21
items 
Start where a breach actually starts: one password manager, one authenticator, one alias service. Together they stop a reused password, an SMS code and your real inbox from being the weakest link.













Blocking and searching only work as a set — a browser that still runs a real content blocker, the blocker itself, a search engine that builds no profile, and DNS that reaches the apps a browser cannot.



















Encryption you hold the key to, not a promise from the provider. Choose by where the files already live: an existing cloud drive, a local disk, or a phone full of photos.
















Three different jobs in one section: a conversation nobody can read, a mailbox your provider cannot scan, and a backup that survives the laptop being gone.










Each of these buys something the free list cannot do — whole-device blocking, removal from data brokers, a cheaper VPN — and every note says plainly what you give up for it.







