Your complete free security setup: every tool, what it protects, and where to get it. No paid upgrades required for the baseline. Each item links to a full guide for setup details.
1. Password Manager
Tool: Bitwarden (free, open-source)
What it protects: Stops credential reuse attacks. One breach can expose every account where you use the same password. Bitwarden generates a unique 20+ character password per site and stores them encrypted. Your master password is never sent to Bitwarden servers in usable form.
Full guide: Best Free Password Manager →
2. Two-Factor Authentication App
Tool: Aegis (Android, open-source) or iOS Passwords app / Raivo OTP
What it protects: A second factor blocks account takeover even when a password is compromised. Authenticator apps generate time-based codes locally, with no network needed and no SMS interception risk. Enable on email, banking, and any account with payment information first.
Full guide: Best Free 2FA Apps →
3. Email Breach Monitor
Tool: HaveIBeenPwned (free) + ToolsFree breach alerts
What it protects: Tells you when your email appears in a breach database. A breach result means your password from a specific service was exposed. It does not mean your device is compromised. The action is to change that password and any accounts sharing it. Set up ongoing monitoring so future breaches reach you immediately.
Full guide: Free Email Breach Check →
4. Private DNS
Tool: Cloudflare 1.1.1.1 or Quad9 (both free)
What it protects: Your ISP logs every domain you visit through default DNS, regardless of HTTPS. Cloudflare 1.1.1.1 encrypts DNS queries so your ISP sees encrypted traffic instead of domain names. Quad9 additionally blocks known malicious domains. Setup takes under 5 minutes on Windows, Mac, iOS, or Android.
Full guide: Free Private DNS Services →
5. Browser Privacy Extensions
Tools: uBlock Origin (Firefox) + Privacy Badger (EFF) + Cookie AutoDelete
What it protects: Blocks third-party trackers that build advertising profiles across sites, removes cookies after tab close, and catches new trackers that blocklists haven't catalogued yet. On Chrome, install uBlock Origin Lite (reduced capability due to Google's MV3 extension restrictions). On Firefox, install the full uBlock Origin for maximum blocking.
Full guide: Free Privacy Browser Extensions →
6. Private Browser
Tool: Brave or Firefox with uBlock Origin
What it protects: Browser fingerprinting, cross-site tracking, and ISP-visible browsing. Incognito mode in Chrome does not protect against your ISP, employer network, or Google itself seeing your traffic. Brave randomizes browser fingerprints and blocks trackers at the browser level before extensions run.
Full guide: How to Browse Privately for Free →
7. Free VPN (for untrusted networks)
Tool: ProtonVPN free (unlimited bandwidth, no data cap)
What it protects: Encrypts all traffic between your device and the VPN server, hiding your IP and content from network operators. Important on public Wi-Fi (airports, hotels, coffee shops) where the network operator can intercept unencrypted traffic. ProtonVPN free covers three countries and one device, no credit card required. For P2P use or multiple devices, see the paid options.
Full guide: Best Free VPN → | NordVPN vs ProtonVPN Free →
What These Tools Cannot Do
Antivirus catches known malware, but ransomware, zero-day exploits, and social engineering sit outside what browser extensions and DNS privacy address. See the guide to free antivirus options for what Windows Defender covers and where it stops.
No combination of free tools prevents real-time phishing (you enter your 2FA code into a fake site) or SIM swapping attacks on SMS 2FA. Hardware security keys (YubiKey, ~$25) and authenticator apps instead of SMS 2FA address the remaining exposure for high-value accounts.
VPNs hide your IP and encrypt traffic. They do not make torrenting legal, prevent malware, or protect you from phishing. DNS privacy hides domain lookups from your ISP but not the content of requests or your identity to sites you visit.
Priority Order If You Can Only Do Some
Minimum viable security (30 minutes): Password manager with unique passwords everywhere + breach monitoring on your main email. This closes more attack surface than everything else combined.
Add next (45 more minutes): 2FA on email and banking accounts, private DNS on all devices.
Complete setup (remaining 15 minutes): Browser extensions + Brave or Firefox as default browser.
Situational: ProtonVPN free when connecting to public Wi-Fi.
Ongoing Monitoring
Set up free breach alerts to receive notifications when your email appears in new breach databases. The one-time setup takes 2 minutes and removes the need to manually recheck HIBP. Weekly security tool updates arrive in the same digest.
Honest Caveat
This checklist covers the tools available as of mid-2026. ProtonVPN and Bitwarden have both been audited; the others have open-source code available for review. Security software changes: companies get acquired, apps add cloud sync that changes their threat model, and browser extension capabilities shift with vendor policy changes (the Chrome MV3 situation is the current example). Revisit this setup once per year, or when you see news about a tool on this list.
Frequently Asked Questions
How long does it take to set up all these free security tools?
About 90 minutes for everything, done once. Password manager migration takes the longest — 30-45 minutes to import existing passwords and update duplicates. A 2FA app takes 15-20 minutes to set up across your key accounts (email, banking, social). Private DNS takes 5 minutes on any device. Breach monitoring is 2 minutes per email address. Browser extensions install in under a minute each. VPN setup is 5 minutes for ProtonVPN free. Most of this time is paid back immediately: fewer password resets, no "check your email" 2FA delays on SMS, faster page loads without trackers.
In what order should I set these up?
Password manager first, always. Every other security improvement compounds on having unique passwords per account. Without it, you can enable 2FA on every account and still be vulnerable if you reuse passwords — one breach exposes all accounts sharing that password. Order: (1) Install Bitwarden, import passwords, fix reused ones. (2) Run a breach check on your main email. (3) Enable 2FA on email and banking. (4) Set up private DNS. (5) Install browser extensions. (6) Optional: ProtonVPN free for untrusted networks.
Is free security software actually trustworthy?
The tools on this list are free for specific reasons: open-source (Bitwarden, Aegis, uBlock Origin — anyone can audit the code), nonprofit mission (Privacy Badger by EFF), or freemium business model with a paid upgrade path (ProtonVPN, Windscribe). These differ from "free" tools that monetize by selling your data. The key signal: open-source tools with published audit results (Bitwarden\
Do I need a VPN if I already use private DNS?
They protect different things. Private DNS (Cloudflare 1.1.1.1, Quad9) encrypts DNS queries so your ISP cannot see which domains you look up. A VPN encrypts all traffic and hides your IP address from the sites you visit. Your ISP sees an encrypted tunnel to a VPN server rather than your actual browsing. For most home internet use, private DNS alone provides meaningful improvement. A VPN becomes important on untrusted networks (coffee shops, airports, hotels) where the network operator could intercept traffic.
What one thing should I do if I do nothing else on this list?
Set up a password manager with unique passwords for every account. One breach exposes your password. If you reuse it, every account sharing that password is compromised simultaneously: email, banking, shopping, social. A unique password per site means any single breach is contained. Bitwarden is free, open-source, and works on every platform. This single change closes more attack surface than all other security improvements combined for most people.