The Anonymity Spectrum
Online privacy depends on who can observe your activity and which information links it to you. Hiding a network address, limiting browser tracking, and separating accounts address different risks. Start with the activity you want to protect and the observer you are concerned about.
Layer 1: Network Privacy
VPN
A VPN encrypts traffic between your device and the VPN server when that traffic uses the tunnel. Websites usually see the VPN's exit address, while the VPN provider becomes another party you must trust. Cookies, signed-in accounts, and browser signals can still link visits. Review a provider's routing, logging, and audit scope in our VPN guide.
Tor
For ordinary web access, Tor Browser uses circuits through multiple relays to separate your source address from the destination. Performance varies, and logging into an identifying account still identifies you to that service. Follow the Tor Project's guidance on browser use and limitations.
VPN + Tor
Some privacy advocates use VPN → Tor (connecting to a VPN first, then routing through Tor). This hides Tor usage from your ISP but adds complexity and potential failure modes.
Layer 2: DNS Privacy
DNS queries outside an intended VPN route can disclose requested domain names. Encrypted DNS protects queries in transit to a resolver, which still receives them. Compare our DNS Leak Test results with your browser and VPN configuration. See our DNS Leak Prevention guide for detailed setup instructions.
Layer 3: Browser Hardening
Browser settings affect both tracking and compatibility. Review these controls:
- Check WebRTC routes and available address controls (guide)
- Configure privacy settings per our browser settings guide
- Minimize fingerprint surface (guide)
- Use separate browser profiles for different identities
- Consider Tor Browser for sensitive activities
Layer 4: Identity Separation
Accounts, payments, and what you share can connect activities even when network addresses differ:
- Email: Separate addresses or aliases can limit direct address reuse. Encrypted email providers such as Proton Mail and Tuta do not make an account anonymous: recovery details, correspondents, and message content can still identify its owner.
- Payments: Consider purchase, delivery, and payment records together. Bitcoin transactions are public, and prepaid cards or cash purchases can still be linked through other records. See Bitcoin's privacy guidance.
- Accounts: Separate browser profiles can reduce accidental cookie and account mixing. Reused usernames, recovery details, and shared content can still connect identities.
- Shared content: Review names, locations, document metadata, and personal details before publishing. Changing writing style alone is not a dependable way to conceal identity.
Layer 5: Operating System
Specialized operating systems address different risks and require careful setup:
- Tails: A live operating system designed to route internet activity through Tor and avoid writing session data to the host disk by default. Persistent Storage, saved files, compromised hardware, and your actions affect the protection. Read Tails' warnings before relying on it.
- Whonix: A two-VM setup that routes the workstation's internet traffic through a separate Tor gateway VM
- Qubes OS: Separates activities into virtual machines to limit the impact of a compromised compartment. How you share files and configure compartments still matters.
Define Your Threat Model
The most important step is defining what you're protecting and from whom:
- Advertiser tracking: Review tracker blocking, cookie isolation, account reuse, and browser fingerprinting. A VPN alone does not stop these mechanisms.
- Local network or ISP observation: Check VPN coverage and DNS routing; your VPN provider and DNS resolver may still observe information that the local network cannot.
- Linking accounts across services: Review profile separation, recovery details, payment records, and information you share.
- Targeted surveillance: No short tool list establishes safety. Consider endpoint compromise, physical access, account records, and network observation alongside browser and routing controls.
Audit Your Current Setup
Run Zunavek's Full Privacy Scan to inspect supported browser and network signals. Its score summarizes those checks; it does not measure anonymity or assess every risk described here.