Personal Encryption 101

A beginner's guide to protecting your messages, masking online movements, and steering clear of digital snoops


This article is part of Reason's special Burn After Reading issue, where we offer how-tos, personal stories, and guides for all kinds of activities that can and do happen at the borders of legally permissible behavior. Subscribe Now to get future issues of Reason magazine delivered to your mailbox!

In 2016, a lone Romanian hacker going by the name Guccifer 2.0 claimed credit for the leak of sensitive internal Democratic National Committee emails. But the would-be hacker celeb's story was quickly debunked by a single nonmasked login from a device at the headquarters of the Russian intelligence service, thus turning what looked like a tech security problem into an international spy scandal. That high-stakes slip-up shows just how stringent one must be to get away with online chicanery these days, when one's every login and keystroke can be tracked through an array of digital identifiers.

But you needn't be engaged in espionage, or anything illegal, to benefit from better digital privacy practices. From surveillance-happy state actors and data-harvesting advertisers to popular email clients, social media apps, and other ubiquitous web tools, there are plenty of potential peepers looking to glimpse your digital data (and potentially share it with or sell it to others).

Traditional privacy protection methods—strong passwords and security questions, plus two-step authentication—are your first line of defense. But they may not cut it if convoluted terms of service give sites more leeway with your data than you realize, if hackers breach the servers where companies store your data, or if the authorities decide they want to see the contents of your texts, chats, and inbox.

"Email remains one of the least secure means of communication, and has been likened to sending a postcard—basically anyone along the way who's interested can read the contents of a message," writes journalist Jonas DeMuro in the U.K.'s TechRadar. This is because "an email is not a direct communication, but rather goes via several intermediaries…with multiple copies of the message stored at each server, and further copies on both the sender and recipient's computer." Deleting something, in other words, doesn't come anywhere close to actually eliminating it.

Email also typically lacks strong protections against access by law enforcement agencies. Under the Electronic Communications Privacy Act, authorities can obtain message content without a warrant after 180 days. (Many providers won't agree to give up your data without a warrant, but they could.)

True online anonymity requires elaborate measures—think a separate device for the anonymous identity, separate phone numbers, use of a virtual private network (VPN) for every login. But most people don't need, or even want, total anonymity.

For most of us, privacy can be drastically improved with a few simple (and free) tweaks and tools. In countries like Turkey, where many websites are censored, they can be essential for the most basic online communications. But even in the U.S. and other Western democracies, these services are enjoying a surge in popularity, thanks to sudden skepticism about the data-security practices of social media giants and increasingly invasive government speech codes for the digital sphere. If you too are ready to take back some of your online privacy, this is a guide to getting started.

To Keep Your Email Safe

Encryption, encryption, encryption. Encrypted email services scramble your data so only you and the message recipient(s) can view a readable version. The undecipherable copy is what passes through and gets stored on the email client's servers, so even if they're hacked, subpoenaed, or cursed with nosy employees, your messages can't be read.

The crowd favorite in this arena so far is ProtonMail, a Switzerland-based company that says it keeps its primary data center "at a secure facility 1 km under a mountain."

Joanna Andreasson

"Because data is encrypted at all steps, the risk of message interception is largely eliminated," the ProtonMail website notes. Emails are first scrambled on the user side, with a key the company can't access—which means even if it wanted to decrypt your mail, it would not have the technical ability to do so. (It also means that if you forget your password, you lose all your previous data.)

ProtonMail promises not to track user information, including metadata or IP addresses, a numeric designation that identifies a location on the internet; doesn't require personally identifiable information to create an account; and features an optional "self destruct" setting when emailing other ProtonMail addresses that automatically deletes a message from both the sender's and the recipient's accounts after a chosen interval. Basic accounts are free and come with 500 MB of storage. Paid accounts ($48 to $288 per year) offer between 5 GB and 20 GB.

In general, ProtonMail looks and works like regular email. Messages sent between ProtonMail accounts are automatically encrypted during transmission and on both ends. When communicating with a non-ProtonMail user, you must provide a security key if you want the email to be encrypted throughout transmission. Mail recipients will be directed to the ProtonMail site to decrypt the email and reply securely.

Over the past few years, ProtonMail has been rolling out an array of new security features, including encrypted contacts for Android and iOS devices and a service called ProtonMail Bridge, which syncs (paid) ProtonMail accounts with traditional desktop email clients such as Microsoft Outlook.

In addition to all this, the company espouses an old-school anarchic internet attitude that's a welcome contrast to most mainstream email providers. As federal authorities damn encryption as a threat to national security, ProtonMail has pushed back against the idea that only the lawless should embrace anonymous communication tools. "It is incorrect to say that using ProtonMail implies you have 'something to hide,'" said founder Andy Yen in a recent blog post. "ProtonMail provides more security and privacy compared to Gmail or other email services, and security is desirable for practically anyone that uses the internet."

Yen noted that "emails, encrypted or not, can be subject to subpoenas." But at least with services like ProtonMail, "it is not possible to obtain them from the service provider, and instead the subpoena must be served to the individual or organization under investigation."

Another service that gets good marks from privacy types is Tutanota, a German company that offers end-to-end encrypted email with 1 GB of storage for free, plus a paid version for those who need more space, multiple addresses, and other features.

As with ProtonMail, email between Tutanota accounts is always encrypted. Sending encrypted messages to a non-Tutanota account requires setting a password and providing it to the recipient in a separate, nonencrypted email. The recipient will be prompted to visit the Tutanota site and enter the password, and then he or she can read the message.

Like ProtonMail, Tutanota's rhetoric is admirably lofty. Last summer, co-founder Matthias Pfau told TechCrunch that "we at Tutanota see ourselves as Freedom Fighters. We believe in human rights such as our right to privacy and freedom of speech. But as these rights are being cut by governments around world, we need to fight back."

Belgium-based Mailfence operates much like ProtonMail and Tutanota. Its more robust accounts can be paid for using bitcoin. Disroot offers encrypted email as well as cloud storage and a host of other services, including a message board, a Twitter-like social media platform called Diaspora, and a browser-based text editor that can be set to "burn after reading," leaving no trace of the decrypted document on either the author or the reader end. The all-volunteer, Amsterdam-based team says it aims to create digital tools that are "open, decentralized, federated, and respectful towards freedom and privacy."

To Chat, Send Photos, or Make Calls Securely

Encryption is also the answer for protecting the secrecy of your more casual communications. There are several popular services right now that allow for the easy exchange of encrypted chat—consider this your alternative to both texting and the likes of Gchat, Facebook Messenger, and similar direct-messaging services—as well as offering ways to make calls and privately exchange photos or videos. The only catch is that your contacts are limited to those who are also using a particular service or app.

Joanna Andreasson

Which one you choose—Signal, WhatsApp, and Telegram are the three most popular—should depend on where you live, which apps are in use among your social and professional networks, how much security you're willing to exchange for other positive attributes, and how much faith you put in proprietary data systems. Your individual privacy concerns come into play as well: Is it government or service-provider snooping that concerns you? Are you trying to prevent people in your household from reading your texts? Do you need to be able to verify the identity of those you're messaging with? Do you mind giving out your phone number?

Telegram is not built on open-source software—a major strike against it, according to some privacy hawks—and the use of a proprietary encryption process is another potential black mark. The London-based service has also run into trouble in such countries as Iran and Russia, where authorities have demanded Telegram turn over info that would let them decrypt all user emails—Telegram declined—or moved to block the service altogether. But it has around 200 million active users per month and boasts large user bases in former Soviet Union countries and the Middle East, which can make it attractive for people with a lot of contacts there. And founder Pavel Durov at least pays lip service to the privacy-minded ethos that ProtonMail and Tutanota tout. "We don't regard Telegram as an organization or an app," he wrote in a March blog post. "For us, Telegram is an idea; it is the idea that everyone on this planet has a right to be free."

Privacy clearinghouse recommends against both Telegram and WhatsApp, a similar (and even more popular) chat platform. In general, the biggest complaint about the latter is that it collects user metadata—and that its parent company is Facebook.

The Electronic Frontier Foundation (EFF) has said on its blog that if pressed, it would recommend either WhatsApp or Signal, though it notes that it's difficult to "make a recommendation without considering the details of a particular person's or group's situation."

Overall, Signal gets the best ratings from the widest array of groups and people, especially if you're looking for strong security. Both Signal and WhatsApp "employ the well-regarded Signal protocol for end-to-end encryption," EFF noted, but "Signal stands out for collecting minimal metadata on users, meaning it has little to nothing to hand over if law enforcement requests user information. WhatsApp's strength is that it is easy to use, making secure messaging more accessible for people of varying skill levels and interests."

To Browse the Internet Anonymously

Most browsers now offer an "incognito" or "private browsing" mode that doesn't log your search or site-visiting history. But these functions only mask your trail locally (i.e., the pages you visit in an incognito window won't show up when you check your browser history). They don't mask your IP address or hide your identity from sites you visit.

Joanna Andreasson

No one app or fix will let you browse online totally anonymously, but the most simple and comprehensive option is to download the Tor browser. Tor—which works on Windows, Mac, Linux, iOS, and Android—is an open-source, modified version of the Mozilla Firefox browser that comes pre-installed with all sorts of privacy features. The bottom line is that it can keep your computer's address from being logged by websites.

"The Tor network is a group of volunteer-operated servers [that] employ this network by connecting through a series of virtual tunnels rather than making a direct connection," the Tor website explains. This lets people "share information over public networks without compromising their privacy" and serves as "an effective censorship circumvention tool, allowing its users to reach otherwise blocked destinations or content."

To supplement Tor, savvy web surfers may want to use a virtual private network (VPN). Normal browsers let your internet service provider (ISP) see every site you visit, in addition to your computer's personal IP address being visible to the sites themselves. VPNs prevent this by filtering your traffic through their network and serving it up with a new, masked IP address.

This means that your ISP records you going to the VPN but not to the sites you visit thereafter. In addition, the sites you visit see the IP assigned to you by the VPN, not your actual information. This can be especially useful for getting around geography-based content filters, like China's ban on many American sites and apps (often referred to as the "Great Firewall") and Russia's ban on everything from Telegram to, temporarily, Google.

The VPN also encrypts your traffic, so it's not accessible the way your browser history on a normal browser would be. Using a VPN is similar to using web proxy servers, which serve as a screen between your computer and your internet activity, except that VPNs also mask your identity when interacting online with games, torrent apps, and the like.

A word of caution: A VPN alone will not keep your emails safe if you're using a traditional email client. It will mask you from your ISP, but unencrypted copies of your messages will still be stored on email client servers.

VPN clients can be downloaded for use on computers, tablets, and smartphones. Some free VPNs that get consistently good reviews are CyberGhost, TunnelBear, and Windscribe. also has put out a list of recommended VPNs, all of which are based outside the U.S., use encryption, and accept bitcoin. ProtonVPN (associated with ProtonMail) is the only one of the most highly rated services that's also free; the others range from around $35 to $125 per year.

Regular browsers can be configured to offer more privacy through the use of various plugins. offers recommendations on that score as well. Of the most well-known browser options, Mozilla Firefox and Brave, from former Mozilla CEO Brendan Eich, are arguably strongest when it comes to security.

To Keep Your Search History Secret

When using typical search engines like Google, Yahoo, and Bing!, clearing your search history from your browser window doesn't mean it's actually gone forever. Your search log is stored by the search-engine company in question. To search without leaving a trail, try DuckDuckGo, which doesn't track any user data, or, which lets you use Google's search engine without being tracked by the tech giant.

To Make Your Go-To Tools More Secure

Gmail offers email encryption under some circumstances—if a user is on a Chrome browser or using a Gmail app and is emailing another Gmail address. But as TechRadar notes, "Google has become the Big Brother of the internet, and is known for reading user's messages, all in the name of targeting them with more relevant ads; there's privacy, and there's Google's idea of privacy."

Microsoft Outlook also has an encryption option, but it only works in limited instances.

If you're using a desktop email client, you may be able to use ProtonMail Bridge to add a layer of protection. The service integrates with Outlook, Apple Mail, Thunderbird, and similar options, serving as "a bridge between the unencrypted and encrypted worlds in the sense that it allows your average user to benefit from the added security and privacy of end-to-end encryption without having to make any changes to their email usage behavior," ProtonMail's Yen explained in a statement.

To Manage All Your Passwords

The best encryption plans in the world don't mean anything if you forget your passwords or if your passwords aren't secure. Consider ditching options such as iCloud Keychain, 1Password, and LastPass in favor of KeePass, a free, open-source password manager with strong encryption game.

Don't forget to check out the rest of Reason's Burn After Reading content.

NEXT: No, Repealing the Volcker Rule Won't Cause an Economic Collapse

Editor's Note: We invite comments and request that they be civil and on-topic. We do not moderate or assume any responsibility for comments, which are owned by the readers who post them. Comments do not represent the views of or Reason Foundation. We reserve the right to delete any comment for any reason at any time. Report abuses.

  1. To Chat, Send Photos, or Make Calls Securely:

  2. For the best email security, do not depend on a third party. Rather, use a heavyweight mail client, an application local to the system. I use Thunderbird on Linux, freeBSD and Windows. Then, install GPG (GNU Privacy guard) and Enigmail. This will allow you to use PKI encryption with others who install GPG and a PKI complien email application. There are other applications that use GPG and even a few for Android.

    1. These are great recommendations for hiding your content, but it doesn’t hide who you are talking to. That may be sufficient for many people’s needs, though.

  3. Always remember, if your data is stored on someone else’s server (what the business now calls “the cloud”) you don’t own it.

  4. Begin profiting week after week. This is a significant low maintenance work for everybody. The best part work from solace of your home and get paid from $500-$2k each week.Start today and have your first money toward the finish of this week.For More Info…

  5. If we’re talking specific companies:

    Nord VPN (based in Panama, outside the 14 eyes countries), has been selling three years worth of unlimited data for $99–for a long time. They keep no server logs.

    For email, Lavabit deserves a mention. The founder famously shut his service down rather than simply comply with a warrant (that turned out to be for Snowden), and when he reopened the service, it was with a new protocol that 1) leaves nothing on their servers to send in case of a warrant and 2) hides metadata, and 3) uses no server side key for encryption (everything is handled by the user).

    The advantage of KeePass XP is that it doesn’t store your passwords on a server. All passwords are stored locally. They have a browser add-in to facilitate pasting passwords from your local KeePass XP database, but passwords are neither stored on nor pulled across the internet. Note that there are several forks of KeePass. Make sure you get the version that is actively maintained.

    pCloud should be looked at as a replacement for DropBox. They’re based in Switzerland. Use Veracrypt to encrypt the files you store there.

    You can also use Veracrypt to encrypt your entire drive (in Windows). That being said, Windows can’t be adequately secured for privacy. Ubuntu just released a new LTS version of Linux that’s getting rave reviews.

    1. P.S. People who depend on the government to protect their privacy are like people who depend on the government to fund their retirement. Freedom is the ability to make choices for yourself–depending on the government to do for you what you should be doing for yourself makes you a psychological socialist. It’s a necessary step to being a welfare queen. It’s an abdication of personal responsibility and, therefore, an erosion of individual rights. You shouldn’t have to depend on the government to protect yourself from a home invasion, and people shouldn’t be impressed by those who don’t care enough about their own right to privacy to use free tools to protect themselves.

  6. If we’re talking specific companies:

    Nord VPN (based in Panama, outside the 14 eyes countries), has been selling three years worth of unlimited data for $99–for a long time. They keep no server logs.

    For email, Lavabit deserves a mention. The founder famously shut his service down rather than simply comply with a warrant (that turned out to be for Snowden), and when he reopened the service, it was with a new protocol that 1) leaves nothing on their servers to send in case of a warrant and 2) hides metadata, and 3) uses no server side key for encryption (everything is handled by the user).

    The advantage of KeePass XP is that it doesn’t store your passwords on a server. All passwords are stored locally. They have a browser add-in to facilitate pasting passwords from your local KeePass XP database, but passwords are neither stored on nor pulled across the internet. Note that there are several forks of KeePass. Make sure you get the version that is actively maintained.

    pCloud should be looked at as a replacement for DropBox. They’re based in Switzerland. Use Veracrypt to encrypt the files you store there.

    You can also use Veracrypt to encrypt your entire drive (in Windows). That being said, Windows can’t be adequately secured for privacy. Ubuntu just released a new LTS version of Linux that’s getting rave reviews.

  7. I think encryption is all well and good and if implemented right is probably unbreakable, but that isn’t what will get you. It’s going to be the connection points – how you initiate a communication, how it terminates, and who you are communicating with.

    To mitigate this aspect means coming up with a plethora of false online personas – one per communication endpoint, and even that seems defeatable by a motivated government.

    In the end the answer seems to me to be to keep those allowed to use force to an absolute minimum and under a tight leash.

    1. This article is meant for people who may have never really thought about encryption before. It’s an introduction, not exhaustive. It’s a ‘get your feet wet” kinda thing, and that’s a good thing. Libertarians should know this shit, and you gotta start somewhere.

      Using Cloudfare as your DNS server and encrypting your traffic with a Raspberry Pi device may not be for newbies, but it’s getting easier:

      “Cloudflare has promised not to log individuals’ DNS traffic and has hired an outside firm to audit that promise.”…..ypted-dns/

  8. What about cellphones and gadgets? What are the best phones to use to preserve privacy?

  9. In regards to WhatsApp, . . .

    If there’s anything stranger than Microsoft’s acquisition of GitHub the other day, it was Facebook’s acquisition of WhatsApp.

    There was an article in the WSJ yesterday about how the founders of WhatsApp are leaving a combined $1.3 billion in options on the table and leaving the company–because they’re disgusted by what Facebook wants to do to WhatsApp users’ privacy. All they had to do was stay with the company until November, and they’d be vested $1.3 billion in additional options! They’d rather walk away.…..1528208641

    Before you use WhatsApp as a privacy solution, ask yourself this: What do you know about Facebook’s plans for your privacy that the founders of WhatsApp don’t know?

    1. Agreed. I use the Signal app. Works great. Fuck FB.

      1. Signal isn’t anonymous. Non-anonymity is DANGEROUS.

  10. WhatsApp is reasonably secure from a messaging standpoint. The departure of Koum is likely about the use of metadata by Facebook (your contact list, groups, etc). Of course, there is always a risk that Whatsapp has code that can upload your private key on demand, but given how apps are de-obfuscated and decompiled, I think we would know about it.

    I do find it amusing that Reason puts out a piece like this, meanwhile their website has trackers and adnets galore.

    1. Worse than that is the simple fact that metadata IS SPYING, and can be more valuable than content. If you have to register, with personally-identifying info, then you are definitely being spied on, and in a bad way. It’s a real shame that such companies (Telegram, Signal, WhatsApp, Discord) have gotten good press, when they have made such a fundamental mistake. The government gets a record of exact identifiable particular persons, and their correspondence duration and times.

      That’s where Tox comes in. I’m not sure why Tox wasn’t mentioned. Tox is not reliant upon a central server, which means it’s not trivial to block. It has file transfer capability, audio and video calling, group conversations, is free, is available on iOS and Android, plus desktops, and obviously encrypts end-to-end. Tox doesn’t require registration.

      Tox is the easiest way for someone to transfer files to/from mobile devices, over the Internet, with end-to-end encryption.

      Tox isn’t perfect, though. Ricochet is better, but doesn’t have mobile versions available. Ricochet uses Tor, which means that even the NSA would struggle to know who’s speaking to whom.

      1. And I forgot to mention, you can use Tox over Tor – “ToT”. It’s simply a matter of configuring your Tox client. However, on mobile, you don’t have that luxury. Mobile has been neglected by the Tor community, overall, for shame.

  11. is a useful alternative for private email from any device and using a web browser. They also have an alternative to private keys, using a challenge question that only the recipient would know. The same outfit (based in the Netherlands) has an anonymous search engine, that is a good alternative.

  12. If this article is meant to be a “beginner’s guide” then advising against “options such as iCloud Keychain, 1Password, and LastPass in favor of KeePass” is bassackwards. All three options are pretty secure with the use of a strong master password and are more functional and usable than KeePass. KeePass is fine for single users with above average technical proficiency. It requires managing multiple files with good backups and additional steps to sync across devices.

    1. I would tend to agree.

      LastPass/1Password/etc only keeps the encrypted version of your password file. Decryption is done locally.

      In keeping KeePass backed up, and also synced between multiple devices you’ll probably end up using a cloud service at some point (not to say you couldn’t keep it local, but doing so would reduce functionality)

      That said, there is an advantage KeePass has over the online password managers. Because they play host to files that contain passwords for millions of people they are a big target.

      I use one of the online managers because its a lot easier than keeping KeePass synced among everything.

      1. What are both your thoughts on Enpass? That’s what I use. No cloud. Local to the device used. If you want to share over devices, you create the file, bring it to the other device and import it.

  13. Encrypting messages before you send them is another option. PGP is good for that and uses public and private keys. Messages encrypted with the public key can only be read by someone with the private key.

    The old one time pad is still unbreakable, but requires truly random keys and exchange of key pads. it’s good for short messages.…..imepad.htm

  14. After the July 2018 edition of Reason *burn after reading, I have a new found respect for Reason.

  15. For your email security and safety, don’t fully depend on the email service provider. You can do all possible things manually for secure and up-to-date your email service. There are many technical problems faced by email users, and they are looking for an email help desk to resolve their email queries.

Please to post comments

Comments are closed.