Security Checklist

Passwords are like underwear; you don’t let people see it, you should change it very often, and you shouldn’t share it with strangers.

Chris Pirillo

Privacy & Security is a process, not a boolean expression — trying to protect all your data from everyone all the time is impractical, expensive, and exhausting.

Creating a personalized threat model will serve as the foundation for an effective security and privacy plan.

Alright, here’s my security checklist:

Update Your Software

No matter the software is closed source or open source, always keep them up to date, and turn on automatic updates for your operating systems (Windows, macOS, Linux), web browsers (Chrome, Firefox, Brave, etc), and all the installed apps.

Upgrade your OS

Switch to a secure, privacy-friendly and open source operating system that doesn’t track and monetize your usage data.

You can use great operating systems like Qubes OS, Parrot OS, Tails or Whonix that come with lots of perks like compartmentalization, AnonSurf, etc.

Upgrade your Browser

Switch to a secure browser that protects your privacy, and keep your personal data secure while defending you from tracking, fingerprinting, and malicious advertising.

I recommend using secure and open source browsers like Mozilla Firefox, Brave, Tor browser, etc for better privacy and security.

  • Utilize the principle of compartmentalization by using different browsers.
  • Make sure your browser’s fingerprint is not unique
  • Install add-ons for privacy and security.

Upgrade your Search Engine

Switch to a private search engine that doesn’t track your search queries, location, etc and monetize it. Avoid using search on the browser where you are logged in with your online accounts.

I recommend using private search engines like Searx, DuckDuckGo, YaCy, etc that don’t track you.

Upgrade your Password Management

Switch to a secure password manager that can create and store unique passwords for each of the services you use. Do not use your browsers’ built-in password manager to store your passwords.

I recommend you using an open source password manager like Keepass XC or Bitwarden.

At the very minimum, use a strong and unique passwords for each of the high-value accounts like your Google, Apple, Microsoft, Email, Banking, etc.

  • Sign up and check for breach alerts on or Firefox Monitor.
  • Use a strong passcode / PIN for your phones.
  • Set up a mobile carrier PIN for protection from SIM Hijacking.

Use Two-Factor Authentication

Two-Factor authentication (2FA) protects your accounts even if your password falls into the wrong hands by adding an extra layer of security on top of passwords.

I recommend using open source app-based 2FA like Aegis Authenticator and Authenticator by Matt Rubin.

  • Don’t use 2FA via SMS, always choose App-based 2FA or hardware-based 2FA.
  • Avoid using your password manager for 2FA as it creates a single point of failure — defeating the purpose of 2FA.
  • Make sure your Backup codes are stored in a safe place.

Encrypt your Data

Always encrypt your phones, computers, and wherever you have your data as this adds a layer of protection even if your device is physically stolen.

All the operating systems, be it Windows, macOS, Linux, Android or iOS come with built-in options for encryption.

You can also use free and open source tools like VeraCrypt or 7Zip to encrypt your files.

Use an Encrypted Email

Switch to an encrypted and privacy-friendly email service provider that doesn’t read your email or collect data about your conversations to target you with ads.

I recommend using private and encrypted email providers like Tutonota, ProtonMail, Soverin, etc.

Use an Encrypted Messenger

Switch to a secure, open source, and end-to-end encrypted messaging app as this protects both the authenticity and confidentiality of the messages as they pass through any devices or servers.

I recommend using free and open source messaging apps like Signal, Riot, Session, etc.

Popular messaging apps like iMessage, WhatsApp, Viber, etc are not open source.

Use an Encrypted DNS

DNS or Domain Name Servers are the internet’s equivalent of a phone book, they convert domain names of websites like “” into IP addresses for your browser to connect.

I recommend using an encrypted and private DNS Resolvers like AdGuard DNS, Blah DNS, Cloudflare, etc as it will help prevent DNS hijacking, and can block malicious sites, ads, and trackers.

An encrypted DNS Resolver won’t make you anonymous, neither will it hide your internet traffic from your ISP.

Use a VPN

A VPN or a virtual private network encrypts your data preventing people from snooping on your traffic, it also helps you access restricted content.

I recommend using trusted VPN providers like Proton VPN, Mullvad VPN, etc that don’t harvest and re-sell your data as they will be the middlemen between you and the internet.

A VPN won’t make you anonymous, neither will it add any additional security to non-HTTPS traffic.

Review Privacy and Security Settings

Check location, camera, microphone, and other sensitive device permissions on your phone and computer. Make sure you trust apps with sensitive permissions, only allow selective apps permissions to access your calls, messages, camera, microphone, etc.

Check privacy and security settings of your online accounts like Facebook, Twitter, Google, etc, you can use an app like Jumbo Privacy or just go manually.

Backup, Backup, & Backup

Always take backups of your data on a regular basis — use the 3-2-1 golden rule of backups:

  • 3 — Keep 3 copies of any important file: 1 primary and 2 backups.
  • 2 — Keep the files on 2 different media types to protect against different types of hazards.
  • 1 — Store 1 copy offsite i.e. on cloud or somewhere outside your home or business facility

Antivirus, Anti Malware, and Firewalls

Protect your devices from viruses and malware attacks by using a trusted antivirus and anti malware software. You can check out AV-TEST for comparisons.

All the operating systems, be it Windows, macOS, Linux, Android or iOS already have some sort of protection built-in, make sure they are updated.

Use Common Sense

Most of the day-to-day attacks can be prevented by common sense, think before sharing personal information or clicking a link in your email. Keep learning, here are a few tips:

  • Install apps from trusted sources and analyze at
  • Use a webcam cover
  • Use a privacy screen to protect yourself from shoulder-surfing.
  • Clear cache, cookies, Internet history, temporary files, logs, etc using a privacy cleaner like BleachBit.
  • Remove Metadata from photos and other documents before sharing, you can turn off location-tagging in your camera settings.
  • Watch out for Key loggers & Rootkits using RootkitRevealer
  • Do not leave your Device Unattended
  • Watch out for Stalker ware and educate yourself about Phishing attacks: Phishing Quiz and Safe Quiz.

Additional Information

  • Surveillance Self-Defense: A curated collection of Tips, Tools, How-tos for safer online communications by Electronic Frontier Foundation.
  • Digital First Aid Kit: A free resource to help you better protect themselves and the communities they support against the most common types of digital emergencies, by Access Now.
  • Data Detox Kit: It is a great resource by Tactical Tech that gives you steps you can take to control your digital privacy, security, and well-being in ways that feel right to you.
  • OONI: Open Observatory of Network Interference is an app that measures Internet censorship by testing the blocking of websites and apps.
  • Security First: An app by Umbrella that gives you free digital and physical security advice when you need it most.
  • The KIT: It is a great resource by Tactical Tech, for those who believe in the power of information as evidence but who recognize that working with information does not necessarily lead to immediate results or desired changes.
  • JustDeleteMe: A directory of direct links to delete your account from web services.
  • Digital Security Helpline: It is Access Now’s Digital Security Helpline that works with individuals and organizations around the world to keep them safe online.
  • Transparency Reporting Index: A curated record of transparency reports from today’s leading internet companies and telcos.
  • Exodus Privacy Reports: The privacy audit platform for Android apps helping you know which trackers and permissions are embedded in apps installed on your device.
  • It is a curated collection of all kinds of awesome tools and resources.

These are some quick fixes you can do to help yourself, friends, or family get started on taking back their privacy and security online. I hope you enjoyed reading about these privacy and security checklist.

That’s all Folks!

I will be updating this page frequently with more information. You can check out all the privacy and security tools i recommend here.