KeePassXC stores passwords in one encrypted file, a .kdbx database, on a disk you control. There is no account and no cloud. It runs on Windows, macOS, and Linux. Browser integration and TOTP codes are built in. The project is open source and is the maintained community client for the KeePass format. The KeePassXC team […]
Proton Pass is the password manager from Proton. Clients are open source. The vault is end-to-end encrypted. Hide-my-email aliases are built in, so a signup form gets a forwarding address instead of your real one. The free tier is enough to try it. Extra aliases and some comfort features sit on paid plans or the […]
Vaultwarden is a community rewrite of the Bitwarden server, in Rust, small enough for a tiny computer at home. The official Bitwarden phone and browser apps talk to it. Your vault stays on hardware you can unplug. It is not Bitwarden’s server and it is not covered by Bitwarden’s audits. Features land when the volunteer […]
AdGuard DNS is a hosted encrypted resolver that drops a lot of ad and tracker domains before the page even loads. There is a family mode and a mode that only does security. Any device that can take a DNS hostname can use it. No app is required, though AdGuard also sells apps. It is […]
Pi-hole is a DNS sinkhole you run yourself, usually on a small computer on the home network. Devices use it as their resolver. Domains on your block lists get a dummy answer, so the ad or tracker never loads. The admin page shows which device tried to call which name. Pi-hole does not encrypt anything […]
/e/OS, from the Murena project, is de-Googled Android aimed at people who will not use a command line. There is an app store, an optional cloud, and phones sold with the system already installed. The default setup uses microG. That is an open reimplementation, and some features, such as push notifications, still go through Google’s […]
Ubuntu Touch is a Linux phone system maintained by the UBports Foundation. Google and Apple are not in the stack. The app store is its own. Fairphone, Volla, and Pine phones are the hardware people actually boot. Banking apps, ride shares, and anything that expects Google Play will not run. The catalog is small. Cameras […]
Quad9 is a recursive DNS resolver run by a Swiss foundation. The address most people use is 9.9.9.9, or the encrypted name dns.quad9.net. It refuses to resolve domains that threat-intel lists mark as malware or phishing, and it says it drops your IP address at the edge instead of keeping a query log tied to […]
NextDNS is a hosted resolver you configure like a firewall. Block ads, trackers, and malware lists per device. Turn the analytics off and it stops drawing you a graph of your own house. It speaks DNS over HTTPS and DNS over TLS, and it gives you a hostname to paste into Android Private DNS or […]
GrapheneOS is a hardened Android that only officially runs on Google Pixel phones. Play Store apps can be installed inside a sandbox: they run as ordinary apps, not as the privileged Google services on a stock phone. Verified boot, a relocked bootloader, and extra exploit hardening are the point. The modem is fenced off from […]
BellCrier breach check
Most people are, and never hear about it. BellCrier checks your email against known data breaches for free, then alerts you when it turns up in a new one, with exactly what leaked and how to fix it.
