What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
You can substantially reduce tracking and account risk without a VPN, but no single setting makes you anonymous. Use layered controls: limit cookies and permissions in your browser and devices, block known trackers, use HTTPS, secure every account with unique passwords and multi-factor authentication, keep software and Wi-Fi equipment updated, and share less personal data. Each measure protects a different part of your digital footprint, while websites, apps, network providers, and anyone who gains access to your device may still see some activity.
Start by defining which privacy problem you are solving
“Privacy” covers several different risks. A control that stops a social network from reading your location does not stop an attacker from guessing your password, and a browser’s private window does not prevent your internet provider from seeing connections. Write down the observer and the information you want to protect before choosing a tool.
As an Amazon Associate I earn from qualifying purchases.
| Risk or observer | Useful controls | What can remain visible |
|---|---|---|
| Websites, advertising networks, and app trackers | Cookie choices, restrictive browser settings, permission reviews, tracker-blocking extensions, reduced ad personalization | The site can still receive information you submit; some trackers can evade filters |
| Someone on the same Wi-Fi network | HTTPS, secure Wi-Fi settings, current router software | Connection details and timing can still reveal that a service was contacted |
| Your internet provider | HTTPS; encrypted DNS can hide DNS queries from local observers | The provider or selected DNS service may still infer activity from connection information; encrypted DNS moves trust to another provider |
| An account attacker | Long unique passwords, a password manager, multi-factor authentication, phishing awareness, security updates | Information already stored in the account remains available to the service |
| Someone with access to your device | Screen lock, device encryption, separate user accounts, updates, backups | Data you intentionally leave accessible or synchronized elsewhere |
| Data brokers and public profiles | Remove unnecessary public details, review app sharing, submit opt-out requests where available | Opt-outs do not guarantee that every copy or record is deleted |
Electronic Frontier Frontier Foundation guidance describes this approach as defense in depth: several partial protections are more realistic than searching for one perfect privacy switch. A VPN can address some network-observation scenarios, but the steps below remain useful whether you use one or not.
Review browser and device privacy controls
Browser and operating-system controls are free, but they are fragmented. Review them on every browser, phone, tablet, and computer you use rather than assuming one change applies everywhere.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Make a cookie and site-storage decision
- Open the browser’s privacy or site-settings panel.
- Choose a restrictive option for third-party cookies when the browser offers one. Third-party cookies are placed by a domain other than the site you are visiting and can be used to connect activity across sites.
- When a consent dialog appears, reject optional advertising and personalization cookies if those choices are offered. Keep only the storage needed for the service you want to use.
- Review the browser’s list of stored site data and remove entries for sites you no longer use or that you want to sign out of.
Deleting cookies or history removes local records and may sign you out, but it does not erase information a website has already collected, copied to an advertising profile, or stored in an account.
Understand private browsing
Private or incognito windows are mainly a local-recording feature. They generally discard the session’s history, cookies, and form data when all private windows close. The Federal Trade Commission states: “Some have a private browsing mode that deletes your browsing history after you end your session, but it doesn’t block websites from seeing your online activity.”
A visited website can still see requests from the private window, and a logged-in service can associate activity with your account. A school, employer, Wi-Fi operator, or internet provider may also observe connections. Use private browsing when you want to keep a session out of the device’s ordinary history or separate temporary logins—not as an anonymity tool.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Turn off permissions you do not need
- On a phone, open the system settings and view the app-permission list. On a computer, use the browser’s site-permission page and the operating system’s privacy panel.
- Set location, camera, microphone, contacts, photos, Bluetooth, and local-network access to “Ask,” “While using,” or “Deny” unless an app genuinely needs continuous access.
- Remove permission from apps you no longer use, then uninstall those apps if they have no remaining purpose.
- Check whether an app can run in the background or use precise location. Choose approximate location or background denial where the feature still works.
Permission controls limit future collection; they do not retract data an app already uploaded. A weather app that previously received precise location may retain a history even after you switch it to approximate location.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Reduce advertising and social exposure
In your phone and browser settings, disable or reset the advertising identifier when that option is available, and turn off ad personalization if you do not want activity used to tailor ads. Review the visibility of your social profiles, friend lists, posts, tagged photos, contact discovery, and search-by-email or phone-number options. Remove public birth dates, home addresses, travel plans, and other details that an attacker could use for impersonation or account-recovery questions.
Use tracker blocking with realistic expectations
Tracker-blocking extensions and built-in content controls can filter requests to known advertising pixels, analytics endpoints, and other tracking domains. The FTC notes: “Some ad blockers let you block pixels and other trackers from gathering data on you.” That is a useful reduction in collection, not a guarantee of anonymity.
Choose an extension carefully
- Install from the browser’s official extension store or the developer’s clearly identified distribution channel.
- Read the requested permissions. An extension that can read and change data on every website deserves more scrutiny than one with narrowly scoped access.
- Check that the extension is maintained and explains how filter lists and collected data are handled.
- Keep a second browser profile available for sites that break when a script is blocked. Add a site exception only when you understand what will be enabled.
Know what a blocker cannot do
Blocking lists are based on known patterns. A first-party analytics system, a newly created tracking domain, fingerprinting, logged-in activity, or data shared directly by a site may not be blocked. A blocker may also allow some advertising needed for a page to function. It is not malware protection, a substitute for antivirus or safe downloads, or a way to hide your destination from a network provider.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Use HTTPS to protect data in transit
Look for HTTPS and the browser’s lock or security indicator before entering passwords, payment details, health information, or private messages. HTTPS encrypts the connection between your browser and the destination service. A person monitoring the network cannot read the protected content or the specific page path carried inside that connection.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
HTTPS has a precise limit. The destination website still receives information you type, files you upload, your account identifier, and technical details needed to deliver the page. Embedded services on that page may receive data as well. The Electronic Frontier Foundation cautions: “Just because a service uses HTTPS does not mean that the service fully protects the privacy of its users visiting its website.”
HTTPS also does not make a malicious site trustworthy. Check the domain name, avoid entering credentials after following suspicious links, and treat browser warnings as a stop signal. If a sensitive site lacks HTTPS or shows a certificate error, do not submit information until the problem is resolved.
Protect accounts as part of your privacy plan
An account takeover exposes private messages, saved files, contacts, purchase records, and sometimes the ability to reset other accounts. Strong account security therefore protects privacy directly.
Use a different long password for every account
- Replace reused passwords first on email, financial, health, cloud-storage, and social accounts. Email is especially important because it often controls password resets.
- Create a long passphrase or a randomly generated password for each service. Do not vary one base password by changing a final number.
- Store the passwords in a reputable password manager or another protected system so uniqueness does not depend on memory.
- Review breach alerts from each service and change a password immediately when the service reports exposure.
A unique password limits the damage when one company is breached. It does not prevent phishing, malware, or an attacker who already has an active session.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Enable multi-factor authentication
Turn on MFA in the account’s security settings, beginning with email and accounts that contain sensitive data. An authenticator app or a physical security key is generally a stronger choice than codes sent by SMS or email when the service supports it, according to FTC guidance. SMS can be exposed through number-porting attacks, while email codes depend on the security of the email account itself.
A FIDO-compatible security key is an optional physical second-factor device. It helps prove that you possess the registered key when signing in to a supported account; it does not hide browsing, filter trackers, or replace HTTPS. Register a backup factor and store recovery codes offline in a secure place so a lost key or phone does not lock you out.
Recognize phishing before it defeats MFA
- Open the service through a saved bookmark or a manually typed address instead of a link in an unexpected message.
- Check the complete domain name and the context of the request before entering a password or one-time code.
- Never approve an MFA prompt you did not initiate. Repeated prompts can indicate that someone has your password.
- Contact the organization through a known phone number or support page when a message demands urgent payment, login, or document access.
Keep devices and home Wi-Fi current
Install operating-system, browser, app, and router updates promptly. Updates often close security flaws that allow unauthorized access or data theft. Enable automatic updates where practical, but periodically confirm that they are succeeding and that old devices still receive security support.
Free tools Windows power users keep installed
One-click scans. No signup required.
Harden the device
- Use a strong screen-lock code or passphrase and a short automatic-lock interval.
- Enable the device’s built-in storage encryption and remote-find or remote-erase feature.
- Remove unused applications and browser extensions, especially those that have broad permissions.
- Keep regular backups of important files. Test that a backup can actually be restored, and protect at least one copy from ransomware by disconnecting it when not in use.
Secure the home network
- Change the router’s factory administrator password to a unique one.
- Use the strongest modern Wi-Fi security mode the router and your devices support, and set a new Wi-Fi passphrase.
- Install router firmware updates and disable remote administration unless you have a specific reason to use it.
- Review the connected-device list for unfamiliar phones, cameras, or smart-home equipment.
- Place untrusted or guest devices on a guest network when your router supports network separation.
These steps reduce the chance that someone can enter your accounts or devices. They do not prevent a website from recording activity after you connect to it.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Limit data you have already shared
Privacy protection is partly a cleanup exercise. Search your major accounts for connected apps, old sessions, saved payment methods, address books, and public profile fields. Revoke integrations you no longer recognize or use, sign out of old sessions, and delete obsolete accounts when the service provides a clear deletion process.
Review app and account sharing
- Remove third-party applications that have access to your email, cloud files, calendar, contacts, or social posts.
- Disable contact uploading and continuous address-book synchronization unless it is essential.
- Delete old location histories and voice recordings where the service offers those controls.
- Choose the minimum profile information required to use a service, and avoid publishing recovery answers or travel dates.
Consider data-broker opt-outs cautiously
Some data brokers provide an opt-out or removal form. Submit requests through the broker’s official process, keep confirmation messages, and schedule periodic checks because records can reappear from new public sources. Requirements and coverage differ by jurisdiction and company. An opt-out can reduce one listing; it does not guarantee deletion from every broker, public record, marketing database, backup, or copy held by another organization.
Understand what encrypted DNS changes
DNS translates a domain name into an address. Ordinary DNS lookups can be readable to a local network operator. Encrypted DNS protects those lookups between your device and the DNS service, which can prevent the local Wi-Fi operator from reading the requested domain names directly.
The privacy trade-off is important: the DNS provider you select receives the queries. Encrypted DNS moves visibility and trust; it does not eliminate them. The provider may also see the timing and source of requests, while websites can still observe connections and information you submit. Coverage, menus, and setup differ by operating system, browser, router, and network, so follow the current instructions for the platform you use and verify that the encrypted mode is actually active.
A practical layered setup
The following order gives the greatest benefit before you spend time on less central settings.
- Secure email first. Give it a unique long password, MFA, current recovery details, and a review of active sessions.
- Update everything. Install pending updates on phones, computers, browsers, apps, and the home router.
- Fix reuse. Change reused passwords on financial, shopping, cloud, health, and social accounts, using a password manager if helpful.
- Turn on MFA. Prefer an authenticator app or security key where supported; save recovery codes securely.
- Reduce permissions. Set location, microphone, camera, contacts, photos, and background access to the least permissive choices that still work.
- Adjust browser storage. Reject optional third-party cookies, clear unwanted site data, and use private windows only for local-history separation.
- Add a reputable tracker blocker. Check its permissions, keep it updated, and expect occasional site exceptions.
- Check HTTPS before sensitive submissions. Stop when the browser reports a certificate or connection error.
- Harden Wi-Fi and devices. Replace default router credentials, use current Wi-Fi security, enable screen locks and encryption, and remove unused software.
- Clean up shared data. Revoke old integrations, reduce public profile details, delete stale location history, and pursue relevant opt-outs.
- Evaluate encrypted DNS. Use it only after understanding which provider will receive your queries and how to verify the setting.
Common mistakes that undermine privacy
- Confusing private browsing with invisibility: it changes local retention, not what websites or network observers can see.
- Assuming HTTPS hides everything: it protects content in transit, while the destination still receives submitted data and can log visits.
- Treating an ad blocker as complete protection: known trackers may be filtered, but fingerprinting, first-party collection, and direct account data remain possible.
- Granting broad extension permissions without review: an extension can become another party able to read or alter pages.
- Using one password with MFA everywhere: a stolen password can still enable attacks against services without MFA and can fuel phishing.
- Ignoring recovery and backup planning: strong controls can lock you out if you lose a phone, key, or recovery code.
- Believing an opt-out erases history: removal from one broker does not remove copies held by every other organization.
- Moving DNS trust without noticing: encrypted DNS protects the path to the resolver, but the chosen resolver sees the queries.
What this approach can and cannot promise
Browser and device settings can reduce unnecessary collection. Tracker blockers can filter some known pixels. HTTPS can keep network eavesdroppers from reading protected content and specific page paths. MFA, unique passwords, updates, and secure Wi-Fi can sharply reduce account and device compromise. Data minimization and opt-outs can shrink the amount of information available for profiling.
None of these controls makes you wholly anonymous or prevents every website from seeing activity. A site can identify a logged-in user, collect data entered into its forms, combine signals from multiple devices, or use tracking techniques that a blocker does not recognize. Your network provider and DNS provider may still infer activity from the connections or queries they handle. The practical goal is not perfect invisibility; it is to give each observer less data, make unauthorized access harder, and understand exactly what remains visible.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
