How to actually stay private online in 2026

Most “online privacy” advice is a VPN ad wearing a trench coat. Install this one app, pay $4.99 a month, done. It isn’t done. Real privacy is a stack of small, boring decisions across your identity, your accounts, your browser, and your devices, and most people only fix one layer and assume the rest is covered.

This guide is for people who actually want to reduce their exposure, not just feel better about it. I run infrastructure for a living, I’ve dealt with account takeovers, doxxing attempts, and data broker scraping on real operations, and what I’m laying out here is the same checklist I use on my own accounts. It’s not paranoid, it’s just complete.

By the end you’ll have a password manager with passkeys, hardware-backed 2FA, an email setup that doesn’t leak your real address everywhere, a browser that doesn’t fingerprint like a beacon, encrypted storage, and a VPN/Tor setup you’ve actually verified isn’t leaking. Budget a weekend for the first pass, then about an hour a month after that.

what you need

a password manager with a free tier (Bitwarden is what I use and what I’ll reference below)
a hardware security key, ideally two (YubiKey 5C NFC runs about $55 each; buy a backup)
an authenticator app if you don’t want to buy hardware keys yet (Aegis on Android, or a TOTP entry in Bitwarden itself)
a privacy-respecting email provider (Proton Mail free tier works; paid Mail Plus is $4.99/mo billed annually)
an email alias service (SimpleLogin, now owned by Proton, has a free tier with 10 aliases)
a no-logs VPN subscription (Mullvad is $5/mo flat, no tiers, accepts cash by mail)
20-30 minutes to check yourself against Have I Been Pwned and any data broker opt-out pages
full-disk encryption already built into your OS (FileVault on macOS, BitLocker on Windows Pro, LUKS on Linux) — no extra purchase needed
a terminal, if you want to run the verification commands below (optional but recommended)

Total hard cost if you buy everything: roughly $70 upfront for two hardware keys, plus $10-15/mo ongoing for VPN and email. You can do this for free minus the hardware keys if you use authenticator apps instead.

step by step

1. define your threat model before you touch a single setting

Write down, literally in a notes file, who you’re actually defending against: an ex who knows your usual passwords, a data broker selling your address, a random hacker running credential-stuffing lists, or a nation-state. 95% of people reading this are in the first three categories, not the fourth. The EFF’s Surveillance Self-Defense guide has a short threat-modeling worksheet that’s worth 10 minutes if you’ve never done this.

Expected output: a one-paragraph note describing who you’re protecting your data from and what the realistic worst case looks like.

If it breaks: if you genuinely can’t articulate a threat, skip to step 3 and just do the general hygiene steps. Threat-modeling paralysis is a real failure mode, don’t let it stop you from doing the basics.

2. find out what’s already exposed

Before adding new protection, check what’s already leaked. Run your primary and secondary emails through Have I Been Pwned. Then search your name plus city on Google to see what data brokers have indexed you.

Expected output: a list of breaches tied to your email (HIBP shows dates and what was exposed, e.g. passwords, phone numbers) and a list of data broker profile pages showing your address or phone number.

If it breaks: if HIBP shows a breach with a plaintext or reversibly-encrypted password, assume that password is burned everywhere you’ve reused it, not just on the breached site. That’s your priority list for step 3.

3. move to a password manager and turn on passkeys

Install Bitwarden, import your browser’s saved passwords, then go through your top 20 accounts (bank, email, social, work) one at a time and replace weak or reused passwords with generated 20+ character random strings. Where a site offers passkeys (most major ones do by 2026: Google, Apple, Microsoft, GitHub, Amazon), enable that instead of a password entirely. Passkeys are phishing-resistant because they’re bound to the origin domain, a fake login page simply can’t use them.

If you want to script the password audit instead of clicking through the UI, the Bitwarden CLI can export a report:

npm install -g @bitwarden/cli
bw login
bw unlock --raw > session.txt
bw get item <item-id> --session $(cat session.txt)

Expected output: your top 20 accounts have unique, generated passwords or passkeys, and Bitwarden’s built-in “weak password” report (Settings > Security > Password Health in the vault) shows zero reused passwords on critical accounts.

If it breaks: if a site doesn’t support passkeys and you don’t trust yourself to remember a manually-typed password, that’s fine, that’s what the manager is for. Don’t memorize passwords for accounts that matter, generate and store them.

4. add hardware-backed 2FA everywhere it’s offered

SMS 2FA is better than nothing but SIM-swapping is a real and common attack. Set your critical accounts (email, password manager itself, bank, crypto if you have any) to use a hardware key via FIDO2/WebAuthn, or at minimum a TOTP authenticator app. Register two keys per account where the site allows it, and store the backup key somewhere physically separate from your daily-carry one.

Expected output: logging into your email or bank now prompts for a physical tap or authenticator code, not just a password.

If it breaks: if you lose your only key and get locked out, that’s the scenario the backup key exists for. If you skipped the backup key, most providers have an account recovery flow, but expect it to take days, this is exactly why NIST’s digital identity guidelines push multi-factor over single-factor auth even with the recovery friction it introduces.

5. stop giving out your real email address

Set up Proton Mail as your primary inbox (their threat model page documents their end-to-end encryption approach if you want the technical detail). Then install the SimpleLogin browser extension and use it to generate a unique alias for every new signup going forward, [email protected] style. If an alias starts getting spam, you know exactly which service leaked or sold it, and you kill that one alias without touching your real address.

Expected output: new signups use a disposable alias, and you can trace any spam back to its source and one-click disable it.

If it breaks: if a service blocks alias domains outright (some do), use a dedicated secondary email you don’t mind burning, not your primary.

6. harden your browser against fingerprinting

Cookies aren’t the main tracking vector anymore, browser fingerprinting is. Your screen resolution, installed fonts, canvas rendering, timezone, and WebGL signature combine into a fingerprint that’s unique to you even with cookies cleared. Use Firefox or Brave with fingerprinting resistance turned on (privacy.resistFingerprinting in Firefox’s about:config), or run a hardened Chromium build. If you manage multiple accounts or personas and need real browser-profile isolation rather than just resistance, that’s a different category of tool entirely, worth reading a proper comparison like antidetectreview.org’s browser breakdowns before picking one, since the wrong one can make your fingerprint more unique, not less.

Expected output: running your browser through a fingerprint test shows a “not unique” or common-fingerprint result rather than a 1-in-a-million match.

If it breaks: aggressive fingerprint resistance sometimes breaks sites that do legitimate device checks (banking portals especially). Keep a separate, unhardened browser profile for those.

7. route your traffic through a verified VPN or Tor, and actually check it

Install Mullvad or a comparable no-logs VPN. Don’t just trust the “connected” icon, verify it. Check for DNS leaks from a terminal:

curl -s https://am.i.mullvad.net/json | python3 -m json.tool

This returns your visible IP, whether it’s a Mullvad exit node, and whether your DNS queries are actually going through the tunnel. For higher-sensitivity browsing, use the Tor Browser instead, it routes through three independent relays and doesn’t rely on trusting a single VPN provider’s no-logs claim.

Expected output: the JSON response shows "mullvad_exit_ip": true and your DNS is resolving through the VPN’s own resolvers, not your ISP’s.

If it breaks: if the check shows your real ISP IP or DNS servers, your VPN client’s kill switch is probably off, turn it on in settings so the connection drops entirely rather than falling back to your normal connection.

8. encrypt what’s on disk and what’s in transit

Turn on FileVault (macOS), BitLocker (Windows Pro/Enterprise), or LUKS (Linux) so a stolen laptop is useless without your login credentials. For messaging, move contacts to Signal, whose protocol is open-source and independently audited, over SMS or unencrypted chat apps. For files you need to send outside a messenger, age is a simple modern encryption tool:

age-keygen -o key.txt
age -r <recipient-public-key> -o secret.txt.age secret.txt

Expected output: your disk shows as encrypted in system settings, and sensitive files sent to others are unreadable without the recipient’s private key.

If it breaks: if you lose your FileVault recovery key or age private key, the data is gone by design, that’s the tradeoff. Store recovery keys in your password manager’s secure notes, not a sticky note.

common pitfalls

treating the VPN as the whole solution. A VPN hides your IP from the sites you visit, it does nothing about weak passwords, browser fingerprinting, or a breached email you’re still using.
reusing the “forgot password” email as the alias-generating email. If your alias service and recovery email are the same compromised account, an attacker who gets into one gets into both.
turning on 2FA but skipping the backup key. This is the single most common lockout cause I see. One key is a single point of failure.
assuming private browsing mode hides your fingerprint. Incognito clears cookies on exit, it does nothing about canvas or font fingerprinting.
doing this once and never again. Data brokers re-scrape and re-list you every few months. Set a recurring calendar reminder to redo step 2 quarterly.

scaling this

At personal scale (1 person, the setup above) the whole thing is a weekend project and an hour a month of upkeep.

At 10x, meaning a household or a small team of 5-10 people, the manual per-account walkthrough stops working. Move to Bitwarden’s organization tier so you can share credentials without ever revealing the plaintext password, and standardize on one hardware key model so you’re not troubleshooting five different UIs.

At 100x, a small business or agency, you need centralized policy enforcement, not individual discipline. This means SSO with mandatory hardware-key 2FA at the identity provider level (Okta, Google Workspace with security keys enforced), and a documented offboarding process so an ex-employee’s access is fully revoked, not just their email deactivated.

At 1000x, you’re managing infrastructure-level identity, and the problem shifts from “did each person do this” to “can the system fail open.” That means audited access logs, automated credential rotation, and treating any single compromised account as an assumed-breach scenario with blast-radius containment built in, not something you individually chase down after the fact.

where to go next

If you want to go deeper on any single layer, start with our password manager comparison for a full breakdown of Bitwarden vs 1Password vs KeePassXC, and VPN vs Tor, what’s actually different if step 7 left you wanting the full technical picture. Browse the rest of our guides at the blog index for account-hygiene and infrastructure topics we update regularly.

Written by Xavier Fok

disclosure: this article may contain affiliate links. if you buy through them we may earn a commission at no extra cost to you. verdicts are independent of payouts. last reviewed by Xavier Fok on 2026-07-16.