Lock everything down. The settings that actually matter.

1Lock the account

• User Settings → My Account → Enable Two-Factor Auth with an authenticator app, or better a security key / passkey.
• Remove SMS backup there as well. SIM swapping beats SMS codes.
• Save the backup codes in your password manager, not as a screenshot.

2Privacy settings

• Content & Social: turn off DMs from server members by default, and only allow friend requests from friends of friends.
• Data & Privacy: turn off "use data to improve Discord" and "use data to personalise my experience".
• Activity Privacy: hide your current activity and Rich Presence. Games and Spotify reveal your schedule and time zone.

3Your profile gives you away

• Don't reuse the username or avatar you use anywhere else. A reverse image search connects them in seconds.
• Keep your real name, age, city, school and birthday out of your bio, pronouns, status and server nicknames.
• Mutual servers can be seen by everyone. They show your region, school and interests, so leave servers you don't need.

4What you post stays

• Public servers get scraped and archived. Treat every message as permanent, even after you delete it.
• Logging bots save deleted and edited messages, so "I deleted it" doesn't help.
• Remove metadata from photos and videos before you upload them. Check what's in the background (windows, letters, school uniforms, the view outside).

6IP address & links

• Voice and video chats go through Discord's servers, so other users don't see your IP there.
• Links are different: shortened links and "image" links can be IP loggers. Only open unknown links with a VPN turned on.
• Don't accept files or "call me on this app" invites from strangers. Stay inside Discord.

2Where it goes wrong

• Join logs posted to Discord webhooks: lots of servers post name, Discord ID, Steam ID and IP to a staff channel. Every staff member, every ex-staff member and anyone who gets that webhook can read it.
• Leaked databases: server databases get dumped and passed around, often with years of identifiers and IPs.
• Lookup bots & sites combine identifiers from many servers. Enter a Discord ID and you get the matching Steam profile, old names and IPs.

3How a dox chain works

1. The server log gives them your Discord ID + IP.
2. From the Discord ID they get your username history and your linked Steam, Spotify and Twitch accounts.
3. You use the same username on Instagram, TikTok or GitHub, and there's your face, school or city.
4. A breach of some shop or game turns up your real name and address.

Each step on its own looks harmless. Together they're a full dox, so break the chain wherever you can.

1One alias per service

• Use an alias service: SimpleLogin, addy.io, DuckDuckGo Email Protection, Firefox Relay or iCloud Hide My Email.
• A leaked alias can't be linked to your other accounts. You can turn it off, and you can see exactly who leaked or sold it.
• Keep your real address for banks, government and people you know.

2Give less data

• Skip optional fields: phone, birthday, gender, address. If a forum or game insists, it doesn't need the real one.
• Use guest checkout and don't let shops save your card.
• Use virtual or one-time cards for online payments where your bank offers them.

3Fewer accounts

• Delete accounts you no longer use. justdeleteme.xyz links straight to the deletion pages.
• In the EU you have the right to demand deletion (GDPR Art. 17) and to see what a company stores about you (Art. 15).
• Avoid "Sign in with Google/Facebook" on small sites, because it shares your profile.

4Contain the damage

• Unique passwords from a password manager. Then a breach only affects one account.
• 2FA with an authenticator app or passkey on everything important.
• Get breach alerts: subscribe at Have I Been Pwned and run the leak check every few months.

1Keep identities strictly apart

• Create a new e-mail, username and avatar for each identity, and never reuse them.
• Use separate browsers (or Tor Browser) for each one. Never log in to a personal account there, not even once.
• Never link the two: no shared friends, no shared payment method, no posting the same pictures or jokes.

2The right tool for the risk

• Everyday privacy: Mullvad VPN + Mullvad Browser.
• Real anonymity: Tor Browser on the "Safer" or "Safest" security level, with no add-ons and the window left at its default size.
• High risk: Tails from a USB stick, which leaves no trace on the computer.

3Metadata gives you away

• Photos contain GPS location and the camera model. Remove it with ExifCleaner (Windows/Mac) or mat2 (Linux).
• Word and PDF files store the author name and the computer username.
• Turn off remote images in your mail app. Tracking pixels reveal your IP and the time you read the mail.

4Behaviour

• Your time zone, language, typos, slang and when you're online can all identify you.
• Don't mention local events, weather, school, work or your age.
• Payments: bank cards and exchange crypto are tied to your name. Use cash, vouchers or Monero where anonymity matters.

1What it reveals and what it doesn't

• It reveals your internet provider and roughly your region, often only the city or the provider's hub.
• It doesn't reveal your street or your name. Only your provider can link those, and only for police with a court order.
• It does matter as one piece of the puzzle: an IP from the same city as your school, plus your first name, narrows it down a lot.

2How people get it

• IP logger links: shortened links, "look at this picture" links or fake clip links that log you before redirecting.
• Game servers and peer-to-peer connections (FiveM, Minecraft servers, some lobbies and voice apps).
• E-mails with remote images, i.e. tracking pixels.

3What attackers do with it

• DDoS: they flood your connection so you lag or drop out of games and streams.
• Intimidation: "I know where you live", usually after a city lookup.
• Pretext for swatting, combined with other data. An IP alone doesn't give an address.

1Turn off "find me by number"

• Instagram / TikTok: turn off account suggestions to contacts and to people with mutual connections, and turn off contact syncing.
• Snapchat: turn on Ghost Mode on Snap Map and limit "who can contact me" to friends.
• Telegram: Phone number → "Nobody", and set "Who can find me by my number" to "My contacts".

2What your posts give away

• School logos, uniforms, team jerseys, bus stops, house numbers and car number plates.
• The view from your window, which can be matched against street maps.
• Tagged friends and family whose profiles are public.

3Lock the profile

• Make the account private, hide your followers and following lists, and turn off activity status.
• Only allow tags and mentions from people you follow, and approve tags manually.
• No birthday, no full name, no city in the bio.

1Settings → VPN settings

• Launch app on start-up + Auto-connect: on - you are never online without the tunnel.
• Lockdown mode: on - blocks all traffic whenever the VPN isn't connected. The kill switch is always on anyway.
• DNS content blockers: Ads, Trackers and Malware on.

2Extra protection

• DAITA (Settings → DAITA): on. Pads and reshapes your traffic against AI-based traffic analysis - costs some speed.
• Multihop (Settings → Multihop): entry and exit server in different countries for higher threat levels.
• Anti-censorship: only if a network blocks VPNs (UDP-over-TCP or Shadowsocks).

3Account & payment

• Generate an account number on mullvad.net and keep it in your password manager - it is your only login.
• Pay with cash by mail, Monero or a voucher if you want no payment trail.
• Don't log in to personal accounts in the same session you want to keep unlinked.

4Verify it works

• Open mullvad.net/check - it tests for IP, DNS and WebRTC leaks.
• Use WireGuard (the default). Mullvad has phased out OpenVPN, so replace old OpenVPN configs on routers or third-party apps.
• Pair it with Mullvad Browser (see the Browser tab) so your fingerprint blends in too.

1Lock down the basics

• Windows Update: automatic, including driver and firmware updates.
• Standard account for daily use and a separate admin account - malware then can't silently install itself.
• Encrypt the disk: BitLocker (Pro) or Device encryption (Home). Keep the recovery key offline, not only in your Microsoft account.

2Windows Security app

• Microsoft Defender + Tamper protection: on.
• Device security → Core isolation → Memory integrity: on.
• Ransomware protection → Controlled folder access: on.

3Settings → Privacy & security

• General: advertising ID and tailored experiences off.
• Diagnostics & feedback: optional diagnostic data off; Activity history off.
• Location: off, or only for apps that really need it.

1Pick the right system

• Everyday: Fedora Workstation (SELinux, fast updates) or Debian / Ubuntu LTS.
• High risk: Qubes OS isolates work, browsing and banking in separate virtual machines.
• Leave no trace: Tails runs from a USB stick, routes everything through Tor and forgets everything on shutdown.

2Harden it

• Full-disk encryption (LUKS) during installation, with a long passphrase.
• Automatic security updates: dnf-automatic (Fedora) or unattended-upgrades (Debian/Ubuntu).
• Firewall: firewalld or ufw, incoming traffic denied by default.

3Network & privacy

• Install the Mullvad app for Linux - Lockdown mode works there too.
• NetworkManager: random MAC address for Wi-Fi connections.
• SSH only if you need it: keys only, no password or root login.

1Choose

• Mullvad Browser: Tor Browser's anti-fingerprinting without the Tor network - ideal with a VPN.
• Tor Browser: when you need real anonymity.
• Everyday: Brave, or Firefox with uBlock Origin.

2Settings

• Block third-party cookies and enable HTTPS-Only mode.
• Delete cookies and site data when the browser closes (for your private browser).
• Don't store passwords in the browser - use a password manager instead.

3Separate identities

• One browser (or profile) for personal accounts, another for anonymous browsing.
• Firefox Multi-Account Containers keep sites from seeing each other's cookies.

1Android

• GrapheneOS on a Google Pixel is the most hardened option.
• Otherwise: latest updates, Play Protect on, no APKs from random sites.
• Delete the advertising ID; location only "while using the app".

2iPhone

• Lockdown Mode if you could be targeted (journalists, activists, creators).
• Stolen Device Protection: on.
• Advanced Data Protection for end-to-end encrypted iCloud, where available.

3Both

• A long passcode instead of 4 digits; hide notification previews on the lock screen.
• SIM PIN + carrier port-out PIN against SIM swapping.
• Review app permissions (location, microphone, contacts) every month.

4Messaging

• Signal: create a username and set "Who can find me by number" to Nobody.
• Turn on Registration Lock and disappearing messages for sensitive chats.

1Passwords

• Password manager: Bitwarden, KeePassXC or Proton Pass.
• A unique, random password for every account; a long passphrase for the few you must remember.

2Two-factor

• Passkeys or hardware keys (e.g. YubiKey) for your e-mail and password manager.
• An authenticator app everywhere else - avoid SMS codes.
• Store recovery codes offline (printed or in your password manager).

3Aliases

• A different e-mail alias per service (SimpleLogin, addy.io) - leaks can't be linked and phishing stands out.
• Different usernames for gaming, social media and work.

4Keep checking

• Run the leak check every few months.
• Review login activity and connected apps; delete accounts you no longer use.

1Pick a manager

• Bitwarden: free, open source, works on every device.
• KeePassXC: fully offline, a single encrypted file that you control.
• Proton Pass: includes e-mail aliases.

2The master passphrase

• 5–6 random words, e.g. granite-otter-violin-maple-rescue. Long beats complicated.
• Never use it anywhere else, and never type it into a website.
• Write it on paper once and keep it somewhere safe at home, not in your phone's photos.

3Move in, step by step

1. Start with your e-mail, then the password manager itself, then banking, Discord, Steam and social media.
2. For each account: generate a new random password (20+ characters) and save it.
3. Run the manager's report for reused or leaked passwords and fix them.
4. Then delete the passwords saved in your browser.

2Set it up in this order

1. Main e-mail account
2. Password manager
3. Banking & PayPal
4. Discord, Steam, Epic, Microsoft / Xbox

3Don't lock yourself out

• Save backup codes in your password manager and on paper.
• Register two security keys or passkeys on two devices.
• Before you change phones, transfer the authenticator app (export or cloud backup in the app).

1Harden the mailbox

• Unique password plus a passkey or security key.
• Run Google's "Security Checkup" or Microsoft's "Security" page once.
• Check recovery address and phone number, and remove old ones.

2Check what's hidden

• Forwarding rules and filters: attackers quietly forward copies of everything, or move security e-mails straight to the trash.
• Connected apps with access to your mailbox. Remove what you don't know.
• Active sessions: log out everywhere if anything looks unfamiliar.

3Separate addresses

• One private address for banks, government and people you know.
• Aliases (SimpleLogin, addy.io, DuckDuckGo) for shops, games and newsletters.
• Want more privacy? Proton Mail or Tuta encrypt your mailbox.

2WhatsApp

• Chats are end-to-end encrypted, but Meta can see who you talk to and when.
• Turn on two-step verification (PIN). It stops account hijacking via SMS code.
• Privacy → Advanced: turn on "Protect IP address in calls", and silence unknown callers.

3Telegram

• Normal chats and groups are not end-to-end encrypted. Only "secret chats" are (1:1, on the phone).
• Privacy → Phone number: "Nobody". Calls → Peer-to-peer: "Nobody" (otherwise your IP can be visible).
• Turn on two-step verification with a password.

1The router

• Change the admin password to a unique one, not the one on the sticker.
• Turn on automatic firmware updates.
• Turn off remote access from the internet unless you really use it.

2The Wi-Fi

• WPA3, or WPA2/WPA3 mixed mode for older devices. Never WEP or "open".
• A long Wi-Fi password (16+ characters).
• A guest network for visitors, smart TVs, light bulbs and other IoT devices.

3Extras

• Leave UPnP off unless a game or console needs it. It lets apps open ports on their own.
• Use a DNS service with malware filtering, e.g. Quad9 (9.9.9.9).
• Don't run port forwarding to devices you don't need to reach from outside.

1How it gets in

• Cheats, cracks, keygens, "free" software and fake installers from search ads.
• Fake "I'm not a robot" pages that ask you to press Win + R and paste something. That runs a command on your PC. No real CAPTCHA ever does this.
• Browser extensions that get sold and updated with malicious code.

2Signs

• Accounts get hijacked one after another, even with 2FA.
• Defender is turned off or reports something.
• Unknown programs at startup, or high CPU use when the PC is idle.

1The 3-2-1 rule

• 3 copies of your important data,
• on 2 different media (e.g. PC + external drive),
• 1 of them somewhere else (cloud, or at someone else's home).

2How to do it

• Windows: OneDrive with version history, or File History to an external drive.
• Mac: Time Machine. Linux: Déjà Dup or Timeshift + an external drive.
• Phone: iCloud / Google backup with 2FA turned on, plus copy photos to your PC now and then.

1Know your threat model

• Who could target you - scammers, an ex, trolls, a stalker? What would they want?
• Protect what matters most first: e-mail, phone number, home address.

2Don't leak yourself

• Strip location data (EXIF) from photos before sharing.
• Check backgrounds: windows, letters, reflections, street signs - in photos and on stream.
• Post locations after you've left, not while you're there.

3Keep identities apart

• Never reuse usernames or profile pictures between your real and anonymous identities - a reverse image search links them.
• Opt out of data brokers and people-search sites, and repeat every few months.