Which tools to choose, from phone to social network

Well defended against everyday attacks, and that's real. The Apple account is still the condition for using the device, not an option. One point more than in the first version of this scorecard, for a single, checkable reason: Advanced Data Protection, which you switch on yourself, raises the number of iCloud categories encrypted end to end from fourteen to twenty-three, backup and photos included. Apple can then no longer read what it hosts for you. Mail, contacts and calendar stay in the clear, and almost nobody will ever switch it on.

One point more for one reason: you can get at it. Separate profiles, alternative stores, Google services partly removable. Straight out of the box, it says as much about you as iOS does. Since Android 16, an advanced protection mode gathers into a single setting what an at-risk user would otherwise switch on by hand, and Google aims it explicitly at journalists and activists. It doesn't move the score: it protects you from an attacker, not from the vendor, and the vendor is what this category measures.

The free ROM covering the most models, including old devices the vendor no longer updates. The vendor leaves the equation, Google services become a choice. Eight, not ten: installing it means unlocking the bootloader, and that costs part of the device's original protections.

The only mobile system that adds a protection instead of removing one: Google services, if you install them, run there in a sandbox like any other app, and the bootloader closes again once the install is done, which LineageOS does not allow. The price is real: a Pixel device, a reinstall, banking apps often lost. Careful with root, which is not the same thing: an app that gets it gets everything, so it's one more door, not a protection.

The online account is forced at install time, usage reporting can't be switched off from settings, and features arrive by update without being chosen. The 3 isn't about security: Windows holds up fine against attackers, it doesn't hold up against its own vendor.

Fewer features forced on you than on Windows, and hardware supported for years. But the Apple account shows up at first boot, iCloud sync is the default, and the system asks Apple about the applications you launch. One point above Windows, for the same underlying reason: what it does cannot be checked, you take the vendor at their word.

A system that only exists with a Google account: it is the condition for logging in, not an option. Solid against attackers, close to silent on the question at hand, since all use goes through the vendor. Developer mode makes up for nothing, it opens one more door.

Yes, Ubuntu is Linux. The gap with the next line isn't the kernel, it's what sits on top and who decided it: an in-house store, defaults chosen for convenience, reporting enabled at install. It's still the lowest step out of Windows without spending a weekend on it.

A mainstream distribution you pick and configure: Debian, Fedora, Arch, NixOS. Nothing reports back that you didn't install, and what the machine does can be checked. Eight, not ten, because everything still sits in one bag: a compromised browser sees your documents, your keys and your mail. The next three lines exist for that. In exchange, you're the administrator, including on the days it breaks.

Two virtual machines: one where you work, one that knows nothing but pushing traffic through Tor. The workstation never learns the real IP address, so a leaky application cannot hand it over. Nine, not ten, because it needs a host machine, and the whole is worth no more than that host.

A system on a USB stick that boots in place of yours, sends all traffic through Tor and forgets everything at shutdown. It is the only one here that installs nothing on the machine, so the only one usable on a computer that isn't yours. What it doesn't do: keep your files, unless you create a persistent space that costs part of the promise, and protect you from a machine whose hardware is already tampered with.

Compartmentalisation as a founding principle: each use runs in its own virtual machine, and an attachment opened in a disposable compartment sees nothing of the rest. It is the best answer to the fact that everyone eventually opens the wrong file. The price is the highest in this guide: compatible hardware, plenty of memory, and a way of working to relearn.

The state most computers are in. A login password stops nobody from taking the drive out, plugging it in elsewhere and reading everything: it protects the screen, not the files. This is the line that explains why the category exists, and why it comes before half the others.

Windows encryption does its job properly: drive stolen, drive unreadable. Six because of the recovery key. On devices where encryption turns itself on, Microsoft itself states that the key is saved to your Microsoft account before protection is even activated. In other words, the disk is closed to a thief and open to whoever gets that account, or whoever can demand it from the vendor.

The same service as BitLocker, with one point more for a precise reason: Apple asks instead of deciding. When you switch it on, you choose between unlocking with your iCloud account and a recovery key you keep. Take the second one, write it down away from the computer, and nobody but you can open the disk.

Open source, on all three systems, and the only one here that encrypts a plain container file: handy when you only want to protect one folder, or a USB stick that travels. A word on hidden volumes, which promise to deny the existence of the data under duress: don't count on them. The duress is applied to you, not to the disk, and having to argue that there is nothing is a worse position than having simply encrypted.

It is already on, on iPhone as on recent Android devices, and it asks nothing of you: the one piece of good news in this guide. What holds it is your passcode. Apple describes the mechanism precisely: the keys are derived from the passcode, and a few seconds after locking the decrypted key is discarded. So everything depends on the length of that passcode, and a four-digit one can be tried exhaustively. Six digits minimum, a phrase if the device can be seized.

The encryption of Linux systems, offered as a checkbox at install time, open source and verifiable. Nine for a simple reason: there is no recovery key anywhere else, so there is nobody to ask for it. That is also what makes it unforgiving, since a forgotten password closes the door for good. Nine, not ten, because nothing here protects a machine seized while it is on.

The default state, and the only line in this guide whose deadline is certain: a drive always fails in the end, a phone always falls in the end. Zero, because there is nothing to rate. This category is the only one that protects you from what you will do to yourself with nobody's help.

iCloud, Google Drive, OneDrive: this isn't a backup, it's a mirror. What is deleted on one side is deleted on the other, and Google states that a file sent to the trash is permanently erased after thirty days. Ransomware that encrypts your files sees the encrypted versions sync straight away. Three, because it still saves you from the lost phone, which is not nothing.

Backblaze and its equivalents: the copy leaves on its own, off your premises, which settles both the house fire and the discipline problem in one go. Six because of a caveat the vendor documents itself: the optional private key does protect your files at their end, but to restore you type the passphrase on their website, where it is used to decrypt the key. So it passes through them at that moment. Fine against hardware failure, less so against an adversary who can serve them a request.

Plugged in once a month, then unplugged: it is precisely the unplugging that earns the score. US ransomware guidance asks for offline, encrypted backups isolated from the network, because these programs look for and wipe any backup they can reach. Seven and no more: the drive sleeps at your place, so it burns, gets stolen and gets seized along with everything else.

restic or Borg: files are encrypted on your machine before they leave, the tool keeps a version history, and the destination stops mattering since it only ever sees ciphertext. It is the only line where the storage provider needs to know nothing about you. Nine, not ten, because you have to install it, automate it, and above all test a restore: a backup never restored is a hypothesis, not a backup.

Two, for the only reason that matters here: it is the documented case. In 2022 a backup of customer vaults was copied by an attacker. Credentials stayed encrypted under a key derived from the master password, but the site addresses were in the clear, and a stolen vault is cracked offline, with no rate limit and nobody to warn you. A password manager is judged at that moment.

Chrome, Safari, Firefox and Edge all offer one, and it beats using the same password everywhere by a mile. Four because it hangs off the vendor's account and is unlocked along with your session: whoever gets the machine while it is on gets the vault, and whoever gets the account gets the rest. It never leaves the browser, whereas your passwords do.

Seriously. A notebook kept at home cannot be attacked remotely, syncs nowhere and depends on no vendor: against the risk most people actually run, reusing a password that has turned up in a breach, it does the job. Five and no more, for two limits that decide everything: it protects you from nobody who walks into your home, which rules it out in cases of domestic violence or harassment by someone close, and it exists in a single copy, so one burst pipe closes every account you own.

The most polished in daily use, with one feature that matters: alongside the account password, a secret key kept on your devices takes part in decryption, so a vault stolen from the vendor cannot be attacked with the password alone. That is precisely the protection the top line lacked. Seven because the code is closed and the subscription mandatory: you take the vendor at their word.

Open source end to end, annual third-party audits published, a free tier that genuinely suffices, and the option of hosting the server yourself. It is the best ratio between what you can check and what you don't have to do. Eight, not ten: the vault is still synced at a provider, so it can be copied if that provider is breached, and everything then rests on the length of your master password.

An encrypted file on your machine, no account, no server, no subscription, and code anyone can read. There is nothing to steal at a provider because there is no provider. Nine, not ten, because everything falls back on you: syncing between your devices, backing up the file, and the fact that the day you lose it, nobody on earth can give it back.

Better than nothing, and that is all there is to say. The code travels over the phone network, where your number can be attached to another SIM card by someone convincing enough with the carrier. US digital identity guidelines class this channel as restricted and ask verifiers to watch for SIM changes and number porting. Useful against the automated pillaging of a leaked password, worthless against someone aiming at you.

The password manager can also produce the six-digit codes, and it is very convenient. Five because the factor then stops being second: an open vault hands over the password and the code in the same motion, and a backup stolen at the provider contains both. Acceptable for accounts without consequences, to be avoided for the ones that open the others.

Aegis or Ente Auth: codes are computed offline, on the device, with no account to create and no carrier involved, and the backup export is encrypted. Seven because the code can still be retyped: a fake site asks for it, you give it, it uses it within the minute. Against phishing, it does not hold.

The same cryptography as the hardware key, kept in the phone or in the password manager, and usually synced across your devices. Nothing to retype, nothing to intercept, and above all the signature is bound to the site's real domain: a fake site gets nothing, even if you fall for it. Eight, not ten, because syncing brings the whole security back to that of the account carrying it.

A USB or NFC key that never hands over a reusable secret and refuses to sign for a domain that isn't the site's: this is what digital identity guidelines call phishing resistance, and they cite precisely this mechanism. It is the only line in this guide that protects you when the user gets it wrong. Buy two, keeping the second elsewhere: otherwise the day you lose the first, you lose everything.

Encrypted at rest, Swiss jurisdiction, throwaway aliases so you don't hand out the same address everywhere. Seven, not ten: as soon as your correspondent is elsewhere, the subject line and headers travel in the clear. Email is a 1982 format, and no provider fixes that.

Same logic as Proton: encrypted at rest, German jurisdiction, an open project. Message body and subject are encrypted, which Proton doesn't do for the subject. Against it: no standard IMAP bridge, so the in-house app is mandatory, and the range of services around the mailbox is narrower than Proton's.

A small Swedish service, paid, encrypting server-side with OpenPGP and claiming to write nothing to a hard disk. Six and no more: that promise cannot be checked from outside, the price is high for what you get, and the team is tiny, which is as much a continuity risk as a guarantee of independence.

One euro a month, no personal data asked at sign-up, and cash payment accepted by post: it is the only one here that doesn't need to know who you are. Mailbox encryption is PGP and switched on by hand, as at Mailbox.org, hence the same kind of score: a good ad-free webmail, not a mailbox encrypted by default.

A serious German provider, ad-free, funded by subscription. End-to-end encryption is via PGP, opt-in and something you have to understand: outside that setup, it's a good classic webmail, not a mailbox encrypted by default. Hence the 5.

The service works very well and the phishing filter is among the best. But the mailbox is machine-read for sorting, and the account is the key to everything else: phone, documents, location history, sign-in to third-party services. One breach opens the lot.

Same model as Gmail, with one extra quirk: the account also unlocks your Windows session. Your mailbox password becomes your computer password.

Gmail's model without the service: ads in the inbox, content analysed to aim them, and one of the heaviest breach records in the industry, with three billion accounts hit in 2013. A forgotten Yahoo address still serving as a recovery address elsewhere isn't a mailbox, it's a way in.

The dot added in the middle, the suffix after a plus sign. This isn't an alias, it's your address in a costume: Google itself explains that every dotted version of a Gmail address belongs to you and reaches you. Anyone strips the suffix in one line of code, and the service reselling its list does exactly that. Two, because it still helps sort your mail, and nothing else.

A random address at each sign-up, offered by the system itself at the moment the form asks for one, which makes it the easiest to adopt here. Six because it needs the iCloud+ subscription and staying with Apple: the aliases don't follow you elsewhere, and the day you leave, everything writing to those addresses has nowhere to land.

Five free masks, enough to cover the five accounts that matter, and a subscription beyond that. Built into the browser, so offered at the right moment. Six for the same reason as the line above: the addresses belong to the provider, not to you, and five masks run out fast once the habit sets in.

Every component is open source, the service belongs to Proton and works with any mailbox, Gmail included: it is the only way to add aliases without changing provider. You reply from the alias, so the correspondent never sees the real address. Eight, not ten: Proton runs the relay, and your aliases live there.

The same service, open source, with the one difference that matters here: you can host it yourself, which removes the last intermediary. The free plan gives unlimited standard aliases. Eight, not ten, because self-hosting needs a domain and a server, and without it you are at a provider like anywhere else.

About a dozen euros a year, and every service gets an address of its own on a name you own. It is the only case where changing provider breaks no address: you take the name with you, repoint it, and nobody needs to be told. Nine, not ten, for two blunt reasons: the name is registered somewhere in connection with you, and if you forget to renew it, you lose every address on the same day.

The providers' in-house apps. They load remote images without asking, report usage back to their vendor, and some fetch third-party accounts through their own servers: in that case, a provider is reading a mailbox that isn't theirs. Three, and the same advice for all three profiles: use a mail client, not the provider's app.

Sound on one rare point: Mail Privacy Protection loads everyone's images through a relay, which makes tracking pixels useless instead of blocking them. The rest is the Apple house: the account, the syncing, and software nobody can open up to check.

The former K-9 Mail, taken over by the same project. Same logic on a phone: several mailboxes in one app, remote images blocked, and no in-house account to open in order to use it. One point below the desktop version, for lack of built-in OpenPGP: it needs OpenKeychain alongside.

Free software, funded by donations, available on all three systems, and the only one here to handle OpenPGP with nothing added. Remote images are blocked by default, which cuts the tracking pixels that tell the sender when and where a message was opened. Nine, not ten: what it downloads stays in the clear on disk, so it is worth only as much as that disk's encryption.

Nothing is blocked at install, and that follows: the vendor lives on the advertising you would want blocked. Add a recent technical limit, the new extension interface having cut down what a blocker can still do here. Two, not zero, because raw security is excellent: against a booby-trapped site, Chrome holds up very well. Against its own vendor, it doesn't.

Chrome's engine with the system vendor stacked on top: the browser is tied to the Windows account, it pushes its own services constantly, and it adds its layer of usage reporting to the system's. The tracker isn't the same one, the position it occupies is.

A built-in free VPN that isn't one: it's a proxy to the vendor's own servers, not a tunnel to a third party, and it covers the browser only. A Chromium engine otherwise, and a Chinese controlling shareholder, Kunlun Tech. The word VPN in a menu tells you nothing about who watches the traffic go by.

Third-party cookie blocking there is old and serious, and the engine was long the only one allowed on the iPhone, which gave it a lead it didn't earn. Four because there is nothing to configure and nothing to check: the protections are the ones Apple decided on, no more and no less, and ad blocking goes through limited extensions.

A built-in blocker, no announced data resale, a Norwegian vendor: on the substance it is better than its reputation. Four because its interface is closed. On this scorecard, a promise you cannot open up isn't worth a protection you can read.

Trackers and cookie banners blocked from install, and one button that wipes the whole tab. The same service as Brave without Brave's advertising model. Six because it sits on the engine of whichever system it runs on, and because the vendor is still a company whose revenue comes from search advertising.

Tracker blocking from install, nothing to configure, and that's what earns its score: default protection is the only kind that helps everyone. The engine is still Chromium, and the vendor has an advertising model of its own.

The only mainstream engine not owned by Google, per-site isolation, and a tracking-resistance mode you can switch on. Same score as Brave for the opposite reason: you have to go and set it up, and nobody does.

Chromium with everything that talks to Google taken out, down to the checks made at startup. Seven: nothing reports back, but nothing is blocked either, you have to add a blocker yourself, updates arrive late and there is no sync. It is the choice of someone who wants Chrome's engine without its vendor, not of someone who wants to be done with it straight away.

Firefox already hardened out of the box: tracking blocked, telemetry removed, cookies cleared on close, without spending an evening in settings. Two points above Firefox for that. Against it: updates trail Firefox a little, and a handful of sites need unblocking by hand.

Tor's browser, without the Tor network: the same fingerprint resistance, every user looks alike, but for clearnet use, paired with a VPN. It's the best day-to-day anti-fingerprint trade-off. Nine, not ten: without the Tor network, your IP goes through the VPN, not three relays.

Ten on the one thing that matters here: the site sees an IP address that isn't yours, and every user looks alike, so browser fingerprinting no longer singles you out. Slow, incompatible with some sites, and cancelled out the moment you sign in to a usual account. It isn't a daily browser, it's the one for searches that must not be traced back to you.

Google's results without Google seeing who asks: Startpage acts as a go-between, a Dutch company, no profile built. Against it, its dependency: quality follows Google's index, which it doesn't control.

An independent index that owes nothing to Google or Bing, and no profiling. That's what earns its score. Still young: on niche queries, results are sometimes thinner.

Builds no advertising profile, and switches on in one click in any browser: it's the easiest change in this whole guide. Six and no more: a US company, and part of the results comes from Bing, so from Microsoft.

The model IS profiling. Signed in, every query is tied to your identity and feeds your advertising file. Excellent engine, and the worst choice the moment discretion matters: it's the starting point, not an option.

Filtering you set yourself, logging you can switch off, a different profile per device. The trade-off: it needs an account, so an identifier attached to your queries.

Swiss non-profit foundation, known-malicious domains blocked, and nothing to create in order to use it: one address to paste into network settings. No fine-grained control in exchange.

A generated account number, no email address asked for, cash payment accepted, a single price with no promotions or referrals. It's the only one whose way of selling matches what it claims to protect.

Same house as Proton Mail, open-source apps, and a genuinely usable free tier, which is rare enough to be suspicious anywhere else. The account is still tied to an email address, so to an identity.

Sold through permanent discounts and affiliate links. Nothing scandalous, but nothing either that justifies handing it all your traffic rather than your ISP.

Deliberately a floor score. It's the name that reaches you through ads and sponsored videos, with a pitch selling anonymity, which no VPN provides. A marketing budget is not technical evidence, and a provider promising what doesn't exist hasn't earned your traffic.

Zero, for the reason given at the top of this category: bandwidth is paid for every month, so a free service recoups it from you. Three ways are documented: renting out your connection as an exit point for strangers' traffic, selling brokers the list of sites you open, injecting advertising into pages. The first is the worst, because what leaves under your address stops being up to you. One exception in this scorecard, the free tier of a paid provider funding it from its subscriptions, and it has its own line.

Opera's and its equivalents. Same score plus one extra deception: it isn't a VPN but a proxy to the vendor's own servers, it covers only the browser's tabs, and the rest of the machine still leaves through your usual address. You think you are covering everything, you are covering one window.

End-to-end encrypted: the host sees only unreadable files. Same house as Proton Mail, Swiss jurisdiction, open-source apps. Against it: younger than the giants, sharing and collaborative editing are thinner.

End-to-end encrypted, built for professional use, Swiss jurisdiction. Solid, but paid with no real free tier, and the code isn't open.

Convenient, integrated, free up to a point. But your files aren't end-to-end encrypted: Google can read them. And the storage hangs off the account that already unlocks your phone, your email and your history.

Same model as Google Drive, tied to the Microsoft account, so to your Windows session. Your files are readable by the host, and the same password opens the computer.

The only one with no account identifier at all, not even an internal one: no number, no handle, no directory. You connect through one-time links or QR codes. That's what the thinnest metadata means, taken literally. Against it: young, uncommon, and the lack of a directory throws people off at first.

Built for hard situations: messages travel over the Tor network, and hop by hop over Bluetooth or Wi-Fi if the internet is cut. No central server to seize. Against it: mostly Android, austere, and made for small circles, not your whole contact list.

No phone number, no email address: a random identifier, and routing that hides your IP. Against that: hardly anyone uses it, and a messenger where nobody answers you protects nothing.

A hardened build of Signal on Android: same contacts, same network, plus local database encryption and app lock. One point above Signal on the device. But the phone number is still required, like Signal, so the same ceiling.

The thinnest metadata of the lot, and that's decisive: a legal order returns almost nothing. The score comes from the phone number required at signup, which ties you to a subscriber contract, so to your legal identity. On this particular scorecard, that's a ceiling.

Nothing is end-to-end encrypted unless you ask, and never in groups or channels: your conversations sit on their servers. Still a five, because an account there lives without hoovering up your address book and without feeding an ad network.

The content is well protected, the rest isn't: contacts, timestamps, groups, address book. And the backup goes to the cloud in the clear until you go and encrypt it yourself, which almost nobody does.

End-to-end encrypted, but attached to the Facebook account, that is, to the most complete file that exists on you. Your messages are protected; the fact that you talk to that person is not.

Audio and video calls end-to-end encrypted, with the same thin metadata as its messaging. The phone number is still required, the same ceiling as for its messages.

Group video in the browser, with no account or install: you open a room, share the link, nothing ties you to an identity. End-to-end encryption depends on the server's configuration, to check or to host yourself.

End-to-end encrypted and federated: you pick the server, or host it. Against it: metadata lives on the home server, and getting started takes some effort.

The service Microsoft moved Skype accounts to, after Skype was retired in May 2025. Tied to the Microsoft account, no end-to-end encryption by default for consumer calls: the host can access the content.

Handy for a community, but no end-to-end encryption: voice and video go through their servers, and the account carries a full profile. It's also a frequent target for token theft, detailed in the anti-doxxing guide.

The 2 rewards one thing only: you can watch without an account and without posting anything. Posting, by contrast, hands your face, your voice and your locations to the most effective recommendation system out there.

The one point comes from content disappearing by default, which limits what stays readable years later. Everything else nearly cancels it out: a friends location map, an address book hoovered up, content kept server-side.

Photos that pin down your neighbourhood, your routine and the people around you, a follower list open by default, and the same account as Facebook behind it. It's the first source for any amateur profiling.

The oldest file on you, and the only one still holding your real name, date of birth, old phone numbers and fifteen years of relationships. It's what a search for your name turns up, before anything else.