Privacy and security overlap, but they are not the same. Privacy concerns who can observe, collect, infer, or share information about you. Security concerns whether someone can steal, alter, or misuse your information and accounts. A private browser window can reduce traces on a shared computer while doing little to stop a phishing site. A secure connection can protect data in transit while the site at the other end records everything you do.
The goal is not perfect invisibility. It is to remove unnecessary exposure, make common attacks harder, and understand what each tool can and cannot do.
Keep the browser and device updated
Updates repair vulnerabilities in browsers, operating systems, password managers, and extensions. Delaying them leaves known weaknesses available to attackers. Turn on automatic security updates where practical, and retire software that no longer receives them.
This is less glamorous than installing a privacy product and more important than most of them.
Use unique passwords—and let a manager remember them
A password reused across sites turns one breach into many compromised accounts. Use a reputable password manager to create and store a different long password for every service. Protect the manager itself with a strong account password and the best multi-factor method it supports.
When a service offers passkeys, they are worth considering. Passkeys are tied to the legitimate site and are designed to resist the credential phishing that defeats ordinary passwords and one-time codes.
Turn on multi-factor authentication
Multi-factor authentication adds another barrier when a password is stolen. Security keys and passkeys generally provide stronger phishing resistance than authenticator codes; authenticator codes are generally preferable to text messages when stronger options are available. Any well-managed second factor is usually better than a password alone.
Save recovery codes somewhere secure before they are needed.
Treat unexpected urgency as a warning
Phishing succeeds by creating pressure: an account will close, a package is waiting, a payment failed, or a supervisor needs an immediate favor. Do not use the link in an unexpected message to resolve the problem. Open the known site yourself, use a saved bookmark, or contact the organization through a number you already trust.
Check the full domain name, not only the page design or the padlock. HTTPS means the connection to that domain is encrypted; it does not prove that the domain is honest.
Choose a browser with meaningful tracking protection
Modern browsers can block or partition many third-party cookies and reduce some known tracking techniques. Review the browser’s privacy settings instead of assuming the defaults match your needs. Blocking cross-site tracking is a sensible baseline.
Extensions can add protection, but every extension is also software with access to some part of your browsing. Prefer a short list from maintainers you trust, grant the narrowest permissions possible, and remove extensions you no longer use. More extensions do not automatically mean more privacy; an unusual combination can also make a browser easier to distinguish.
Understand private windows
Private or incognito mode mainly changes what is retained on the device after the window closes. It can prevent local history, cookies, and form entries from joining the normal browser profile. It does not make your traffic invisible to the websites you visit, your employer or school network, your internet provider, or services you sign in to.
It is useful for a shared computer, a temporary session, or keeping accounts separate. It is not an anonymity system.
Use encrypted connections
Prefer HTTPS and enable an HTTPS-only mode if your browser offers one. HTTPS protects the content of a connection against ordinary interception and modification between your browser and the site. Network observers may still learn that you connected to a domain, and the destination still sees the request.
Avoid bypassing certificate warnings unless you fully understand the cause. The warning exists because the browser cannot establish the identity or integrity of the connection it expected.
Know what a VPN changes
A virtual private network moves trust; it does not eliminate it. Your local network and internet provider see an encrypted connection to the VPN, while the VPN provider becomes capable of observing connection metadata and, for unencrypted traffic, content. Websites can still recognize accounts, cookies, browser characteristics, and behavior.
A VPN can be useful on an untrusted network, for reaching a private organizational network, or for changing the apparent network location. Choose one based on a credible operational record and business model—not promises of total anonymity.
Reduce data at the source
Delete accounts you no longer need. Decline optional permissions. Avoid giving a site contacts, precise location, camera, or microphone access unless the task requires it. Prefer services that work without an account. Clear stored site data when you want to remove local identifiers, knowing that doing so may sign you out and remove saved preferences.
For sensitive research or communication, ordinary privacy settings may not be enough. Threats differ: an advertiser, an abusive acquaintance, an employer, and a government investigator have different capabilities. The Electronic Frontier Foundation’s Surveillance Self-Defense material is a better starting point for threat-specific planning.
A compact baseline
- Install security updates promptly.
- Use a password manager and unique passwords or passkeys.
- Enable strong multi-factor authentication.
- Navigate independently when a message creates urgency.
- Block cross-site tracking and keep extensions few.
- Use HTTPS, but do not confuse encryption with trustworthiness.
- Treat private windows and VPNs as limited tools, not invisibility switches.
- Share less information and grant fewer permissions.