General readers start here¶

Nobody specific is watching you. You would just rather not be profiled by platforms and ad networks, and would rather not lose an account one day. This applies to most people, and it is the shared baseline under the other four roles.

For comprehensive general guidance, EFF Surveillance Self-Defense and Privacy Guides go deeper than this site does and we recommend them directly. The path below is the short version, written with regional context where it changes the answer.

Three things you are probably dealing with¶

Every site wants an account, and the same password goes everywhere¶

One site leaks and the same credentials fall everywhere else. For most people this is how the first security incident happens.

The passphrase and password generator runs in your browser and uploads nothing.

Apps keep asking for permissions and it is unclear which to refuse¶

Location, contacts, photos. Most apps ask for far more than they need, and refusing rarely affects use. Most people simply have not had time to go through them.

How platforms collect your data covers how the collected pieces get combined.

Claims about private browsing and VPNs, with no way to judge them¶

Both have real uses, and both cover a much narrower range than the marketing suggests. Applied to the wrong problem they produce false confidence.

Networks mistaken for anonymity goes through what each one actually blocks.

Three pages for your first twenty minutes¶

What an ordinary person should actually do: ordered by real-world effect, and explicit about which measures are overestimated. If you read only one page, read this one
Passphrase and password generator: the lowest effort for the most direct effect, generate a few while you are there
Networks mistaken for anonymity: clear the misconceptions first, so effort does not go where it has no effect

Building the foundation over a week¶

Highest effect first¶

Getting started with password managers: one password per site, held by a tool rather than by memory
Email aliases, and who you hand your trust to: a signup address separate from your main one
Secure messaging compared: what to use day to day, and where each option stops

Understanding what is happening¶

Anonymity, privacy, pseudonymity, and confidentiality: four words routinely used interchangeably, which leads to picking the wrong tool
Metadata, and why it matters: who contacted whom and when, a layer content encryption does not cover
How platforms collect your data: how the fields you never filled in get inferred
A browser fingerprint cannot be cleared the way a cookie can: what remains after you clear everything

Tools that run in your browser¶

All three run on your own device and upload nothing.

What your browser gives away: see right now what your device is disclosing
URL cleaner: strip tracking parameters before sharing a link
File metadata stripper: coordinates in a photo are the most common leak

Going further¶

What is Tor?: most people have heard the name, and the uses and limits are worth reading properly
Interactive visualisations: walk through onion routing in 3D, faster than reading about it

What to take with you¶

Threat model checklist: three questions and you will know where your effort belongs. Answers are never stored and are gone on reload
The tools section works offline, see offline reading
Come talk in the public Matrix room

What this path does not cover¶

Someone specific is watching you: an ex-partner, an employer, or attention that comes with your work. Find the closest fit in scenarios, or go back to start by role for the other entry points
Speaking online from a jurisdiction with heavy platform controls: see posting on mainland Chinese platforms and speaking online from Singapore and Malaysia
An account already compromised, money already sent, a device lost, or stalking in progress: go to emergency help first. The helpline numbers there are Taiwan-specific, while the account, device, and connectivity sections apply anywhere