Privacy online isn’t a single setting or a single app — it’s a stack of online privacy tools that address different data collection vectors at different layers of the digital experience. The browser layer, the DNS layer, the network layer, the account layer, and the device layer each need specific tools to address the tracking and surveillance operating at that level. For the bigger picture, our Complete Guide to Security and Privacy pulls everything together.
The sheer number of tools available — many with overlapping marketing claims — creates confusion about what’s actually needed. Some users install a VPN, three browser extensions, and a private browser, and still expose themselves through unaddressed account-level tracking. Others do very little and achieve reasonable privacy through consistent habits. This guide cuts through the noise by categorising tools by what they actually protect and building a coherent, non-redundant stack.
Start here — the single most impactful move
If you do nothing else: install uBlock Origin in whatever browser you currently use. That single extension eliminates a significant fraction of the cross-site tracking most users experience, blocks known malicious domains, and operates automatically after installation with zero configuration effort. Everything else in this guide can be added one at a time over the following weeks.
The foundation layer — highest-volume tracking addressed first
uBlock Origin blocks third-party tracking scripts, advertising networks, and known malicious domains through regularly-updated filter lists. Its open-source codebase has been independently reviewed; it uses a minimal-permission model; and its developer doesn’t monetise user data. Available for Firefox, Chrome, Edge, and Brave. Install it first, before any other privacy tool.
A password manager (Bitwarden, 1Password) is a privacy tool in an important sense: it prevents the credential reuse that enables account correlation across services. When every account uses a unique email alias and unique password, account-level digital identity stays fragmented rather than unified — which is exactly what advertisers and data brokers work to reverse. Our guide on using a password manager covers the setup that underpins this privacy architecture.
A privacy-focused search engine — DuckDuckGo, Brave Search, or Startpage — eliminates search query history from Google’s advertising profile while providing adequate results for most queries. Switching the default search engine in browser settings takes 30 seconds.
The intermediate stack — addressing what the foundation misses
Firefox with Strict ETP, or Brave browser: a privacy-respecting browser is a force-multiplier for the other tools. Firefox’s Enhanced Tracking Protection in Strict mode blocks trackers, fingerprinters, and cross-site cookies at the browser engine level — before extensions even act. Brave adds built-in fingerprint randomisation alongside ad blocking. Either browser provides protection that Chrome with extensions cannot fully replicate due to Manifest V3 restrictions. Our guide on securing your browser covers the full comparison.
DNS over HTTPS provider (NextDNS or Cloudflare 1.1.1.1): DNS queries reveal every domain the device contacts. Encrypting these queries (Settings → Security → Secure DNS in Chrome; about:config in Firefox) prevents the ISP from logging browsing destinations. NextDNS additionally filters known tracking domains at the DNS level — a network-wide equivalent of uBlock Origin for all devices, including phones and smart TVs that can’t run browser extensions.
Email alias service (SimpleLogin or AnonAddy): every account signup that uses the real email address adds it to a database that may be sold, breached, or used for targeted advertising. An alias service provides unique per-service addresses that forward to the real inbox. When a service is breached or starts spamming, disabling the alias ends all contact from that source without affecting the main inbox. Both have generous free tiers for most individual needs.
Privacy Badger (EFF): uses heuristic detection — observing cross-site tracking behaviour — rather than fixed filter lists. Catches novel trackers that haven’t yet been added to uBlock Origin’s lists. Available for Chrome and Firefox; works alongside uBlock without redundancy.
Cookie AutoDelete: automatically removes cookies when a tab is closed, preventing accumulation of cross-session tracking data. Complements uBlock Origin by addressing the cleanup layer for cookies that do get set.
Online privacy tools — what each one actually protects
| Tool | What it protects | What it does NOT protect | Cost |
| uBlock Origin | Browser tracking scripts, ad networks, malicious domains | DNS queries, network-level surveillance, fingerprinting | Free |
| Privacy-focused browser (Firefox/Brave) | Fingerprinting, built-in tracking protection, telemetry | Network-level, DNS, account-level tracking | Free |
| DNS over HTTPS (NextDNS) | ISP DNS query logging, cleartext DNS surveillance | Destination content, HTTPS metadata, browser tracking | Free / ~$2/mo |
| Email aliases (SimpleLogin) | Email address identity linkage across services | Content surveillance, metadata, delivery tracking pixels | Free / $3/mo |
| Password manager | Credential reuse, account correlation by credential | Browsing tracking, fingerprinting, network surveillance | Free / $3/mo |
| VPN (Mullvad, ProtonVPN) | ISP traffic surveillance, public WiFi eavesdropping, IP tracking | Account-level tracking, browser fingerprinting, malware | $5–10/mo |
| Mullvad Browser | Browser fingerprinting (all users share identical fingerprint) | Account-level tracking if logged in, network surveillance | Free (+ VPN cost) |
| Tor Browser | IP address, network traffic, connection to destination | Account-level tracking if logged in, malware, endpoint surveillance | Free |
| Virtual card numbers (Privacy.com) | Payment card identity linkage, merchant data accumulation | Transaction metadata, account-level profiling | Free (US only) |
The table reveals the most important insight: no single online privacy tool protects everything. A VPN doesn’t protect against browser fingerprinting. uBlock Origin doesn’t protect against ISP DNS logging. Email aliases don’t protect against content surveillance. Building an effective stack means selecting tools that complement rather than duplicate each other, with each tool addressing the vectors the others leave uncovered.
The advanced layer — for higher-stakes privacy needs
Mullvad Browser is designed to make all its users’ fingerprints identical. Based on Firefox with Tor Browser-level fingerprint resistance, it provides the strongest anti-fingerprinting browser available for everyday use without routing through the Tor network. Paired with a VPN, it protects against the combination of IP-based and fingerprint-based tracking used to identify individuals.
Tor Browser routes all traffic through the Tor anonymity network — three volunteer-operated relay hops that obscure the connection between the user and the destination. The strongest available tool for anonymous browsing, but with significant trade-offs: notably slower speeds, compatibility issues with sites that block Tor exit nodes, and the requirement that no personally-identifying information be entered during the session (logging into any account breaks the anonymity). Appropriate for situations where the source of access must be concealed — not for routine private browsing.
VPN (Mullvad, ProtonVPN): encrypts traffic between the device and the VPN server, masking the real IP address and preventing ISP traffic logging. Worth using on public WiFi as a baseline protection and for reducing IP-based tracking. Choose providers with independently audited no-logs policies — not marketing claims alone.
Virtual card numbers (Privacy.com in the US, Revolut virtual cards in the EU) address the financial tracking layer — preventing payment card details from accumulating across merchants and limiting breach exposure to a single merchant’s isolated virtual card number. Particularly useful for online subscriptions that auto-renew; the virtual card can be set to single-use or merchant-locked.
Building a coherent stack — avoiding common mistakes
The most common mistake: installing multiple tools that protect the same layer while leaving adjacent layers unaddressed. Three VPNs on one device provide no more protection than one VPN — they add redundant cost and complexity while fingerprinting, DNS, and account tracking remain unaddressed.
A practical online privacy tool stack for most users:
- uBlock Origin in Firefox with Strict ETP → browser tracking addressed
- DNS over HTTPS to NextDNS → DNS surveillance addressed
- SimpleLogin email aliases for all new account signups → identity linkage addressed
- Bitwarden for unique credentials per service → account correlation addressed
- Mullvad or ProtonVPN for public WiFi and ISP surveillance when needed → network layer addressed
This stack costs approximately $10–15/month for the paid components (VPN + email aliases at paid tier, or just the VPN if using free alias tiers) and addresses every major tracking category. It’s not the maximum possible configuration — it’s the optimal one that provides strong practical protection without the usability trade-offs of maximum-privacy tools like Tor Browser for daily use.
Evaluating a tool before adding it
A browser extension that claims to protect privacy but sends your browsing history to its own servers is worse than nothing — it adds a new surveillance vector while providing the psychological comfort of having done something. Before adding any tool, check three things:
- Is the codebase open-source and auditable? Privacy tools with hidden code cannot be independently verified.
- What is the stated logging policy — and has it been independently audited? “No logs” marketing is easy; published independent audit reports are meaningful evidence.
- What is the business model? If the tool is free and not open-source, data is likely the revenue source. Subscription revenue from users is the model that doesn’t require selling user data.
Tools that satisfy all three criteria are the ones that genuinely deserve the “privacy tool” label. Tools that fail on any of them warrant skepticism proportional to the access they have to sensitive data. For a comprehensive current list of audited privacy tools by category, Privacy Guides (privacyguides.org) maintains an independently-curated, regularly-updated reference covering browsers, VPNs, email providers, and every tool category in this guide.
Maintenance — keeping the stack current
Online privacy tools need periodic attention — not constant management, but a quarterly check covers the most important maintenance items:
- Browser extensions: check for updates and verify the publisher hasn’t changed (extensions can be acquired by new owners who may have different data practices). Review what permissions each extension holds.
- VPN audit results: major providers (Mullvad, ProtonVPN) periodically publish independent audit results — check whether the provider has been audited recently and whether the results raised any concerns.
- DNS over HTTPS provider logging policy: review whether the provider’s stated policy has changed. NextDNS publishes a transparency page; Cloudflare publishes annual transparency reports.
- Email alias service: check free tier limits haven’t changed; verify aliases are still forwarding correctly.
- Browser privacy settings: major browser updates occasionally reset specific privacy settings to defaults — verify Strict ETP is still active and Secure DNS is still configured after major Firefox or Chrome updates.
The online privacy tools stack, maintained quarterly and built incrementally — one category at a time rather than all at once — provides lasting, practical privacy improvement. The foundation layer (uBlock Origin, password manager, private search engine) provides the majority of benefit for most users. The intermediate and advanced layers address progressively narrower but higher-stakes privacy needs. Build from the foundation outward, verify each addition is genuinely protective, and the stack compounds over time into something meaningfully more private than the default browser-and-Google-everything starting point.
Platform-specific privacy tool considerations
The stack above focuses on desktop browsers, but mobile and operating system-level tracking operate independently. A few platform-specific additions worth knowing:
Mobile (iOS and Android):
- Firefox Focus on iOS provides a tracking-protection browser for searches that shouldn’t tie to the main browser session
- On Android, Brave or Firefox with uBlock Origin provides the same browser-level protection as desktop
- DNS-level tracking protection for mobile apps (which can’t run browser extensions): configure NextDNS as a Private DNS in Android (Settings → Network → Private DNS → nextdns.io) or use the NextDNS iOS app to extend DNS filtering to all device traffic including apps
- App permissions review quarterly — location, microphone, and camera access are the highest-value tracking vectors at the mobile app layer
Windows 11 and macOS system-level tracking: operating systems collect diagnostic and usage data that is separate from browser tracking. Our guides on Windows privacy settings and iPhone privacy settings cover the OS-level controls that complement these browser and network-layer tools. If this sounds familiar, Protect Your Online Identity is worth a look.
The privacy tools that don’t work as advertised
Worth naming specifically because they’re commonly recommended in privacy circles:
- “Private mode” / Incognito: prevents the browser from saving local history and cookies — does not hide activity from the ISP, employer network, or websites visited. Not a privacy tool in the tracking-prevention sense. Useful for session isolation; misleading as a privacy claim.
- Free VPNs (as a category): the business model for free VPNs almost invariably involves logging and selling connection data — exactly the opposite of privacy protection. Hola VPN specifically routes user traffic through other users’ connections. HotspotShield and others have been found to inject tracking code. Free VPN = highly probable privacy risk.
- HTTPS Everywhere: now deprecated. Modern browsers handle HTTPS upgrading natively; this extension adds nothing in current browser versions.
- “Anti-tracking” browser extensions from companies with ad businesses: browser extensions from companies whose revenue depends on advertising have a direct conflict of interest with providing genuine tracking protection. Evaluate the business model before trusting an extension with full browsing history access.
Building a privacy stack that actually works requires the same skepticism toward the tools themselves that the tools are designed to create toward surveillance. The specific tools recommended throughout this guide — uBlock Origin, Firefox/Brave, Bitwarden, SimpleLogin, Mullvad, ProtonVPN — have track records, open-source codebases, and independent audits that distinguish them from the broader category of things called “privacy tools” that may offer no meaningful protection. Our guide on Browser Privacy Extensions covers an adjacent issue.
