A privacy-first setup that does not break your computer
Four changes that matter and a long list that does not. How to reduce what a new PC reports without ending up with a machine that cannot log in to anything.
Privacy advice for a new machine tends to oscillate between doing nothing and breaking everything. The productive version is a short list of high-leverage changes, applied one at a time, with a restore point taken first.
The principle: change what is on by default, not what is possible. A setting you have to remember to re-apply after every update is not a control, it is a chore.
The four changes worth making
Use a password manager so every account gets a distinct password and two-factor authentication becomes manageable. Choose a browser that blocks trackers out of the box rather than assembling a stack of extensions. Turn on disk encryption for anything that travels. Keep the operating system updated, which fixes more real exposure than any privacy utility.
That is most of the return. Everything else on this list is marginal by comparison.
The tools this step calls for, with their real licence and platform details:
| Program | Licence / price | Platforms | Why it is on the list |
|---|---|---|---|
| Bitwarden Publisher's site ↗ | Free + paid tiers | Windows, macOS, Linux, Android, iOS | If you install one thing from this entire page, install this. The free tier covers unlimited passwords on unlimited devices with sync, and everything is end-to-end encrypted. Start here rather than with a paid competitor. |
| Firefox Publisher's site ↗ | Free · Open source | Windows, macOS, Linux, Android, iOS | The safest default for most people. It runs its own engine instead of Chromium, blocks trackers out of the box, and carries extensions the Chromium side is busy removing. Slightly rougher on a handful of Google properties. |
| VeraCrypt Publisher's site ↗ | Free · Open source | Windows, macOS, Linux | Creates encrypted containers and can encrypt a whole drive, including hidden volumes. The successor to TrueCrypt. Keep the password and the rescue disk somewhere you will still find them in two years. |
Encrypt the right things
Full-disk encryption protects a lost laptop. Encrypting individual files before they reach cloud storage protects them from a cloud account compromise, which is a more everyday problem for most people. They solve different threats and you may need both. Either way, write down the recovery information; encryption without recovery is a data-loss plan.
The tools this step calls for, with their real licence and platform details:
| Program | Licence / price | Platforms | Why it is on the list |
|---|---|---|---|
| VeraCrypt Publisher's site ↗ | Free · Open source | Windows, macOS, Linux | Creates encrypted containers and can encrypt a whole drive, including hidden volumes. The successor to TrueCrypt. Keep the password and the rescue disk somewhere you will still find them in two years. |
| Cryptomator Publisher's site ↗ | Free + paid tiers | Windows, macOS, Linux, Android, iOS | Encrypts files before they reach Dropbox, OneDrive or Google Drive, so the cloud provider stores scrambled data. The right tool if you must use a mainstream cloud but do not want to trust it. |
| KeePassXC Publisher's site ↗ | Free · Open source | Windows, macOS, Linux | A password database that is just an encrypted file on your own disk. No company, no account, no server to breach. You are responsible for your own backups, which is the trade you are making. |
What to leave alone
Do not stack four blocking extensions on a browser that already blocks trackers, do not install a second real-time antivirus, and do not switch every Windows telemetry control off in one pass. Overlapping blockers break login and payment pages in ways that look like broken websites, and a blanket hardening sweep makes an unrelated failure hard to diagnose. Change a few settings, use the machine for a day, then continue.
The tools this step calls for, with their real licence and platform details:
| Program | Licence / price | Platforms | Why it is on the list |
|---|---|---|---|
| O&O ShutUp10++ Publisher's site ↗ | Free · Closed source | Windows | A single portable screen of switches for Windows telemetry, ads, Cortana and background reporting, with a restore point button. Read each description before flipping it and you will not break anything. |
| BleachBit Publisher's site ↗ | Free · Open source | Windows, Linux | Clears caches, logs and traces from dozens of applications, and shreds files properly. Only useful if you understand what you are deleting. Windows' own Disk Cleanup covers the safe basics. |
Mistakes to avoid
- Believing a lock icon means end-to-end encryption. It describes the connection, not what the service can read.
- Assuming a VPN is a general privacy switch. It moves trust from your internet provider to the VPN provider; it is most useful on networks you do not control.
- Encrypting a volume without a written recovery path, then discovering the passphrase was the only copy.
Questions people ask
Is Windows Defender plus updates enough security?
For most home use, yes. The gap is almost always password reuse and unpatched software, not the antivirus product.
Will a privacy-focused browser break my work tools?
Occasionally. Keep a second browser installed for the one site that refuses to work, rather than weakening the daily driver.
Related guides
Or see all guides and category explainers.
How to read this page. How to read this page. Platform, licence and publisher details come from our directory data. Where an independent review, audit or survey is mentioned, it is summarised in our own words with the source named and linked; our /sources page sets out that policy. The recommendation, the trade-offs and every 'skip it if' line are our editorial judgement. We do not run benchmarks, publish measured performance figures or host installers, and every download link goes to the publisher's own site. If a detail is out of date, our About page explains how to tell us.