Microsoft's own authenticator app for phones, handling second-factor checks and passwordless sign-in, with a built-in one-time passcode generator that also works offline, and room for accounts from Microsoft and from other providers alike.

A mobile password manager that hands encrypted storage to the phone s dedicated security chip and never reaches the network while running. The free edition holds 20 accounts across 17 templates, and forgetting the master password can be resolved with help from friends rather than a server.

A password and passkey manager built on zero knowledge encryption: scrambling and unscrambling happen on the local device and the service stores only ciphertext. Extensions and native desktop and mobile clients all open the same vault, while the free tier caps at ten records and one mobile device.

One encrypted file on your own disk, no cloud sync, no telemetry, no account: a password vault whose trust model is a file and a master password, nothing else.

The idea that made it popular is still the idea worth having: tokens encrypted and synced, so a new phone gets forty accounts back instead of forty support tickets. The desktop app is gone, the mobile one works.

Every signup form asking for your real address is a small wager on somebody else data handling. SimpleLogin hands out a separate forwarding address per site, passes the mail to your real inbox, and lets you switch off whichever alias starts receiving nonsense.

Google Authenticator is the most classic of the two-factor tools: a minimal interface that produces a rolling code, support on most major sites, cloud sync so a new phone does not lose the keys, and no cost and no distractions. The simplest first step into better account security.

WARP encrypts everything from the device to the nearest edge node over WireGuard, sends lookups through an encrypted resolver, needs no account and has no traffic limit. Free on every platform, with post quantum crypto added in 2026.

Enpass has no server holding your vault: the encrypted file stays on your devices, syncs through a cloud account you already own, and unlocks with a key that never leaves your head.

Cryptomator is an open-source tool that encrypts files in a local vault with AES-256 before they sync, so a cloud provider only ever stores unreadable data.

A manager that began in 1999 as a form filler, and still treats forms as its real trade: registration pages, checkouts and multi step logins are completed in one go from an identity set up beforehand. AES-256 encryption, a master password stretched through millions of rounds, and a zero knowledge design in which the server never sees the key. The free tier puts no ceiling on the number of passwords on a single device.

An open-source privacy extension that has been running for more than a decade. It blocks ads and trackers, swaps personal identifiers in requests for random values, and answers cookie consent prompts with a refusal on your behalf. Every page shows how many trackers it carried and which companies they belong to.

A public resolver that answers ad, tracking and phishing domains with a name that does not exist, so nothing on the network can reach them. It speaks every mainstream encrypted protocol, keeps no logs, needs no client, and its core is open enough to host yourself. The base service is free.