It's easy to feel that personal privacy is a dead issue. Once you go online, your every action is exposed, either through data lost in a breach or misuse by advertisers and online merchants. But don't give up hope. You don't have to go totally off-grid to retain or regain control of your privacy. Smart people around the world have come up with a variety of programs to attack the problem from different directions—creating apps that range from VPNs to email providers that don't spy on you or share your data. You may have to lay out a little cash, but the alternative is using free services that pay themselves by monetizing your private data.
Like the internet itself, email was invented by optimists and academics who never dreamed that anyone would misuse it. Read someone else's mail? How rude! Fill up inboxes with unwanted junk mail? They had no idea what was coming.
One type of privacy app aims to protect the content of your email conversations from snooping and tampering. Preveil, Private-Mail, ProtonMail, and StartMail let you lock down your communications using a technique called public-key cryptography. All but Preveil use a protocol called PGP (Pretty Good Privacy) to generate a pair of keys, one public, one private. To send me a secure message, you encrypt it with my public key, and I decrypt it with my private key. Simple!
Using Preveil is even simpler, though. A high-tech system involving what they call wrapped keys means you never deal with a key, public or private. It does also mean you can't connect with users of other PGP-based services, but few consumers know how to set that up.
This public key technology also lets me send you a message that's digitally signed, guaranteeing it came from me, with no tampering. I simply encrypt the message with my private key. The fact that you can decrypt it using my public key means it's totally legit. ProtonMail and StartMail automate the key exchange process with other users of the same service, while Private-Mail requires that you perform the exchange yourself. With any of these, you can exchange secure messages with anybody who provides a public key.
Of course, not everyone has embraced public key cryptography for their email. With StartMail and ProtonMail, you can send encrypted messages to non-users, though you don't get the same level of open-source security. The service encrypts the message using a simple password, and you transmit the password via some avenue other than email, perhaps a secure messaging app.
Virtru offers email encryption for free, but only if you use Gmail, and only in Chrome. Like Preveil, it handles key management internally, though it doesn't use public-key cryptography. You send an encrypted message and the recipient clicks a button to read it, without either of you entering a password.
With the contents of your email conversations encrypted, no hacker can sniff out just what you're saying. However, your email address itself is exposed any time you send a message, buy a product online, or sign up for any kind of internet-based service. That might not sound problematic, but your email address is typically your user ID for many sites. A hacker who finds your email and guesses your weak password now owns the account. And, of course, having your email address floating promiscuously around the web just invites spam.
But how can you communicate without giving a merchant or service your email? The solution lies in a simple technology called a Disposable Email Address, or DEA. The DEA service provides and manages these addresses, ensuring that mail sent to them lands in your inbox, and that your replies seem to come from the DEA. If you're done dealing with a particular merchant, or if one of your DEAs starts receiving spam, you just destroy it.
Burner Mail, Abine Blur, and ManyMe are among the services offering DEA management. ManyMe is unusual in a couple of ways. First, it's free, which is uncommon. Second, unlike most such services it doesn't make you register a new FlyBy email (as it calls them) before using it. Say someone at a cocktail party asks for your email. You can make up a FlyBy address on the spot, without giving your actual email away.
Abine Blur takes the concept of masking your actual identity online to the next level. Besides masking your email address, it offers masked credit card numbers, different for each transaction. You load the masked card with exactly the amount of the transaction, so a sleazy merchant can't overcharge you or use the card again. It even lets you chat on the phone without giving your actual number.
It's worth noting that Private-Mail and StartMail also offer a modicum of DEA management. StartMail lets you manage up to 10 permanent DEAs, and an unlimited number of DEAs set to expire within two weeks or less. Private-Mail offers five alternate email identities, without full DEA management.
As they say, if you're not paying, then you are the product. You can surf the internet endlessly without paying a fee to visit specific sites, but those sites still work hard to monetize your visits. Advertising trackers plant cookies on your system, taking note when a tracker from an ad on a different website encounters that same cookie. Through this and other tracking methods, they form a profile of your online activity, a profile that others are willing to pay for.
Some years ago, the Internet's Powers That Be, recognizing that many users prefer not to be tracked, ginned up a simple Do Not Track message to be sent by the browser. This DNT system never became a standard, but all the top browsers adopted it anyway. It had no effect, because websites were and are free to ignore the header.
In place of the ineffectual DNT header, many security companies started devising active systems to identify and block ad trackers and other trackers. You'll find this feature as a bonus in many security suites and some privacy-specific products. Abine Blur, Ghostery Midnight, and ShieldApps Cyber Privacy Suite offer active DNT. Unlike most such implementations, Midnight deters tracker requests in any internet-aware application.
The trackers, in turn, invented a different technique for identifying individuals across different websites, relying on the ridiculous amount of information supplied to each site by your browser. This ranges from your IP address and browser version down to minutiae like the fonts installed on your system. There's so much information that trackers can create a fingerprint that's almost sure to identify you, and only you.
So, what can you do? Make a liar out of your browser, that's what. TrackOff mixes up the data sent from your browser so it's different for each website. Cyber Privacy Suite also scrambles your fingerprint. Important info still reaches the site, but not in a consistent way that could be fingerprinted. Steganos Privacy Suite once included a component to foil fingerprinting, but the latest edition has dropped that feature, along with its active Do Not Track component.
Using a Virtual Private Network, or VPN, disguises your IP address but leaves plenty of data unchanged for the fingerprinters. Even so, keeping your internet traffic encrypted and having your IP address hidden are valuable ways to protect your privacy. In addition to their other privacy components, Ghostery Midnight and Cyber Privacy Suite include VPN protection.
Passwords are terrible, but we don't yet have a universal replacement. For security, you must use a different non-guessable strong password for every secure site. The only way anybody can accomplish that feat is by relying on a password manager. Unless you use a different strong password for every website, a data breach on one site could expose dozens of your other accounts.
In a perfect world, you already have an effective password manager in place, and you've taken the opportunity to fix any weak or duplicate passwords. On the chance you aren't already equipped, some privacy products have taken to including password management as a bonus feature. Abine Blur, for one, offers a complete, if basic, password manager. It even rates your passwords, giving extra credit for those logins that also use a masked email address.
You can get Steganos Password Manager as a separate program or as part of Steganos Privacy Suite. Either way, it's not a standout. You're probably better off with a top-notch free password manager. Cyber Privacy Suite seeks passwords stored insecurely in your browsers and moves them to encrypted storage, but doesn't do any password management beyond that protective step.
Icloak Stik is a tiny, bootable USB device that provides you with an entire private operating system; more about that below. Within that private OS, it offers the One Ring password manager built into the Tor Browser. That's important, because your existing password manager won't work in the Icloak environment.
Just as your private data can be exposed in many ways, software companies find a variety of ways to protect it. One unusual service comes from Abine DeleteMe. Rather than create disposable email addresses, this service attempts to clean up your existing email and other personal data. It searches dozens of websites that legally aggregate public information. Wherever it finds you, it sends an opt-out request to remove your data. This process can't be fully automated, so DeleteMe is relatively expensive.
Icloak Stik takes privacy to an extreme. You plug this tiny USB device into any PC, Mac, or Linux box and reboot. The Linux-based operating system that comes up resides entirely on the USB device. If you don't need to copy any files to the device, you can pocket it after booting up. And you can hide your IP address by going online with the Tor Browser. Once you shut down the host device, all traces of your session vanish.
If a malefactor steals your laptop or otherwise gains access to your PC, your private data could still be safe, provided you've encrypted it. We've covered numerous products solely devoted to encrypting files, folders, or whole drives. Some privacy products broaden their protection by including encryption. Steganos Privacy Suite, for example, includes the Steganos Safe encryption tool, also available as a standalone product.
Private-Mail goes beyond the usual features of encrypted email by giving you an online area to store encrypted files. You can encrypt files using PGP or using a simple password, and you can even share your encrypted files with others.
With Preveil, storing essential files in your encrypted cloud is a snap. You just treat that cloud like any other folder. Sharing with other Preveil users is also easy.
Virtru doesn't offer cloud storage, but it gives you unusual control over your messages and attachments. You can set messages to expire, disable secure forwarding, and add a watermark to some kinds of attachments. You can also convert attachments into a protected form that only the recipient can view, just like a Virtru message.
When you set up an encrypted email system or a disposable email address manager, your account password is a potential weakness. If you use an easily-guessed password, or if a stranger shoulder-surfs your login, you could lose control of your privacy protection. That's where two-factor authentication comes in.
The concept is simple. With two-factor authentication, logging requires at least two of the following: something you know (such as a password); something you have (such as an authentication app); or something you are (such as a fingerprint). Quite a few of the privacy tools examined here offer a two-factor option, specifically Abine Blur, Burner Mail, Private-Mail, StartMail, and Steganos Privacy Suite.
All these products rely on Google Authenticator or another Time-based One-Time Password generator. To get started, you use your authenticator mobile app to snap a QR code provided by the privacy program. Enter the code generated by the app and you're done. Now, your password alone doesn't grant access to the privacy program. A password thief won't be able to enter the code from your authenticator app, and hence won't get in.
Preveil also provides a degree of two-factor authentication by the very nature of its encryption. Connecting to your encrypted mail is easy and automatic provided that you have access both to the email account and to a trusted device. An evildoer who cracks your email account still won't gain access to your encrypted mail and files. And if you lose a trusted device, you can cancel your trust.
As for Virtru, it doesn't require a password and doesn't offer two-factor authentication. You prove your identity by logging into your Gmail account. That being the case, you'd do well to protect that Gmail account using two-factor authentication.
These aren't the only programs for protecting your privacy, and this isn't an exhaustive list of privacy-cloaking techniques. However, all these programs do their best to keep you safe from advertisers, spies, and creeps online.
Abine Blur Premium
Your subscription to Abine Blur Premium brings a veritable smorgasbord of privacy-enhancing features and services. Its masked emails feature automates the process of using a different disposable email address for every transaction. If one of those masked emails starts getting spam, you can just delete it, and you know which merchant sold you out.
What's the use in masking your email when you're giving the merchant something even more sensitive—your credit card number? Blur masks card numbers, too, and each masked card only has enough value to pay the particular transaction. No shady merchant can charge you extra, or fake another transaction on your card.
You can have all the masked emails you want, but masked cards require a small payment, because Abine expends resources processing the payment. Masked phone numbers are still more limited; you get just one. But when you use that masked phone number, you can be sure your contact won't benefit by selling it to robocallers or text spammers.
It's a small step from tracking your disposable email addresses to tracking your logins for all those websites. Blur includes a complete, if basic, password manager. Most password managers praise you for using a different password at each website; Blur gives you extra credit if you also use a masked email address for each.
Blur securely syncs your password and payment data across all your PCs, Macs, and mobile devices. Its browser extensions offer full access to program features and include an active Do Not Track component that foils advertisers and other trackers. On top of all that, Blur spells out how it handles your data in clear, simple detail. It's a cornucopia of privacy protection.
Preveil
Preveil lets you exchange encrypted email without having to switch to a special, new email account. You just keep using your existing email with Gmail, Outlook, Apple Mail, or the Mail apps built into Android and iOS. Using it with another email client requires a little work, but it's possible. You don't have to memorize or exchange passwords. The combination of access to your email account and use of a trusted device authenticates you.
With almost any encryption system, losing your master key or password means you lose access to your files. Some even make you accept a disclaimer to that effect. Preveil offers an unusual system from the deep reaches of crypto technology. Called Shamir's Secret Sharing, it lets you set up a pool of fellow Preveil users who can help you regain a lost key. They don't get any access to your key, but several of them working together can rebuild it for you.
Preveil brings top-tier enterprise-grade encryption technology to the consumer, yet presents it in a user-friendly way. This free solution is our Editors' Choice for email encryption.
ProtonMail
You use ProtonMail the same way you'd use any web-based email service. The difference is that email conversations with other ProtonMail users are automatically protected using public key encryption. The same is true for any correspondent whose public key you've imported. You can also send encrypted mail to outsiders using a simpler form of encryption.
If you don't need more than 150 messages per day and 500MB of storage for email, you can use ProtonMail for free. Even a paid subscription isn't expensive, at $5 per month or $48 per year. The paid edition gets you 1,000 messages per day, along with the ability to create up to four protected email addresses, full tech support, and 5GB of email storage. This is a simple, solid email encryption solution.
TrackOFF Basic
Advertisers really care what you do online. The better they can profile you, the more they can target ads. A nice juicy personal profile is also a commodity they can sell. With the proliferation of active Do Not Track systems, some trackers have switched to a technique called browser fingerprinting. And TrackOFF Basic stands square in their way, ensuring that your browser does its job without painting a target on your back.
Every time you visit a website, your browser sends a ton of information. It has to send your IP address, to receive the requested pages. But it also sends the browser version, OS details, even the fonts installed on your PC. Nominally, this information helps the website fine-tune your browsing experience. But there's so much data spewing from the browser that trackers can easily create a unique fingerprint, and thereby recognize you when you visit a different site.
TrackOFF doesn't suppress the info coming from your browser, as that could cause problems with some sites. It just mixes things up a little, presenting a slightly different fingerprint to each website. It does cost $34.95 per year, but that's fine for some tracking-sensitive souls.
Virtru Email Protection for Gmail
Like Preveil, Virtru is a consumer product that takes advantage of technology developed for the corporate world. Also like Preveil, it's free, and doesn't require that you change your email address. However, it only works with Gmail accounts, and only if you access them using Chrome.
Corporations can set up in-house handling of encryption keys. With the consumer edition, Virtru takes on that role. You never enter a password or share a key. By logging in to your Gmail account, you get full access to your encrypted email. If that seems unsafe in any way, consider enabling two-factor authentication for Gmail itself.
Virtru offers unusual control over your encrypted email messages. You can set them to expire after a fixed time, and change that time (or revoke access) even after sending the message. You can control the recipient's ability to forward secure messages. And you can watermark certain attachment types, to prove they came from you.
Yes, only those who access their Gmail on Chrome can make use of this tool. But the pools of Gmail users and of Chrome users are large enough to guaranteed quite a few potential users.
Abine DeleteMe
Some DEA services require you to create a new, pristine email account to receive the mail from your disposable addresses, while others feed directly into your existing inbox. The latter approach is more convenient, but it comes with a problem. Your email address, along with other personal information, is already scattered across the interwebs. Completely wiping that information from the web is impossible, but Abine DeleteMe does everything that is possible to minimize your exposure.
DeleteMe scans websites for dozens of information aggregating websites. These sites legally collect public information and make it easy to find. They also legally must remove your info if you so request. DeleteMe automates the opt-out process as much as possible. However, automation isn't possible in some cases, so Abine retains a staff of human operators to handle those. Every six months, you get a report of what DeleteMe found, and what was removed.
Unlike automated opt-out algorithms, those human operators must be paid. That's why DeleteMe costs more than most privacy services, $129 per year. You can often find discounts, or deals to add a family member.
Burner Mail
In the movies, spies use burner phones to communicate, destroying the phones after an operation. Burner Mail applies the same concept to email. Its browser extension (for Chrome or Firefox) detects pages that prompt for an email address and offers to swap in a burner address instead. Messages still reach your regular email inbox, and your replies seem to come from the burner address. If one of those addresses starts getting spam…burn it!
Burner Mail gives you more flexibility than some competitors. As noted, it doesn't require you to create a new email address to receive your messages. You can even change the recipient for a particular burner, or assign more than one recipient.
Burner Mail sticks to the task of providing and managing burner addresses and for $29.99 per year, it does that one job well.
Icloak Stik
Most privacy products aim to protect your privacy from internet threats or other external forces as you reach out from your secure home devices. The point of Icloak Stik is to allow you privacy even when you must use an unknown, unfamiliar, or even downright dangerous computer. Insert this minuscule, bootable USB device into any Windows, macOS, or Linux device, reboot, and you're running your own private OS, completely separate from the installed operating system.
If you need to save files, you save them on the Icloak Stik itself. Don't need any files? Then you can pop it back in your pocket as soon as the foreign computer has fully booted.
You do have to deal with the Stik's own OS, which is a modified version of Linux that could use some more pruning of unnecessary features and settings. And you'll have to get used to the built-in password manager, word processor, and other apps, as the host system's programs aren't available. But all that may be well worth the trouble, given that you can boot the device, get online, do whatever you want, and then depart, leaving no trace.
Icloak Stik goes for a one-time cost of $99, with unlimited security upgrades.
ManyMe
In one sense, you get most free webmail services by paying with your privacy. It only makes sense that if you want to preserve your privacy, you'll have to shell out cash. Not with ManyMe. At present, the DEA service is entirely free, with plans to make money on a feature-enhanced paid edition.
As noted, ManyMe differs from many competitors in that it doesn't require you to register DEAs (which it calls FlyBy addresses) before using them. Start with your account name, append a period and any phrase, and you've got a FlyBy, something like [email protected].
The service does have a few limitations. In testing, we found that its security precautions prevented communication with certain email systems, including PCMag's own. Your main account email address can never be changed after the initial signup. And it doesn't offer two-factor authentication. Still, you can't beat the price!
Private-Mail
You don't have to pay to encrypt your email using Private-Mail, but if you really get into it you're likely to run into the limit of 100MB storage for messages. No problem; when that happens, it's clearly time to spring for the paid edition, which gives you 10GB of message space.
Private-Mail relies on public-key cryptography, specifically using OpenPGP to generate public / private key pairs. Where most competing products automate the process of key exchange with other users of their service, Private-Mail makes key exchange a hands-on operation. In addition, where others can send encrypted messages with rich formatting, Private-Mail strips all formatting when it encrypts.
This service does have the unique ability to store and sync encrypted files for you, up to another 10GB of file storage. In addition, you can share encrypted files, using public key cryptography for those with whom you've shared keys, and simple password-based encryption for others.
At $69.99 per year, Private-Mail costs a bit more than StartMail and more than twice as much as ProtonMail. But if you need both encrypted email and encrypted file sharing, it can be a good bet.
StartMail
We've talked about protecting the content of your emails using encryption, and keeping your email address private using Disposable Email Addresses. StartMail handles both tasks, though there are limits on its DEAs.
You can exchange PGP-encrypted mail with other StartMail users, or with anyone whose public key you've recorded. A secondary password-based encryption system lets you converse securely with those who haven't signed up for public key cryptography. And your messages can include formatting, images, even attachments.
As for disposable email addresses, which it calls email aliases, you can create and use an unlimited number of temporary ones. Temporary aliases expire after a fixed time, no more than two weeks. Permanent aliases are also available, but only 10 at a time.
You pay $59.95 per year for the whole StartMail package. At present, the service is in transition to a new, improved user interface, with some features still available only through the old interface. That confusion should settle going forward.
Ghostery Midnight
Ghostery has long offered ad and tracker blocking in the form of browser extensions. The new Ghostery Midnight works below the browser level. In fact, it can block ads and online trackers for any internet-aware application.
Midnight also incudes a basic VPN, with no configuration settings and a very limited set of server locations. It costs significantly more than any of our Editors' Choice VPNs. In our speed testing, it had a massive effect on latency but didn't slow downloads much. And it has the unusual advantage of no cap on the number of simultaneous connections.
ShieldApps Cyber Privacy Suite
ShieldApps Cyber Privacy Suite includes many features aimed at protecting your privacy. Among other things, it moves exposed passwords from your browsers into encrypted storage, finds and deletes personal information stored in your browsers, and cleans up browsing history and cookies. If it finds documents containing sensitive personal data, it lets you move those to storage.
Real-time protection includes active Do Not Track for browsing, as well as a component to scramble browser fingerprints. A component devoted to steering you away from malware-hosting websites works for any browser, but proved ineffective in testing. While a tech-savvy user could perform some of this suite's tasks by hand, it's a convenient collection for the user with more interest in privacy than tech ability.
This suite also incudes a basic VPN, with no configuration settings and a somewhat limited set of server In our speed testing, it had a larger than usual effect on latency but didn't slow downloads much. Note that you just get three simultaneous connections, where most standalone VPNs give you five, and many give you even more.
Steganos Privacy Suite
When a privacy product must continuously offer its services, whether to encrypt email messages, manage disposable addresses, or store passwords online, it makes sense that users pay a yearly subscription. Steganos Privacy Suite does include a password manager, but its encryption solution resides and works entirely on your local PC. It's no big surprise, then, that you pay a one-time fee for this suite, rather than an ongoing subscription.
The most impressive component of this suite is Steganos Safe, a multi-faceted file encryption system. It used to include an active Do Not Track browser extension, and the ability to tweak the information sent by your browser to prevent tracking via browser fingerprinting. However, those two features are absent in the current edition, and we weren't terribly impressed with the password manager.
Other privacy elements that have been dropped include: a shredder utility to securely delete files beyond the possibility of recovery; a tool to hide encrypted files within image or video files; a simple webcam privacy system that just disables the webcam; and an all-or-nothing ad blocker.