Building a complete privacy stack on a realistic budget

Most people treat privacy tools like impulse purchases — they grab a VPN during a sale, maybe download Signal because everyone says to, and call it done. That's not a privacy stack. That's random pieces of armor scattered on the floor while you walk into battle.

A real privacy stack is layered. Each tool covers a specific attack surface. VPNs hide your IP from websites. Password managers stop credential reuse. Encrypted messaging keeps conversations private. Two-factor authentication blocks account takeovers. Ad blockers reduce tracking. The goal isn't perfection — it's making surveillance and exploitation expensive enough that you're not worth the effort.

Here's how to build that stack without spending yourself into the ground.

The baseline: Free tools that actually work

Start here if your budget is zero. These aren't compromises — they're legitimate tools that privacy-conscious people actually use.

Password manager: Bitwarden's free tier handles unlimited passwords, syncs across devices, and includes a password generator. The interface is clean, the security model is solid (zero-knowledge encryption, regular audits), and you're not locked into an ecosystem. Pay $10/year if you want TOTP codes stored alongside passwords, but the free version covers 90% of what most people need.

VPN: This is trickier. Free VPNs are usually terrible — they either sell your data, inject ads, or cap bandwidth so aggressively they're useless. The exception: Proton VPN's free tier. It's genuinely no-logs (verified through transparency reports and court cases), doesn't sell data, and works for basic browsing. You're limited to three countries and slower speeds, but it's functional. If you're on a student budget or testing the waters, it's viable.

Browser: Firefox with a few tweaks. Out of the box, it's better than Chrome for privacy (no Google telemetry harvesting everything you do), but you need to lock it down. Go to Settings → Privacy & Security, set Enhanced Tracking Protection to "Strict," enable DNS over HTTPS, and turn off Firefox Studies and data collection. Add uBlock Origin (not just any ad blocker — uBlock Origin specifically) to block trackers and malicious ads. That's your foundation.

Encrypted messaging: Signal. End-to-end encrypted by default, minimal metadata collection, open source, audited. It's free. The only catch is getting your contacts to switch, which is a social problem, not a budget problem.

Email: This is the weak point in the free tier. Gmail and Outlook read everything for ad targeting and AI training. Proton Mail's free plan gives you one address with 1GB storage — enough for a primary account if you're not hoarding newsletters. Tutanota (now called Tuta) offers similar. Neither is perfect (you can't use them with third-party clients on the free tier), but both are encrypted at rest and don't scan your mail for ad profiles.

Two-factor authentication: Aegis (Android) or Raivo OTP (iOS) for TOTP codes. Both are free, open source, encrypted, and work offline. Skip SMS-based 2FA whenever possible — SIM swapping is trivial, and SMS codes are plain text.

Total monthly cost: $0. Annual: $0 if you stick with free tiers, $10 if you upgrade Bitwarden.

The realistic tier: Where most people should land

This is the sweet spot. You're spending less than the cost of two streaming subscriptions per month, but you've closed the major gaps.

Password manager: Keep Bitwarden, upgrade to Premium ($10/year). Now you get TOTP storage, 1GB encrypted file storage for sensitive documents, and priority support. Or jump to 1Password ($36/year individual) if you want a more polished UI and better family sharing. Both are zero-knowledge encrypted. Both have been audited. Pick based on whether you value cost (Bitwarden) or interface (1Password).

VPN: This is where you stop compromising. Budget VPNs in the $3-5/month range (paid annually) include Mullvad (€5/month, flat rate, no sales gimmicks, accepts cash), IVPN (from $60/year), and Proton VPN's Plus tier (around $5/month on annual plans). All three are audited, genuinely no-logs, and support WireGuard for fast, modern encryption.

If you see VPNs for $2/month, read the fine print. You're usually locked into a 2-3 year contract, and if the company is cutting costs that aggressively, ask what corners they're cutting on infrastructure and privacy. Better to pay $60/year for a VPN that's been third-party audited than $40/year for one that says it's private but has never proven it.

Email: Proton Mail Plus (around $48/year) or Mailbox.org (€36/year). Both give you custom domains, multiple addresses, enough storage for real use (15GB+), and IMAP/SMTP access so you can use Thunderbird or another client. Proton's interface is friendlier; Mailbox.org integrates calendar and cloud storage. Both encrypt at rest and don't scan your mail.

Browser: Still Firefox, still free, but now add a few extensions: uBlock Origin (already mentioned), Privacy Badger for additional tracker blocking, and optionally Multi-Account Containers to isolate browsing contexts (e.g., keep Facebook in one container so it can't track you across the web). Total cost: $0.

Encrypted messaging and 2FA: Still Signal and Aegis/Raivo. No reason to upgrade here — the free options are top-tier.

Cloud storage: This is optional, but if you're replacing Google Drive or Dropbox, budget for it. Proton Drive (included in Proton Mail Plus) gives you 500GB. If you need more, Tresorit or Sync.com start around $8/month for 2TB, both with zero-knowledge encryption. Nextcloud is free if you self-host, but that adds complexity.

Total monthly cost: Roughly $10-15/month ($120-180/year) if you go with Mullvad + Proton Mail + Bitwarden Premium. That's less than a single monthly subscription to most SaaS tools, and you're covering VPN, email, passwords, messaging, and browsing.

The premium tier: For high-risk users or those with specific needs

This is where you go if you're a journalist, activist, or just someone with genuine adversaries (stalkers, corporate competitors, state-level threats). Or if you want maximum convenience and are willing to pay for it.

Password manager: 1Password Families ($60/year for five people) or Bitwarden Families ($40/year for six). Share vaults with trusted people, get recovery options, store files. Or stick with individual plans if you're solo.

VPN: Same recommendations (Mullvad, IVPN, Proton), but consider multi-hop (routing through two servers) if your threat model includes traffic analysis. IVPN and Proton offer this. Mullvad keeps it simple with single-hop WireGuard, which is faster and often sufficient.

Email: Proton Unlimited (around $120/year) bundles mail, VPN, calendar, drive, and password manager. If you're already using multiple Proton products, the bundle is cheaper than buying separately. Alternatively, stick with dedicated best-in-class tools for each category — sometimes the bundle isn't the best at any single thing.

Browser: Brave (Chromium-based with built-in blocking) or Firefox hardened with arkenfox user.js (a configuration template that locks down Firefox to near-Tor Browser levels). Brave is easier out of the box; arkenfox requires tinkering. Either way, add uBlock Origin and call it done.

Encrypted messaging: Signal for most contacts. Add Element (Matrix protocol) or Wire if you need decentralized or self-hosted options. These are free but have steeper learning curves for non-technical users.

Operating system: This is the nuclear option. If you're on Windows, you're leaking telemetry constantly. macOS is better but still closed-source. Linux (Ubuntu, Fedora, Pop!_OS) is free and gives you full control. The cost is time — you'll need to relearn some workflows and troubleshoot compatibility. For most people, sticking with macOS and locking it down is the pragmatic choice. For high-risk users, Linux is non-negotiable.

Hardware security keys: YubiKey 5 NFC ($45-50) for phishing-resistant 2FA. This is a physical key you tap to authenticate — no codes to intercept, no SMS to hijack. Use it for your password manager, email, and critical accounts. Budget for two keys (keep a backup) and store the second somewhere secure.

Total monthly cost: $15-25/month ($180-300/year), depending on whether you bundle or buy à la carte. Add $100 upfront for hardware keys.

What's not worth paying for (and what you missed)

Antivirus: Windows Defender (free, built-in) is fine for most people. Paid antivirus is bloatware unless you're on an unpatched Windows 7 machine, in which case your problem isn't the antivirus. On macOS and Linux, antivirus is mostly theater.

"Identity theft protection" services: These are credit monitoring plus a VPN you don't need, wrapped in a $200/year package. You can freeze your credit for free at all three bureaus (Equifax, Experian, TransUnion) and get better protection. If you want monitoring, Credit Karma is free.

Secure DNS services (as a standalone purchase): Firefox and most VPNs already route DNS through encrypted channels. If you're not using a VPN, Quad9 (9.9.9.9) or Cloudflare (1.1.1.1) are free DNS resolvers that don't log queries. No need to pay for this separately.

What people forget: Backups. Your privacy stack is useless if ransomware locks your files or your laptop dies. Budget for an external drive ($50-100) and use built-in tools (Time Machine on macOS, Déjà Dup on Linux, or Veeam on Windows) to automate encrypted backups weekly. Or pay for Backblaze ($70/year for unlimited cloud backup, encrypted). This isn't sexy, but losing your data because you skipped backups is the stupidest way to fail at privacy.

Bundling strategies to save money

If you're using Proton for email, their Unlimited plan ($120/year) includes VPN, 500GB Drive, Calendar, and Pass (password manager). That's cheaper than buying Proton Mail Plus ($48) + Mullvad ($60) + Bitwarden Premium ($10) separately. The tradeoff: Proton's VPN and password manager aren't quite as good as Mullvad and Bitwarden/1Password standalone. But for most people, the convenience and cost savings are worth it.

Similarly, 1Password Families ($60/year) or Bitwarden Families ($40/year) make sense if you're splitting costs with a partner or household. Five or six people on one plan beats everyone paying individually.

How to audit your own stack

Every six months, check:

1. Are you actually using everything you're paying for? If your VPN has been off for three months, cancel it. If you're still storing passwords in your browser, you're wasting money on that password manager.

2. Have any services had breaches or scandals? Search "[service name] breach" and "[service name] audit." If a VPN got caught logging when they claimed not to, or a password manager had a serious vulnerability, it's time to switch.

3. Are there cheaper options that do the same job? Prices drop. New tools emerge. What cost $10/month last year might have a competitor at $5/month now. Compare, but don't chase every sale — switching costs time.

4. What's missing? If you've been SIM-swapped, maybe it's time for a hardware key. If you're getting phishing emails, maybe your email address is in too many breaches — time for aliasing (SimpleLogin or AnonAddy, $30/year, lets you generate unique addresses per service).

Building this incrementally

You don't need to buy everything at once. Here's a sane rollout:

Month 1: Password manager (Bitwarden free). Migrate your passwords out of your browser. Enable 2FA (Aegis/Raivo) on critical accounts (email, banking, password manager itself).

Month 2: VPN (Proton free to test, or pay for Mullvad if you're ready). Learn to use it consistently for public Wi-Fi and general browsing.

Month 3: Email (Proton Mail free, or pay for Plus if you need more storage). Start migrating accounts to your new address — critical services first (banking, taxes), then social, then newsletters.

Month 4: Browser and ad blocking (Firefox + uBlock Origin). Export bookmarks, import to Firefox, lock down privacy settings.

Month 5: Encrypted messaging (Signal). Get your close contacts to switch. Use SMS as a fallback for everyone else.

Month 6: Backups. Buy a drive, set up encryption, automate the process.

Spreading this over six months makes it digestible. You're not drowning in new interfaces, and you can test each tool before committing money.

Key takeaways

The free tier is viable: Bitwarden, Proton VPN (free), Signal, Firefox, and Aegis cover the basics without spending a dollar.
The realistic tier costs $10-15/month: Mullvad or IVPN ($60/year), Proton Mail Plus ($48/year), Bitwarden Premium ($10/year) closes the gaps for most people.
Bundles save money but involve tradeoffs: Proton Unlimited ($120/year) is cheaper than separate tools, but standalone tools are often slightly better at their specific jobs.
Don't pay for antivirus or identity theft protection: They're mostly redundant or overpriced credit monitoring. Freeze your credit for free instead.
Backups aren't optional: Budget $50-100 for a drive or $70/year for Backblaze. Ransomware doesn't care about your threat model.
Build incrementally: One tool per month over six months is more sustainable than buying everything at once and getting overwhelmed.