect, and it is important to follow good security practices.

A Codeberg mirror is available here.

• Essentials
  • Password Managers
  • 2-Factor Authentication
  • File Encryption
  • Private Browsers
  • Non-Tracking Search Engines
• Communication
  • Encrypted Messaging
  • P2P Messaging
  • Encrypted Email
  • Email Clients
  • Anonymous Mail Forwarding
  • Email Security Tools
  • VOIP Clients
  • Virtual Phone Numbers
  • Team Collaboration Platforms
• Security Tools
  • Browser Extensions
  • Mobile Apps
  • Online Tools
• Networking
  • Virtual Private Networks
  • Self-Hosted Network Security
  • Mix Networks
  • Proxies
  • DNS Providers
  • DNS Clients
  • Firewalls
  • Ad Blockers
  • Host Block Lists
  • Router Firmware
  • Network Analysis
  • Cloud Hosting
  • Domain Registrars
  • DNS Hosting
  • Pre-Configured Mail-Servers
• Productivity
  • Digital Notes
  • Cloud Productivity Suites
  • Backup and Sync
  • Encrypted Cloud Storage
  • File Drop
  • Browser Sync
  • Secure Conference Calls
• Utilities
  • Virtual Machines
  • PGP Managers
  • Metadata Removal
  • Data Erasers
• Social
  • Social Networks
  • Video Platforms
  • Blogging Platforms
  • News Readers
  • Proxy Sites
• Operating Systems
  • Mobile Operating Systems
  • Desktop Operating Systems
  • Linux Defences
  • Windows Defences
  • Mac OS Defences
  • Anti-Malware
• Development
  • Code Hosting
• Home/ IoT
  • Home Automation
  • Voice Assistants
• Finance
  • Cryptocurrencies
  • Crypto Wallets
  • Crypto Exchanges
  • Virtual Credit Cards
  • Other Payment Methods
  • Secure Budgeting
• Bonus
  • Alternatives to Google
  • Open Source Media Applications
  • Self-Hosted Services
  • Self-Hosted Sys-Admin
  • Self-Hosted Dev Tools
  • Security Testing Tools
  • Raspberry Pi Security Projects

• Personal Security Checklist

Password Safe is an offline, open source password manager designed by Bruce Schneier, with native applications for Windows, Linux, MacOS, Android and iOS, and support for YubiKey. The UI is a little dated, and there is no official browser extension, making is slightly less convenient to use compared with other options

PassBolt is a good option for teams. It is free, open source, self-hosted, extensible and OpenPGP based. It is specifically good for development and DevOps useage, with integrations for the terminal, browser and chat, and can be easily extended for custom usage, and deployed quickly with Docker

1Password (proprietary) is a fully-featured cross-platform password manager with sync. Free for self-hosted data (or $3/ month hosted). Be aware that 1Password is not fully open source, but they do regularly publish results of their independent security audits, and they have a solid reputation for transparently disclosing and fixing vulnerabilities

Other Open Source PM: Buttercup, Clipperz, Pass, Padloc, TeamPass, PSONO, UPM, Gorilla, Seahorse (for GNOME), GNOME Keyring, KDE Wallet Manager.

If you are using a deprecated PM, you should migrate to something actively maintained. This includes: Firefox Lockwise, Encryptr, Mitro, Rattic, JPasswords, Passopolis, KYPS, Factotum.

See also Password Management Checklist

Check which websites support multi-factor authentication: 2fa.directory

OTPClient (Linux), gauth (Self-Hosted, Web-based), Etopa (Android)

For KeePass users, TrayTop is a plugin for managing TOTP's - offline and compatible with Windows, Mac and Linux.

Authy (proprietary) is a popular option among new users, due to its ease of use and device sync capabilities. Cloud sync may be useful, but will also increase attack surface. Authy is not open source, and therefore can not recommended

See also 2FA Security Checklist

AES Crypt is a light-weight and easy file encryption utility. It includes applications for Windows, Mac OS, BSD and Linux, all of which can be interacted with either through the GUI, CLI or programatically though an API (available for Java, C, C# and Python). Although it is well established, with an overall positive reputation, there have been some security issues raised recently.

CryptSetup is a convenient layer for use on top of dm-crypt. EncFS is a cross-platform file-based encryption module, for use within user local directories. geli is a disk encryption subsystem included with FreeBSD.

PGP may be useful for encrypting individual files and folders, preparing files for transmission, or adding an additional layer of security to sensitive data. With PGP, you can encrypt, decrypt, sign and verify files and folders: see PGP Tools

BitLocker is popular among Microsoft Windows and enterprise users, and provides fast, efficient and (if correctly configured) reasonably secure full drive encryption. However it is not open source, has poor compatibility with other operating systems, and has some very dodgy defaults, which could lead to your system being compromised. Similarly, Apple's FileVault on MacOS is easy and secure, but again, the source code is proprietary.

DiskCryptor is a Windows-only, open source, file and volume encryption solution, that makes a good alternative to BitLocker.

If you need to create a compressed archive, then PeaZip is a great little cross-platform open source file archiver utility. It allows you to create, open, and extract RAR TAR ZIP archives. It also has a password-protection feature, which encrypts compressed files using AES-256, which is also compatible with most other archive utilities

Where possible, choose a cross-platform and well established encryption method, so that you are never faced with not being able to access your files using your current system.

Although well-established encryption methods are usually very secure, if the password is not strong, then an adversary may be able to gain access to your files, with a powerful enough GPU. If your system is compromised, then the password may also be able to be skimmed with a keylogger or other similar malware, so take care to follow good basic security practices

Mobile Browsers: Mull Hardened fork of FF-Fenix (Android), Firefox Focus (Android/ iOS), DuckDuckGo Browser (Android/ iOS), Orbot + Tor (Android), Onion Browser (iOS)

Additional Desktop: Nyxt, WaterFox, Epic Privacy Browser, PaleMoon, Iridium, Sea Monkey, Ungoogled-Chromium, Basilisk Browser and IceCat

12Bytes also maintains a list privacy & security extensions

New vulnerabilities are being discovered and patched all the time - use a browser that is being actively maintained, in order to receive these security-critical updates.

Even privacy-respecting browsers, often do not have the best privacy options enabled by default. After installing, check the privacy & security settings, and update the configuration to something that you are comfortable with. 12Bytes maintains a comprehensive guide on Firefox Configuration for Privacy and Performance

See also Browser & Search Security Checklist and recommended Browser Extensions for privacy & security.

Google frequently modifies and manipulates search, and is in pursuit of eliminating competition and promoting their own services above others. They also track, collect, use and sell detailed user search and meta data.

MetaGear, YaCy, Brave Search.

Searx and SearXNG are two self-hostable search engines that use the results of multiple other engines (such as Google and Bing) at the same time. They're open source and self-hostable, although using a public instance has the benefit of not singling out your queries to the engines used.

12Bytes also maintains a list of privacy-respecting search engines

See also Browser & Search Security Checklist

Without using a secure app for instant messaging, all your conversations, meta data and more are unprotected. Signal is one of the best options - it's easy, yet also highly secure and privacy-centric.

Other private, encrypted and open source messaging apps include: Surespot, Chat Secure (iOS only) and Status. Note that Tor Messenger has been removed from the list, since development has halted.

KeyBase allows encrypted real-time chat, group chats, and public and private file sharing. It also has some nice features around cryptographically proving social identities, and makes PGP signing, encrypting and decrypting messages easy. However, since it was acquired by Zoom in 2020, it has no longer been receiving regular updates.

OpenPGP can be used over existing chat networks (such as email or message boards). It provides cryptographic privacy and authentication, PGP is used to encrypt messages.
Note/ Issues with PGP PGP is not easy to use for beginners, and could lead to human error/ mistakes being made, which would be overall much worse than if an alternate, simpler system was used. Do not use 32-bit key IDs - they are too short to be secure. There have also been vulnerabilities found in the OpenPGP and S/MIME, defined in EFAIL, so although it still considered secure for general purpose use, for general chat, it may be better to use an encrypted messaging or email app instead.

Many messaging apps claim to be secure, but if they are not open source, then this cannot be verified - and they should not be trusted. This applies to Telegram, Threema, Cypher, Wickr, Silent Phone and Viber, to name a few - these apps should not be used to communicate any sensitive data. Wire has also been removed, due to a recent acquisition

With Peer-to-Peer networks, there are no central server, so there is nothing that can be raided, shut-down or forced to turn over data. There are P2P networks available that are open source, E2E encrypted, routed through Tor services, totally anonymous and operate without the collection of metadata.

Cwtch, BitMessage, RetroShare, Tor Messenger (deprecated), TorChat2 (deprecated), Ricochet (deprecated)

Email is not secure - your messages can be easily intercepted and read. Corporations scan the content of your mail, to build up a profile of you, either to show you targeted ads or to sell onto third-parties. Through the Prism Program, the government also has full access to your emails (if not end-to-end encrypted) - this applies to Gmail, Outlook Mail, Yahoo Mail, GMX, ZoHo, iCloud, AOL and more.

The below email providers are private, end-to-end encrypted (E2EE) and reasonably secure. This should be used in conjunction with good email practices

See OpenTechFund - Secure Email for more details.

See also Comparison or Private Email Providers and Email Security Checklist

HushMail, Soverin, StartMail, Posteo, Lavabit. For activists and journalists, see Disroot, Autistici, CriptText and RiseUp

• When using an end-to-end encryption technology like OpenPGP, some metadata in the email header will not be encrypted.
• OpenPGP also does not support Forward secrecy, which means if either your or the recipient's private key is ever stolen, all previous messages encrypted with it will be exposed. You should take great care to keep your private keys safe.

If you do not want to trust an email provider with your messages, you can host your own mail server. Without experience, this can be notoriously hard to correctly configure, especially when it comes to security. You may also find that cost, performance and features make it a less attractive option. If you do decide to go down this route, Mail-in-a-box, is an easy to deploy, open source mail server. It aims to promote decentralization, innovation, and privacy on the web, as well as have automated, auditable, and idempotent system configuration. Other ready-to-go self-hosted mail options include Mailu and Mail Cow, both of which are docker containers.

Email clients are the programs used to interact with the mail server. For hosted email, then the web and mobile clients provided by your email service are usually adequate, and may be the most secure option. For self-hosted email, you will need to install and configure mail clients for web, desktop or mobile. A benefit of using an IMAP client, is that you will always have an offline backup of all email messages (which can then be encrypted and archived), and many applications let you aggregate multiple mailboxes for convenience. Desktop mail clients are not vulnerable to the common browser attacks, that their web app counterparts are.

One disadvantage of mail clients, is that many of them do not support 2FA, so it is important to keep your device secured and encrypted

Revealing your real email address online can put you at risk. Email aliasing allows messages to be sent to [anything]@my-domain.com and still land in your primary inbox. This protects your real email address from being revealed. Aliases are generated automatically, the first time they are used. This approach lets you identify which provider leaked your email address, and block an alias with 1-click.

Alternatively you could host your own catch-all email service. Mailu can be configured to accept wildcards, or for Microsoft Exchange see exchange-catchall

mailhero.io is a smaller service, it does not have built-in encryption, so you will need to use PGP, but it is free.

If you are using ProtonMail, then the ProtonMail Bridge enables you to sync your emails to your own desktop mail client. It works well with Thunderbird, Microsoft Outlook and others

SpoofCard lets you make anonymous phone calls + voicemail, but not open source and limited information on security (avoid sending any secure info). MicroSip is an open source portable SIP softphone for Windows based on PJSIP stack

Now more than ever we are relying on software to help with team collaboration. Unfortunately many popular options, such as Slack, Microsoft Teams, Google for Work and Discord all come with some serious privacy implications.

Typical features of team collaboration software includes: instant messaging, closed and open group messaging, voice and video conference calling, file sharing/ file drop, and some level or scheduling functionality.

Some chat platforms allow for cross-platform group chats, voice and video conferencing, but without the additional collaboration features. For example, Tox, Session, Ricochet, Mumble and Jami.

For Conferences, OSEM is an open source all-in-one conference management tool, providing Registration, Schedules, Live and Recorded Sessions, Paper Submissions, Marketing Pages and Administration.

The following browser add-ons give you better control over what content is able to be loaded and executed while your browsing.

Extension source viewer is a handy extension for viewing the source code of another browser extension, which is a useful tool for verifying the code does what it says

• Having many extensions installed raises entropy, causing your fingerprint to be more unique, hence making tracking easier.
• Much of the functionality of the above addons can be applied without installing anything, by configuring browser settings yourself. For Firefox this is done in the user.js
• Be careful when installing unfamiliar browser add-ons, since some can compromise your security and privacy. At the time of writing, the above list were all open source, verified and 'safe' extensions.
• In most situations, only a few of the above extensions will be needed in combination.
• See the arkenfox wiki for more information on the obsolescence and purposelessness of many popular extensions, and why you may only need a very limited set.

See also Browser & Search Security Checklist

Too many installed apps will increase your attack surface - only install applications that you need

For more open source security & privacy apps, check out these publishers: The Guardian Project, The Tor Project, Oasis Feng, Marcel Bokhorst, SECUSO Research Group and Simple Mobile Tools- all of which are trusted developers or organisations, who've done amazing work.

For offensive and defensive security, see The Kali Nethunter Catalogue of apps

For advanced users, the following tools can be used to closely monitor your devise and networks, in order to detect any unusual activity. PortDroid for network analysis, Packet Capture to monitor network traffic, SysLog for viewing system logs, Dexplorer to read .dex or .apk files for your installed apps, and Check and Test to check status and details of devices hardware.

See also Mobile Security Checklist

A selection of free online tools and utilities, to check, test and protect

Browsers are inherently insecure, be careful when uploading, or entering personal details.

VPNs are good for getting round censorship, increasing protection on public WiFi, obscuring your IP address, and reducing what data your ISP can log. But for the best anonymity, you should use Tor. VPNs do not mean you are magically protected, or anonymous (see below).

• A VPN does not make you anonymous - it merely changes your public IP address to that of your VPN provider, instead of your ISP. Your browsing session can still be linked back to your real identity either through your system details (such as user agent, screen resolution even typing patterns), cookies / session storage, or by the identifiable data that you enter. Read more about fingerprinting
• Logging - If you choose to use a VPN because you do not agree with your ISP logging your full browsing history, then it is important to keep in mind that your VPN provider can see (and mess with) all your traffic. Many VPNs claim not to keep logs, but you cannot be certain of this (VPN leaks). See this article for more
• IP Leaks - If configured incorrectly, your IP may be exposed through a DNS leak. This usually happens when your system is unknowingly accessing default DNS servers rather than the anonymous DNS servers assigned by an anonymity network or VPN. Read more: What is a DNS leak, DNS Leak Test, How to Fix a DNS Leak
• Stealth - It will be visible to your adversary that you are using a VPN (usually from the IP address), but other system and browser data, can still reveal information about you and your device (such as your local time-zone, indicating which region you are operating from)
• Many reviews are sponsored, and hence biased. Do your own research, or go with one of the above options
• Using Tor (or another Mix Network) may be a better option for anonimity

While choosing a VPN, consider the following: Logging policy (logs are bad), Jurisdiction (avoid 5-eyes), Number of servers, availability and average load. Payment method (anonymous methods such as BTC, Monero or cash are better), Leak protection (1st-party DNS servers = good, and check if IPv6 is supported), protocols (OpenVPN and WireGuard = good). Finally, usability of their apps, user reviews and download speeds.

If you don't trust a VPN provider not to keep logs, then you could self-host your own VPN. This gives you you total control, but at the cost of anonymity (since your cloud provider, will require your billing info). See Streisand, to learn more, and get started with running a VPN. Digital Ocean provides flexible, secure and easy Linux VMs, (from $0.007/hour or $5/month), this guide explains how to set up VPN on: CentOS 7 or Ubuntu 18.4+. See more about configuring OpenVPN or IKEv2. Alternatively, here is a 1-click install scriptfor on Digital Ocean, by Carl Friess.

Recently distributed self-hosted solutions for running your own VPNs have become more popular, with services like Outline letting you spin up your own instance and share it with friends and family. Since it's distributed, it is very resistant to blocking, and gives you world-wide access to the free and open internet. And since you have full control over the server, you can be confident that there is no logging or monitoring happening. However it comes at the cost of anonymity, especially if it's only you using your instance.

Fun little projects that you can run on a Raspberry Pi, or other low-powered computer. In order to help detect and prevent threats, monitor network and filter content

Don't want to build? See also: Pre-configured security boxes

Mix networks are routing protocols, that create hard-to-trace communications, by encrypting and routing traffic through a series of nodes. They help keep you anonymous online, and unlike VPNs -there are no logs

Tor, I2P and Freenet are all anonymity networks - but they work very differently and each is good for specific purposes. So a good and viable solution would be to use all of them, for different tasks. You can read more about how I2P compares to Tor, here

See also: GNUnet, IPFS, ZeroNet, Panoramix, and Nym

To provide low-latency browsing, Tor does not mix packets or generate cover traffic. If an adversary is powerful enough, theoretically they could either observe the entire network, or just the victims entry and exit nodes. It's worth mentioning, that even though your ISP can not see what you are doing, they will be able determine that you are using a mix net, to hide this - a VPN could be used as well. If you are doing anything which could put you at risk, then good OpSec is essential, as the authorities have traced criminals through the Tor network before, and made arrests. Don't let Tor provide you a false sense of security - be aware of information leaks through DNS, other programs or human error. Tor-supported browsers may might lag behind their upstream forks, and include exploitable unpatched issues. See #19

Note: The Tor network is run by the community. If you benefit from using it and would like to help sustain uncensored internet access for all, consider running a Tor relay

A proxy acts as a gateway between you and the internet, it can be used to act as a firewall or web filter, improves privacy and can also be used to provide shared network connections and cache data to speed up common requests. Never use a free proxy.

V2ray-core is a platform for building proxies to bypass network restrictions and protect your privacy. See more

Malicious Proxies are all too common. Always use open source software, host it yourself or pay for a reputable cloud service. Never use a free proxy; it can monitor your connection, steal cookies and contain malware. VPNs are a better option, better still - use the Tor network.

Without using a secure, privacy-centric DNS all your web requests can be seen in the clear. You should configure your DNS queries to be managed by a service that respects privacy and supports DNS-over-TLS, DNS-over-HTTPS or DNSCrypt.

See also this Full List of Public DoH Servers, you can then check the performance of your chosen server with DNSPerf. ). To read more about choosing secure DNS servers, see [this article](https://medium.com/@nykolas.z/dns-security-and-privacy-choosing-the-right-provider-61fc6d54b986.

• Quad9 is a well-funded, performant DNS with a strong focus on privacy and security and easy set-up, however questions have been raised about the motivation of some of the financial backers.
• BlahDNS (Japan, Finland or Germany) is an excellent security-focused DNS
• OpenNIC, NixNet DNS and UncensoredDNS are open source and democratic, privacy-focused DNS
• Unbound is a validating, recursive, caching DNS resolver, designed to be fast and lean. Incorporates modern features and based on open standards
• Clean Browsing, is a good option for protecting kids, they offer comprehensive DNS-based Content Filtering
• Mullvad Mullvads public DNS with QNAME minimization and basic ad blocking. It has been audited by the security experts at Assured. You can use this privacy-enhancing service even if you don’t use Mullvad.

Using an encrypted DNS resolver will not make you anonymous, it just makes it harder for third-partied to discover your domain history. If you are using a VPN, take a DNS leak test, to ensure that some requests are not being exposed.

DNS-over-TLS was proposed in RTC-7858 by the IETF, then 2 years later, the DNS-over-HTTPS specification was outlined in RFC8484 in October '18. DNSCrypt, is a protocol that authenticates communications between a DNS client and a DNS resolver. It prevents DNS spoofing, through using cryptographic signatures to verify that responses originate from the chosen DNS resolver, and haven’t been tampered with. DNSCrypt is a well battle-tested protocol, that has been in use since 2013, and is still widely used.

A firewall is a program which monitors the incoming and outgoing traffic on your network, and blocks requests based on rules set during its configuration. Properly configured, a firewall can help protect against attempts to remotely access your computer, as well as control which applications can access which IPs.

There are different types of firewalls, that are used in different circumstances. This does not omit the need to configure your operating systems defences. Follow these instructions to enable your firewall in Windows, Mac OS, Ubuntu and other Linux distros. Even when properly configured, having a firewall enabled does not guarantee bad network traffic can not get through and especially during boot if you don't have root privileges.

There are a few different ways to block ads - browser-based ad-blockers, router-based / device blockers or VPN ad-blockers. Typically they work by taking a maintained list of hosts, and filtering each domain/ IP through it. Some also have other methods to detect certain content based on pattern matching

AdGuardHome is a cross-platform DNS Ad Blocker, similar to Pi Hole, but with some additional features, like parental controls, per-device configuration and the option to force safe search. This may be a good solution for families with young children.

Some VPNs have ad-tracking blocking features, such as TrackStop with PerfectPrivacy. Private Internet Access, CyberGhost, PureVPN, and NordVPN also have ad-block features.

Installing a custom firmware on your Wi-Fi router gives you greater control over security, privacy and performance

Tomato, Gargoyle, LibreCMC and DebWRT

Flashing custom firmware may void your warranty. If power is interrupted mid-way through a firmware install/ upgrade it is possible for your device to become bricked. So long as you follow a guide, and use a well supported system, on a supported router, than it should be safe

Whether you live in a country behind a firewall, or accessing the internet through a proxy - these tools will help you better understand the extent of blocking, deep packet inspection and what data is being analysed

An IDS is an application that monitors a network or computer system for malicious activity or policy violations, and notifies you of any unusual or unexpected events. If you are running a server, then it's essential to know about an incident as soon as possible, in order to minimize damage.

Whether you are hosting a website and want to keep your users data safe, or if you are hosting your own file backup, cloud productivity suite or VP - then choosing a provider that respects your privacy and allows you to sign up anonymously, and will keep your files and data safe is be important.

See also: 1984 based in Iceland. Shinjiru, which offers off-shore dedicated servers. Orange Website specialises in protecting online privacy and free speech, hosted in Iceland. RackBone (previously DataCell) provides secure and ethical hosting, based in Switzerland. And Bahnhof offers high-security and ethical hosting, with their data centres locates in Sweden. Finally Simafri has a range of packages, that support Tor out of the box

The country that your data is hosted in, will be subject to local laws and regulations. It is therefore important to avoid a jurisdiction that is part of the 5 eyes (Australia, Canada, New Zealand, US and UK) and other international cooperatives who have legal right to view your data.

Self-hosting your own mail server is not recommended for everyone, it can be time consuming to setup and maintain and securing it correctly is critical

If you are already tied into Evernote, One Note etc, then SafeRoom is a utility that encrypts your entire notebook, before it is uploaded to the cloud.

Org Mode is a mode for GNU Emacs dedicated to working with the Org markup format. Org can be thought of as a more featureful Markdown alternative, with support for keeping notes, maintaining todo lists, planning projects, managing spreadsheets, and authoring documents -all in plaintext.

For a simple plain text note taking app, with strong encryption, see Protected Text, which works well with the Safe Notes Android app. Laverna is a cross-platform secure notes app, where all entries are formatted with markdown.

Alternatively, consider a headless utility such as Duplicacy or Duplicity. Both of offer an encrypted and efficient sync between 2 or more locations, using the rsync algorithm.

SpiderOak, Tresorit and Resilio are good enterprise solutions, all with solid encryption baked-in

FileRun and Pydio are self-hosted file explorers, with cross-platform sync capabilities.

You should always ensure that any data stored in the cloud is encrypted. If you are hosting your own server, then take the necessary precautions to secure the server. For hosted solutions - use a strong password, keep your credentials safe and enable 2FA.

Backing up important files is essential, and keeping an off-site copy is recommended. But many free providers do not respect your privacy, and are not secure enough for sensitive documents. Avoid free mainstream providers, such as Google Drive, cloud, Microsoft Overdrive, Dropbox.

It is recommended to encrypt files on your client machine, before syncing to the cloud. Cryptomator is a cross-platform, open source encryption app, designed for just this.

An alternative option, is to use a cloud computing provider, and implement the syncing functionality yourself, and encrypt data locally before uploading it - this may work out cheaper in some situations. You could also run a local server that you physically own at a secondary location, that would mitigate the need to trust a third party cloud provider. Note that some knowledge in securing networks is required.

See Also:

• File Encryption Software
• File Sync Software
• Cloud Hosting Providers

Instant.io, is another peer-to-peer based solution, using Web Torrent. For specifically transferring images, Up1 is a good self-hosted option, with client-side encryption. Finally PsiTransfer is a feature-rich, self-hosted file drop, using streams.

It is not advised to sign into your browser, since it allows for more of your browsing data to be exposed, and can tie anonymous identities to your real account. If you require your bookmarks to be synced across devices or browsers then these tools can help, without you having to rely on an untrustworthy third-party.

Ymarks is a C-based self-hosted bookmark synchronization server and Chrome extension. syncmarx uses your cloud storage to sync bookmarks (Chrome and Firefox). NextCloud Bookmarks has several community browser extensions, inducing FreedomMarks (Firefox) and OwnCloud Bookmarks (Chrome). Finally, Turtl Notes has excellent link saving functionality built-in

RainDrop is a fully-featured all-in-1 bookmarking and web-snip suite. It has a beautiful UI, good data controls and some very handy integrations and features. Available on desktop, mobile, web and through a browser extension. The catch is that it is not open source, there is a free and premium plan, but no option for self-hosting.

Strip out unneeded GET parameters if they reveal any device or referrer information, so as to not inadvertently allow a website to link your devices. ClearURLs may help with this.

With the many, many security issues with Zoom, and other mainstream options, it becomes clear that a better, more private and secure alternative is required. As with other categories, the "best video calling app" will be different for each of us, depending on the ratio of performance + features to security + privacy required in your situation.

Apache OpenMeetings provides self-hosted video-conferencing, chat rooms, file server and tools for meetings. together.brave.com is Brave's Jitsi Fork. For remote learning, BigBlueButton is self-hosted conference call software, aimed specifically at schools and Universities. It allows for the host/ teacher to have full control over the session, and provides high-quality video streaming, multi-user whiteboards, breakout rooms, and instant chat. For 1-to-1 mobile video calls, see Encrypted Messaging, and for P2P single and group calls, see P2P Messaging.

Tools for signing, verifying, encrypting and decrypting text and files using GnuPG standard

Exif/ Metadata is "data about data", this additional information attached to files can lead us to share significantly more information than we intended to. For example, if you upload an image of a sunset to the internet, but don't remove the metadata, it may reveal the location (GPS lat + long) of where it was taken, the device is was taken on, precise camera data, details about modifications and the picture source + author. Social networks that remove metadata from your photos, often collect and store it, for their own use. This could obviously pose a security risk, and that is why it is recommended to strip out this data from a file before sharing.

It's possible (but slower) to do this without a third-party tool. For Windows, right click on a file, and go to: Properties --> Details --> Remove Properties --> Remove from this File --> Select All --> OK.

Alternatively, with ImageMagic installed, just run convert -strip path/to/image.png to remove all metadata. If you have GIMP installed, then just go to File --> Export As --> Export --> Advanced Options --> Uncheck the "Save EXIF data" option.

Often you need to perform meta data removal programmatically, as part of a script or automation process.
GoLang: go-exif by @dsoprea | JS: exifr by @MikeKovarik | Python: Piexif by @hMatoba | Ruby: Exif by @tonytonyjan | PHP: Pel by @mgeisler.

Simply deleting data, does not remove it from the disk, and recovering deleted files is a simple task. Therefore, to protect your privacy, you should erase/ overwrite data from the disk, before you destroy, sell or give away a hard drive.

There's no need to use a third-party tool. You can boot into a UNIX-based system, mount the disk you need to erase, and use a command to write it with arbitrary data. For best results, this process should be repeated several times. This is a good way to wipe a disk, before selling or destroying it, to protect your data.

Such as the dd command, is a tool to convert and copy files, but running sudo dd if=/dev/zero of=/dev/sdX bs=1M will quickly overwrite the whole disk with zeros. Or badblocks which is intended to search for all bad blocks, but can also be used to write zeros to a disk, by running sudo badblocks -wsv /dev/sdd. An effective method of erasing an SSD, it to use hdparm to issue a secure erase command, to your target storage device, for this, see step-by-step instructions via: wiki.kernel.org. Finally, [srm](https://www.systutorials.com/docs/linux/man/1-srm/) can be use to securely remove files or directories, just run srm -zsv /path/to/file for a single pass over.

A virtual machine (VM) is a sandboxed operating system, running within your current system. Useful for compartmentalisation and safely testing software, or handling potentially malicious files

QEMU is a virtual hardware emulation tool, meaning it is less appropriate for creating fully independant sandboxes, but performance is considerable better than that of a traditional virtual machine.

VMWare is popular in the enterprise world, it is not open source, and although there is a free version, a license is required to access all features. VMWare performs very well when running on a server, with hundreds of hosts and users. For Mac users, Parallels is a popular option which performs really well, but again is not open source. For Windows users, there's Hyper-V, which is a native Windows product, developed by Microsoft.

Over the past decade, social networks have revolutionized the way we communicate and bought the world closer together - but it came at the cost of our privacy. Social networks are built on the principle of sharing - but you, the user should be able to choose with whom you share what, and that is what the following sites aim to do.

• diaspora*, Pleroma, Friendica and Hubzilla - distributed, decentralized social networks, built on open protocols
• Tildes, Lemmy and notabug.io - bulletin boards and news aggregators (similar to Reddit)
• Pixelfed - A free, ethical, federated photo sharing platform (FOSS alternative to Instagram)

The content on many of these smaller sites tends to be more niche. To continue using Twitter, there are a couple of tweaks, that will improve security. For Reddit, use a privacy-respecting client - such as Reditr. Other main-stream social networking sites do not respect your privacy, so should be avoided, but if you choose to keep using them see this guide for tips on protecting your privacy

Without moderation, some of these platforms accommodate video creators whose content may not be appropriate for all audiences

The content on many of the smaller video sites, often just doesn't compare to YouTube. So another alternative, is to access YouTube through a proxy client, which reduces what Google can track.

• Good options are: Invidious (web), Piped (web), FreeTube (Windows, Mac OS, Linux), NewPipe (Android), YouTube++ (iOS)
• Or download videos with youtube-dl (cli) or youtube-dl-gui (gui). For just audio, there is PodSync

Petey Vid is a non-biased video search engine. Unlike normal search engines it indexes videos from a lot of sources, including Twitter, Veoh, Instagram, Twitch, MetaCafe, Minds, BitChute, Brighteon, D-Tube, PeerTube, and many others.

If you use Standard Notes, then Listed.to is a public blogging platform with strong privacy features. It lets you publish posts directly through the Standard Notes app or web interface. Other minimalistic platforms include Notepin.co and Pen.io.

Want to write a simple text post and promote it yourself? Check out telegra.ph, txt.fyi and NotePin. For seriously anonymous platforms, aimed at activists, see noblogs and autistici. It is also possible to host a normal WordPress site, without it being linked to your real identity, although WP does not have the best reputation when it comes to privacy.

Of course you could also host your blog on your own server, using a standard open source blog platform, such as Ghost and configure it to disable all trackers, ads and analytics.

For iPhone users in the US, Tonic is a great little app that provides you with a selection of personalized new stories and articles daily. It is possible to use Reddit anonymously too - you can use throwaway accounts for posting.

News reader apps don't have a good reputation when it comes to protecting users privacy, and often display biased content. Many have revenue models based on making recommendations, with the aim of trying to get you to click on sponsored articles - and for that a lot of data needs to have been collected about you, your habits, interests and routines.

These are websites that enable you to access existing social media platforms, without using their primary website - with the aim of improving privacy & security and providing better user experience. The below options are open source (so can be self-hosted, if you wish), and they do not display ads or tracking (unless otherwise stated).

• NewPipe is an open source, privacy-respecting YouTube client for Android.
• FreeTube an open source YouTube client for Windows, MacOS and Linux, providing a more private experience, with a native-feel desktop app. It is built upon the Invidious API.

When proxies are involved - only use reputable services, and never enter any personal information

It is still possible to use currencies that have a public ledger 'privately', but you will need to take great care not to cause any transactions to be linked with your identity or activity. For example, avoid exchanges that require KYC, and consider using a service such as Local Bitcoins. If you use a Bitcoin ATM, then take care to not be physically tracked (CCTV, phone location, card payments etc)

Other privacy-focused cryptocurrencies include: PIVX, Bitcoin Private, Verge, and Piratechain.

Not all cryptocurrencies are anonymous, and without using a privacy-focused coin, a record of your transaction will live on a publicly available distributed ledger, forever. If you send of receive multiple payments, ensure you switch up addresses or use a mixer, to make it harder for anyone trying to trace your transactions. Cryptocurrencies that allow private and public transactions may reveal meta data about your transactions and balances when funds are moving from private to public addresses which can compromise your privacy with methods similar to a knapsack problem. Store private keys somewhere safe, but offline and preferably cold.

Note: Cryptocurrency prices can go down. Storing any wealth in crypto may result in losses. If you are new to digital currencies - do your research first, don't invest more than you can afford, and be very weary of scams and cryptocurrency-related malware.

Avoid using any online/ hot-wallet, as you will have no control over the security of your private keys. Offline paper wallets are very secure, but ensure you store it properly - to keep it safe from theft, loss or damage.

Metamask (Ethereum and ERC20 tokens) is a bridge that allows you to visit and interact with distributed web apps in your browser. Metamask has good hardware wallet support, so you can use it to swap, stake, sign, lend and interact with dapps without you're private key ever leaving your device. However the very nature of being a browser-based app means that you need to stay vigilant with what services you give access to.

For traders, BaseFEX doesn't require ID and has a good privacy policy. BitMex has more advanced trading features, but ID verification is required for higher value trades involving Fiat currency. For buying and selling alt-coins, Binance has a wide range of currencies, and ID verification is not needed for small-value trades.

Virtual cards generated provide an extra layer of security, improve privacy and help protect from fraud. Most providers have additional features, such as single-use cards (that cannot be charged more than once), card limits (so you can be sure you won't be charged more than you expected) and other security controls.

PayLasso, JoinToken, EntroPay are now discontinued

Paying for goods and services is a good example of where privacy and security conflict; the most secure option would be to pay with credit card, since most providers include comprehensive fraud protection, whereas the most private option would be to pay using crypto currency or cash, since neither can be easily tied back to your identity.

Note that credit card providers heavily track transaction metadata, which build up a detailed picture of each persons spending habits. This is done both to provide improved fraud alerts, but also because the data is extremely valuable and is often 'anonymized' and sold to 3rd parties. Hence your privacy is degraded if these cards are used for daily transactions

Spreadsheets remain a popular choice for managing budgets and financial planning. Collabora or OnlyOffice (on NextCloud), Libre Office and EtherCalc are popular open source spread sheet applications. Mintable allows you to auto-populate your spreadsheets from your financial data, using publicly accessible API - mitigating the requirement for a dedicated budgeting application.

Other notable open source budgeting applications include: Smart Wallet (iOS), My-Budget (Desktop), MoneyManager EX, Skrooge, kMyMoney and Budget Zen (a simple E2E encrypted budget manager)

See Also: Cryptocurrencies, Virtual Credit Cards and Other Payment Methods

See Also: Personal Finance Security Tips

If you are an Android user, your device has Google built-in at its core. Google tracks you, collecting a wealth of information, and logging your every move. A custom ROM, is an open source, usually Google-free mobile OS that can be flashed to your device.

Replicant OS is a fully-featured distro, with an emphasis on freedom, privacy and security. OmniRom, Resurrection Remix OS, and Paranoid Android are also popular options. Alternatively, Ubuntu Touch is a Linux (Ubuntu)- based OS. It is secure by design and runs on almost any device, - but it does fall short when it comes to the app store.

To install apps on the Play Store without using the Play Store app see Aurora Store. For Google Play Service see MicroG

It is not recommended to root, or flash your device with a custom ROM if you are not an advanced user. There are risks involved

• Although the above ROMs omit Google, they do open up other security issues: Without DM-verity on the system partition, the file system could be tampered with, and no verified boot stack, the kernel/initramfs also could be edited. You should understand the risks, before proceeding to flash a custom ROM to your device
• You will need to rely on updates from the community, which could be slower to be released - this may be an issue for a time-urgent, security-critical patch
• It is also possible to brick your device, through interrupted install or bad software
• Finally, rooting and flashing your device, will void your warranty

Windows 10 has many features that violate your privacy. Microsoft and Apple are able to collect all your data (including, but not limited to: keystrokes, searches and mic input, calendar data, music, photos, credit card information and purchases, identity, passwords, contacts, conversations and location data). Microsoft Windows is also more susceptible to malware and viruses, than alternative systems.

Switching to Linux is a great choice in terms of security and privacy - you don't need necessarily need to use a security distro, any well-maintained stable distro is going to be considerably better than a proprietary OS

Septor is a Debian-based distro with the KDE Plasma desktop environment, and Tor baked-in. Designed for surfing the web anonymously, and completing other internet-based activities (with Thunderbird, Ricochet IM, HexChat, QuiteRSS, OnionShare). Septor is light-weight, but comes bundled with all the essential privacy + security utilities (including: Gufw, Ark, Sweeper, KGpg, Kleopatra, KWallet, VeraCrypt, Metadata Anonymisation Toolkit and more).

Subgraph OS is designed to be an adversary resistant computing platform, it includes strong system-wide attack mitigations, and all key applications run in sandbox environments. Subgraph is still in beta (at the time of writing), but still is well tested, and has some nice anonymization features

For defensive security, see Kali and BlackArch, both are bundled with hundreds of security tools, ready for pretty much any job.

Other security-focused distros include: TENS OS, Fedora CoreOS, Kodachi and IprediaOS. (Avoid systems that are not being actively maintained)

If you do not want to use a specalist security-based distro, or you are new to Unix - then just switching to any well-maintained Linux distro, is going to be significantly more secure and private than Windows or Mac OS. Since it is open source, major distros are constantly being audited by members of the community. Linux does not give users admin rights by default - this makes is much less likely that your system could become infected with malware. And of course, there is no proprietary Microsoft or Apple software constantly monitoring everything you do.

Some good distros to consider would be: Fedora, Debian, or Arch- all of which have a large community behind them. Manjaro (based of Arch) is a good option, with a simple install process, used by new comers, and expers alike. POP_OS and PureOS are reasonably new general purpose Linux, with a strong focus on privacy, but also very user-friendly with an intuitive interfac and install process. See Simple Comparison or Detailed Comparison.

BSD systems arguably have far superior network stacks. OpenBSD is designed for maximum security — not just with its features, but with its implementation practices. It’s a commonly used OS by banks and critical systems. FreeBSD is more popular, and aims for high performance and ease of use.

Two alternative options for Windows users are Windows 10 AME (ameliorated) project and the LTSC stream. Windows 10 AME AME project aims at delivering a stable, non-intrusive yet fully functional build of Windows 10 to anyone, who requires the Windows operating system natively. Core applications, such as the included Edge web-browser, Windows Media Player, Cortana, as well as any appx applications (appx apps will no longer work), have also been successfully eliminated. The total size of removed files is about 2 GB. Comes as a pre-built ISO or option to build from scratch with de-bloat scripts. Strong, supportive community on Telegram. Windows 10 LTSC LTSC provides several security benefits over a standard Win 10 Installation. LTSC or Long Term Servicing Channel is a lightweight, low-cost Windows 10 version, that is intended for specialized systems, and receives less regular feature updates. What makes it appealing, is that it doesn't come with any bloatware or non-essential applications, and needs to be configured from the ground up by the user. This gives you much better control over what is running on your system, ultimately improving security and privacy. It also includes several enterprise-grade security features, which are not available in a standard Windows 10 instance. It does require some technical knowledge to get started with, but once setup should perform just as any other Windows 10 system. Note that you should only download the LTSC ISO from the Microsoft's official page

After installing your new operating system, or if you have chosen to stick with your current OS, there are a couple of things you can do to improve security. See: Windows 10 security guide, Mac OS security guide or Linux security guide.

SecTools.org is a directory or popular Unix security tools.

(The above software was last tested on 01/05/20). Many of the above tools are not necessary or suitable for beginners, and can cause your system to break - only use software that you need, according to your threat model. Take care to only download from an official/ legitimate source, verify the executable before proceeding, and check reviews/ forums. Create a system restore point, before making any significant changes to your OS (such as disabling core features). From a security and privacy perspective, Linux may be a better option.

• github.com/Awesome-Windows/Awesome#security
• github.com/PaulSec/awesome-windows-domain-hardening
• github.com/meitar/awesome-cybersecurity-blueteam#windows-based-defenses

Cross-platform, open source malware detection and virus prevention tools

For 1-off malware scans on Windows, MalwareBytes is portable and very effective, but not open source

For Microsoft Windows, Windows Defender provides totally adequate virus protection in most cases. These tools are intended for single-use in detecting/ removing threats on an infected machine, and are not recommended to be left running in the background, use portable editions where available.

Many anti virus products have a history of introducing vulnerabilities themselves, and several of them seriously degrade the performance of your computer, as well as decrease your privacy. Never use a free anti-virus, and never trust the companies that offer free solutions, even if you pay for the premium package. This includes (but not limited to) Avast, AVG, McAfee and Kasperky. For AV to be effective, it needs intermate access to all areas of your PC, so it is important to go with a trusted vendor, and monitor its activity closely.

If you have smart devices within your home, you should consider running the automation locally, rather than using a cloud service. This will reduce the amount of exploits you could potentially be vulnerable to. It is also important to have network monitoring and firewalls enabled, to ensure suspicious activity is flagged or blocked. The following projects will make controlling and monitoring IoT devices within your home easier, safer and more private.

For creating dashboard from IoT devices, see ThingsBoard. Another home automation tool is FHEM, which has been around for a while and needs a bit more work to get up and running, but is still a popular option.

IoT smart home devices can open you up to many security risks and exploits. It is really important that you configure them correctly, setting strong unique passwords, turn off data sharing, and if possible restrict internet access so devices can only communicate within your local network. See Smart Home Security Checklist for more tips.

Google Assistant, Alexa and Siri don't have the best reputation when it comes to protecting consumers privacy, there have been many recent breaches. For that reason it is recommended not to have these devices in your house. The following are open source AI voice assistants, that aim to provide a human voice interface while also protecting your privacy and security

If you choose to continue using Google Home/ Alexa, then check out Project Alias. It's a small app that runs on a Pi, and gives you more control over your smart assistants, for both customisation and privacy.

For a desktop-based assistant, see Dragonfire for Ubuntu, and Jarvis for MacOS. LinTO, Jovo and Snips are private-by-design voice assistant frameworks that can be built on by developers, or used by enterprises. Jasper, Stephanie and Hey Athena are Python-based voice assistant, but neither is under active development anymore. See also OpenAssistant.

If you are building your own assistant, you may want to consider a hardware-switch for disabling the microphone. Keep tabs on issues and check the code, to ensure you are happy with how it works, from a privacy perspective.

Moving away from Google, and using multiple alternative apps will mean there is no single source of tracking. Open source and privacy-focused software is best

• Academic: RefSeek, Microsoft Academic, More Academic Search Engines
• Analytics: Matomo, Privalytics, Plausible, Fathom, GoatCounter, ShyNet, Pirsch, Aptabase
• Assistant: Mycroft, Kalliope, Project-Alias (for Google Home/ Alexa)
• Authenticator: Aegis (Android), Authenticator (ios)
• Blogging: Write Freely, Telegraph, Mataroa, Bear Blog, Ghost (Self-Hosted)
• Browsers: Brave, Firefox (with some tweaks), Vivaldi
• Calendar: EteSync, ProtonCalendar, NextCloud Calendar (self-hosted), Radicale (self-hosted, also supports contact lists)
• Cloud: Njalla, Vindo, Private Layer
• DNS: Cloudflare, Quad9
• Docs: NextCloud, CryptPad, Skiff
• Finance: Wallmine, MarketWatch, Nasdaq Lookup
• Flights: SkyScanner, Kayak (Note: Beware of tracking, use Tor)
• Location Tracker: Private Kit
• Mail: ProtonMail, Tutanota, MailFence, HushMail, Skiff
• Maps: OpenStreetMaps (web), OsmAnd (Android + iOS)
• Messaging: Signal (Mobile Number Required), KeyBase, Session
• Mobile OS: LineageOS, GrapheneOS, Ubuntu Touch
• Notes: Cryptee, Joplin, Standard Notes, Joplin
• Passwords: BitWarden, 1Password, KeePassXC, LessPass
• Pay (Currencies): Monero, ZCash
• Pay (Virtual Cards): Privacy.com, Revolut (disposable virtual credit cards)
• Photos: PhotoPrism (Self-Hosted)
• Play Store: F-Droid, APK Mirror
• Search: DuckDuckGo, Searx (self-hosted), Qwant
• Sync: SeaFile, Syncthing, NextCloud, Duplicacy
• Translate: Apertium
• Weather: Geometric Weather (Android), Open Weather Map (Web)
• Workspace / Group Messaging: Riot (Through Matrix), Jami
• Video Platforms: PeerTube, BitChute (Caution: Not moderated), Invidio (YouTube Proxy)

Community-maintained media software can help you migrate away from providers that may not respect privacy. The following creative software packages are open source, cross-platform and free.

• Graphics: GIMP, Scribus, SwatchBooker, InkScape, Krita
• Audio: Audacity, Mixxx, MusicBrainz, Qtractor, SpotiFlyer
• Video: Shortcut, OpenShot, kdenlive
• Video Transcoders: HandBreak
• Media Players: VLC Player
• Media Servers: Kodi, Plex, Subsonic, Emby, Gerbera, OpenELEC, OpenFlixr 2, OCMC
• 3D Rendering: Blender, Wings3D
• Game Engines: GoDot, SpringEngine, Panda3D, Cocos
• Rendering Engines: LuxCoreRender, AppleSeed

• Analytics: Matomo, Privalytics, Plausible, Fathom, GoatCounter, ShyNet
• Blogging: Hexo, Noddity, Plume, Ghost, Write.as
• Bookmarks: Shiori, Geek Marks, Ymarks, xBrowserSync, reminiscence, unmark
• Chat Networks: Gotify, GNU:net, Centrifugo, Mumble, Tox, Matrix + Riot, Retroshare
• CMS: Strapi (headless), ApostropheCMS, Plone, Publify, Pico
• Conference: Jami, Jitsu, BigBlueButton (Academic Institutions), OpenMeetings
• Document Management: Paperless
• E-Commerce: Qor, Magento, Grandnode
• Email Clients: Rainloop, RoundCube
• Email Setup: Mailu, MailCow, Mail-in-a-Box
• File Drop: PsiTransfer, Up1, FilePizza
• File Explorer: FileRun, Pydio
• Groupware: SoGo, SuiteCRM
• News Letters: LewsNetter, PHP List, Dada Mail
• Office Suites: CryptPad, LibreOffice, onlyoffice, NextCloud
• Paste Bins: Snibox, PrivateBin, 0bin, Stikked, Paaster
• Photo Managers: PhotoPrism
• Search Engine: Searx
• Social Networks: Mastodon, Pixelfed, diaspora
• Ticketing: Zammad, osTicket, Helpy
• URL Shortners: Shlink, Polr, Istu, Linkr
• WiKi/ Knowledge Sharing: Gollum, Outline, Wiki JS, Gitit, TidyWiki5, Cowyo
• XMPP: Server: ejabberd, MongooseIM, OpenFire, Prosody. Clients: Converse, JSXC, Movim, XMPP Web

• Ad-Block (network-wide): PiHole
• Content Filter: E2Guardian, Squid Guard
• Cron Jobs: HealthChecks
• Dashboards: Homer, Heimdall, SWMP, Uchiwa (for Sensu), Linux Dash
• DNS: CoreDNS, KnotDNS, Bind 9, PowerDNS
• Domain Control: DomainMod, OctoDNS, DNSControl
• Firewall: IPFire, PFSense, OPNSense, ShoreWall
• Log Management: GoAccess
• Monitoring: Alerta, Cabot, Cadvisor, CheckMK, Linux Dash. NetData, PS Dash
• Proxy: ShaddowSocks, Privoxy
• Server Status: Statup, BotoX / ServerStatus, Mojeda / ServerStatus, Statusfy, Cachet
• SSH Tools: RTop (sts stats), Fiche (cli pastepin)
• Storage DB: OpenTSBD, KairosDB, InfluxData
• VPN: OpenVPN, Pritunl
• Web Servers: NGINX, Caddy, Light TPD

• API Management: Kong, Krakend, tyk, Hasura
• Browser-based IDE: Code Server (VS Code), Che (Eclipse), ICEcoder, ml-workspace (for Data science and ML), r-studio (for R programming)
• Code Reviews: Phabricator. See also: Git Servers, most of which have CR features
• Containers: Docker, LXC, OpenVZ
• Continuous Integration: Drone, Concourse, BuildBot, Strider, Jenkins
• Deployment Automation: Capustrano, Fabric, Mina, Munki, Rocketeer, Sup
• Doc Generators: FlatDoc, Docsify, Sphinx, ReadTheDocs, Docusarus, mkdocs
• Git Server: GitBucket, GitTea, GitLab, Gogs
• Localization: Weblate, Translate/ Pootle, Accent
• Serverless: OpenFaas, IronFunctions, LocalStack, fx
• Static Site Gen: See StaticGen.com
• UI Testing: Selenoid, Zalenium, Selenium
• More Tools:
  • Request Bin - Inspect HTTP requests and Debug webhooks
  • Regexr - Web tool for for creating, testing, and learning about Regular Expressions
  • JS Bin - Collaborative JavaScript Debugging App, create, test, run and send web code snippets
  • Koding - A development platform to orchestrates your project-specific dev environment
  • Judge0 - A web compiler accessed through either an API of web-IDE, for executing trusted or untrusted code
  • SourceGraph - Self-hosted universal code search and navigation engine

This list is intended to aid you in auditing the security of your own systems, and help detect and eliminate vulnerabilities. It is intended for advanced users and sysadmins. For penetration testing, see enaqx/awesome-pentest GitHub list instead

• Amass - In-depth Attack Surface Mapping and Asset Discovery, to help you identify issues and secure your network
• CloudFail - Ensure there are no misconfigured DNS and old database records, accessible by bypassing CloudFlare network
• CrackMapExec - A CLI tool for pen testing all areas of your local and remote networks, to ensure their integrity
• DNSdumpster - A domain research tool that can discover hosts related to a domain. It can be used to test and ensure there are no visible hosts that a hacker could exploit
• DNSTracer - Scan your domain, to show which records are publicly visible and need to be obfuscated
• dnstwist - Domain name permutation engine for detecting typo squatting, phishing and corporate espionage, to protect those on your network
• GRR - incident response framework focused on remote live forensics
• Impacket - A collection of Python classes for working with network protocols, focused on providing low-level programmatic access to the packets and for the protocol implementation themselves
• Kali Linux - A Debian-based distro for security testing, bundled with 1000's of powerful packages and scripts. Saves a lot of time configuring sys-admin tools and drivers
• Lynis - A security tool that performs an extensive health scan of your systems to support system hardening and compliance testing
• Masscan - TCP port scanner, that checks packets asynchronously, configure it to check only your IP ranges and it completes in milliseconds
• Metasploit - Popular and powerful penetration testing framework, for exploitation and vulnerability validation - bundled with a full suite of tools, it makes it easy to divide your penetration testing workflow into manageable sections. Very useful for testing your entire network E2E
• Moloch - Full packet capture, indexing, and database system. The elastic search backend makes searching through pcaps fast, and the frontend displays captured data clearly with good support for protocol decoding
• Nikto2 - Well-established web server testing tool, useful for firing at your web server to find known vulnerable scripts, configuration mistakes and related security problems
• Nmap - Powerful utility for network discovery and security auditing. Useful for your network inventory, managing service upgrade schedules, and monitoring host or service uptime
• OpenAudit - An application to tell you exactly what is on your network, how it is configured and when it changes
• OpenVAS - Fully-featured security vulnerability management system, with web-based dashboards. Useful for fast and easy scans of your network
• OSQuery - SQL powered operating system instrumentation, monitoring, and analytics. Very performant cross-platform tool, useful for monitoring a host for changes and providing endpoint visibility
• OSSEC HIDS - A host based intrusion detection system that is easy to setup and configure, which performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response
• Otseca - Search and dump your system configuration + generate HTML reports
• RouterSploit: An exploitation framework for checking the security of local embedded devices, to ensure they are safe
• Security Onion - Linux distro for intrusion detection, enterprise security monitoring, and log management. It includes a suite of security testing tools. Useful for collecting, storing and managing a variety of system data, for use on your networks
• Snort - Intrusion detection system aimed at real time traffic analysis and packet logging tool
• SPARTA - GUI tool that makes pen testing your network infrastructure easier
• Wireshark - Popular, powerful feature-rich network protocol analyser. Lets you analyse everything that is going on in your network in great detail
• Zeek - Powerful intrusion detection system and network security monitoring, that (rather than focusing on signatures) decodes protocols and looks for anomalies within the traffic

• OnionPi - Create an Anonymizing Tor Proxy using a Raspberry Pi
• CIRCLean - A Pi-based USB Sanitizer, plug an untrusted USB in, and get clean files out
• Pi Hole - A network-wide ad-block, that improves network performance as well as privacy
• Project Alias - Gives you full-control, and better privacy of your Google Home or Alexa
• Raspiblitz - Build your own Bitcoin & Lightning Node on a Pi, see also Trezor wallet
• PiVPN - Simple low-cost yet secure VPN, for the Raspberry Pi (or set up manually, as outlined in this guide)
• DeauthDetector - Detect deauthentication frames using an ESP8266, useful to be aware of ongoing wireless attacks
• IPFire - Hardened open source firewall to prevent common attacks on your network. Capable of running on a Pi
• SquidGuard - Fast and free URL redirector, which can work well as a home caching server
• E2guardian - Comprehensive content filtering, with powerful configuration options

USB-based projects include:

• DBAN - Bootable hard drive erasers for destroying data
• Syncthing - Create automated backups to an external medium
• KeePass Portable - Portable password manager. For hardware-encrypted password manager, see HardPass 2.0
• VeraCrypt - Full drive encryption for USB devices

See more hardware-based security solutions

This list was focused on privacy-respecting software. Below are other awesome lists, maintained by the community of open source software, categorised by operating system.

• Windows: awesome-windows-apps by 'many'
• MacOS: awesome-macOS-apps by @iCHAIT
• Linux: awesome-linux-software by @luong-komorebi
• iOS: open-source-ios-apps by @dkhamsing
• Android: open-source-android-apps by @pcqpcq
• Server: awesome-selfhosted by 'many'
• More GitHub Awesome Lists →

A custom Reddit feed covering news and updates for privacy-respecting apps, software & services can be found here

Many corporations put profit before people, collecting data and exploiting privacy. They claim to be secure but without being open source it can't be verified, until there's been a breach and it's too late. Switching to privacy-respecting open source software will drastically help improving your security, privacy and anonymity online.

However, that's not all you need to do. It is also important to : use strong and unique passwords, 2-factor authentication, adopt good networking practices and be mindful of data that are collected when browsing the web. You can see the full personal security checklist for more tips to stay safe.

Compartmentalise, Update and Be Ready
No piece of software is truly secure or private. Further to this, software can only as secure as the system it is running on. Vulnerabilities are being discovered and patched all the time, so you much keep your system up-to-date. Breaches occur regularly, so compartmentalise your data to minimise damage. It's not just about choosing secure software, you must also follow good security practices.

Attack Surface
It is a good idea to keep your trusted software base small, to reduce potential attack surface. At the same time trusting a single application for too many tasks or too much personal data could be a weakness in your system. So you will need to judge the situation according to your threat model, and carefully plan which software and applications you trust with each segment of your data.

Convenience Vs Security
There is often a trade-off between convenience and security. Construct a threat model, and choose a balance that is right for you. In a similar way in some situations there is privacy and security conflict (e.g. Find My Phone is great for security, but terrible for privacy, and anonymous payments may be good for privacy but less secure than insured fiat currency). Again it is about assessing your situation, understanding the risks and making an informed decision.

Hosted Vs Self-Hosted Considerations
When using a hosted or managed application that is open-source software - there is often no easy way to tell if the version running is the same as that of the published source code (even published signatures can be faked). There is always the possibility that additional backdoors may have been knowingly or unknowingly implemented in the running instance. One way round this is to self-host software yourself. When self-hosting you will then know for sure which code is running, however you will also be responsible for the managing security of the server, and so may not be recommended for beginners.

Open Source Software Considerations
Open source software has long had a reputation of being more secure than its closed source counterparts. Since bugs are raised transparently, fixed quickly, the code can be checked by experts in the community and there is usually little or no data collection or analytics. That being said, there is no piece of software that it totally bug free, and hence never truly secure or private. Being open source, is in no way a guarantee that something is safe. There is no shortage of poorly-written, obsolete or sometimes harmful open source projects on the internet. Some open source apps, or a dependency bundled within it are just plain malicious (such as, that time Colourama was found in the PyPI Repository)

Proprietary Software Considerations
When using a hosted or proprietary solution - always check the privacy policy, research the reputation of the organisation, and be weary about which data you trust them with. It may be best to choose open source software for security-critical situations, where possible.

Maintenance
When selecting a new application, ensure it is still being regularly maintained, as this will allow for recently discovered security issues to be addressed. Software in an alpha or beta phase, may be buggy and lacking in features, but more importantly - it could have critical vulnerabilities open to exploit. Similarly, applications that are no longer being actively maintained may pose a security risk, due to lack of patching. When using a forked application, or software that is based on an upstream code base, be aware that it may receive security-critical patches and updates at a slightly later date than the original application.

This List: Disclaimer
This list contains packages that range from entry-level to advanced, a lot of the software here will not be appropriate for all audiences. It is in no way a definitive list of secure applications, and aims only to be a guide, a collection of software and services that myself and other contributors have used, and would recommend. There will always be new vulnerabilities discovered or introduced, bugs and security-critical glitches, malicious actors and poorly configured systems. It is up to you to do your research, draw up a threat model, and decide where and how your data are managed.

If you find something on this list that should no longer be deemed secure or private/ or should have a warning note attached, please raise an issue. In the same way if you know of something that is missing, or would like to make an edit, then pull requests are welcome, and are much appreciated!

This is a community-maintained project, which wouldn't have been possible without help from all these wonderful people.

Top Contributors:

Thanks for visiting! If you have suggestions, then you open an issue, or submit a PR, see: CONTRIBUTING.md. Contributions are welcome, and always much appreciated ☺️

Licensed under Creative Commons, CC BY 4.0, © Alicia Sykes 2022

Thank you for checking out this project - I hope you found it somewhat useful 😊

This list was initially compiled by Alicia Sykes / @Lissy93, with a lot of help from the community.

Follow me on GitHub for updates and other projects.

If you found this project helpful, consider dropping us a star, and sharing with your network.