A VPN Is a Starting Point, Not a Complete Setup
If you already use a VPN, you are ahead of most internet users. Your traffic is encrypted and your ISP cannot log your browsing. But a VPN does not stop someone from guessing your recycled passwords, does not remove your home address from data broker sites, and does not block malware from running on your device.
Here are the seven tools that, together with a VPN, give you a genuinely solid privacy setup.
1. A VPN (If You Do Not Have One Already)
Start here. A VPN encrypts your internet traffic and hides your IP address from websites, advertisers, and your ISP. Use it whenever you are on public Wi-Fi and keep it running by default if you care about ISP tracking.
Our recommendation: NordVPN for most users, ProtonVPN if privacy is your top priority.
2. A Password Manager
Reused passwords are how most accounts get hacked. When one site in your history gets breached, attackers try those credentials on every other service. A password manager generates a unique random password for every account and stores them all behind one strong master password.
1Password is the best option for most people. Its Watchtower feature alerts you when a site you use has been breached, so you know immediately which passwords to change. It works on iOS, Android, Windows, and Mac.
3. Antivirus
A VPN does not scan files you download. If you open a malicious email attachment or install software from an untrustworthy source, antivirus is what catches the threat before it executes.
ESET runs lightest and suits gaming PCs or anyone who wants low resource impact. McAfee adds identity monitoring and parental controls if you need those features.
4. A Data Removal Service
Data brokers collect and sell your personal information, including your home address, phone number, and family details. These sites feed doxxing, targeted spam, and identity theft.
DeleteMe sends removal requests to 750+ broker sites using human-verified processes, so removals actually stick. Incogni automates the same process using GDPR and CCPA legal frameworks at a lower price.
If you are in the US and want comprehensive coverage, use DeleteMe. If you are in the EU or want a budget option, Incogni is the better pick.
DeleteMe vs Incogni comparison
5. A Two-Factor Authentication App
Passwords alone are not enough. Two-factor authentication (2FA) means an attacker needs your password and a second factor (usually a time-based code) to access your account.
Use Aegis (Android) or Raivo (iOS) as local 2FA apps that store codes on your device without syncing to a cloud service. Avoid SMS-based 2FA when possible since SIM-swapping attacks can intercept text messages.
Enable 2FA on your email, banking, and any account with payment details first.
6. A Private Browser
Chrome sends browsing data to Google by default. Firefox is a better default for most users: it blocks third-party trackers, supports uBlock Origin (the best ad blocker), and does not build a profile of your browsing for advertising.
For higher privacy needs, Brave blocks ads and trackers at the browser level without extensions, and includes Tor integration for private browsing sessions.
7. A Secure Email Provider
Gmail scans your emails. The content of your inbox informs Google's advertising profile of you.
ProtonMail (now Proton Mail) is end-to-end encrypted, based in Switzerland, and free for basic use. If you are already using ProtonVPN, your account gives you access to Proton Mail at no extra cost.
Putting It Together
You do not need all seven tools at once. Start with what covers your biggest gaps:
- Already have a VPN? Add a password manager next. It has the highest impact per effort.
- Worried about malware? Add antivirus.
- Concerned about privacy and doxxing? Add a data removal service.
- Using the same passwords across sites? Password manager, today.
Each tool adds a layer. A VPN plus a password manager plus antivirus covers most of what the average user faces. The data removal service, 2FA app, private browser, and secure email are worth adding if you want to go further.