A short list, by job to be done. Each pick says what it's for, why we like it, what to watch out for, what it costs, and what it does with your data.
No affiliate links. No referral fees. No sponsorships. We earn nothing when you pick a tool.
Links go straight to the vendor with nothing added. Prices change, so each card shows the date we last checked; confirm on the vendor's site before you buy.
Showing all 22 tools
Password managers
A password manager gives every account its own long, random password, so one leaked password doesn't unlock the rest of your life.
Bitwarden
Cost: Free tier + paid
HomeBusinessWorks on: iOS, Android, Windows, macOS, Linux, Web
Storing and filling a unique password and passkey for every account, and sharing the ones you need to with your family or team.
Why we like it
Its code is open source and it publishes a long list of independent audits, including 2025 reviews by Cure53 and ETH Zurich's applied cryptography group.1 The free plan covers unlimited passwords on unlimited devices, so cost is never the reason to go without.2 Families costs $47.88 a year for six people and Teams is $4 per user a month, which fits a household or a small business.23
Watch out for
A 2026 study by ETH Zurich and USI researchers found 12 ways a fully compromised Bitwarden server could undermine its zero-knowledge encryption.4 The same study found weaknesses in 1Password, LastPass and Dashlane, and the authors report that fixes are under way.4
In April 2026 a malicious version of Bitwarden's command-line tool was briefly published to the npm software registry.5 Bitwarden says it found no sign that vault data was accessed, and people who don't use that developer tool weren't affected.5
Emergency access, vault health reports and the built-in authenticator codes (time-based one-time passwords, or TOTP) need a paid plan.2
What it costs
Free for one person. Premium is $19.80 a year, Families $47.88 a year for up to 6 people, Teams $4 and Enterprise $6 per user a month, all billed annually.23Price checked
Privacy
Bitwarden describes its vault as zero-knowledge, meaning encrypted so the company can't read it; see the caveat on the 2026 study.4 It reports SOC 2 Type 2 and ISO 27001 attestations, and Enterprise customers can self-host.13
Alternatives
Proton Pass: From the Swiss company behind Proton Mail and SimpleLogin. A 2026 Recurity Labs audit found no remote exploits or encryption bypasses.6
Your phone's built-in manager: Apple Passwords or Google Password Manager is a sound free choice if everyone in the house uses the same kind of phone.
LastPass: We don't recommend it today. After its 2022 breach, the UK data regulator fined it £1.2 million in 2025 for inadequate security measures.7
HomeBusinessWorks on: iOS, Android, Windows, macOS, Linux, Web
A polished password manager for families and teams who want easy sharing, admin controls and good onboarding.
Why we like it
Your vault is protected by two layers, your master password and a 128-bit Secret Key, so guessing the password alone isn't enough.8 It holds SOC 2 Type 2 and several ISO certifications, runs a public bug bounty, and its Watchtower feature flags weak or compromised passwords.910 The Teams Starter Pack covers 10 people for $24.95 a month billed yearly, a simple fit for a small office.11
Watch out for
There's no free plan, and first-year discounts mean the renewal price is higher than the price you first see.10
The full version of the 2026 ETH Zurich and USI study found 6 attacks a fully compromised 1Password server could attempt; the authors report fixes are under way.4
Its public assessments page doesn't name its recent penetration testers; the reports sit behind its Trust Center.9
What it costs
Families $5.99 a month for up to 5 people, billed yearly.10 Teams Starter Pack $24.95 a month for 10 people; Business $8.99 per user a month, billed yearly.1011Price checked
Privacy
Encrypted with your master password, which 1Password says it never stores, plus a 128-bit Secret Key.8 Certified to SOC 2 Type 2 and ISO 27001, 27017, 27018 and 27701.9
Alternatives
Bitwarden: Open source with a free plan and lower team pricing; see its entry.
Passkeys can't be typed into a fake website and app-generated codes beat text messages, so a stolen password alone stops being enough to get in.
Apple Passwords
Cost: Free
HomeWorks on: iOS, macOS, Windows
The free, built-in place on iPhone, iPad and Mac to keep passwords, passkeys and the verification codes used for multi-factor authentication (MFA).
Why we like it
It ships with iOS 18 and macOS Sequoia and later, and it handles passkeys and verification codes in the same app, so you can stop relying on text-message codes.12 Passwords and Keychain are end-to-end encrypted even without Advanced Data Protection turned on.13 It also warns you about reused, easily guessed and leaked passwords.12
Watch out for
There's no Android app, and on Windows it works through iCloud for Windows (an app plus Chrome and Edge extensions), so mixed Apple and Android households do better with a cross-platform manager.12
Everything is tied to your Apple Account, so protect that account first with a strong passcode and a passkey or security key.
What it costs
Included with iOS 18, iPadOS 18, macOS Sequoia and later; no subscription.12Price checked
Privacy
Syncs through iCloud Keychain with end-to-end encryption; the keys stay on your trusted devices, not with Apple.13
Alternatives
Google Password Manager: The Android and Chrome equivalent; see its entry.
Bitwarden or 1Password: Better if your household mixes Apple, Android and Windows.
The built-in password and passkey manager for Android phones and the Chrome browser.
Why we like it
It saves passwords and passkeys to your Google Account, fills them in on Android and in Chrome, and warns you when a saved password shows up online.14 Your passkeys are protected by your screen lock or a Google Password Manager PIN, so not even Google can read them.15
Watch out for
Everything rides on your Google Account, so give that account a passkey first.
If you made your first passkey on Android, you have to reset the PIN from a computer, iPhone or iPad.15
What it costs
Built into Android and Chrome; no subscription.Price checked
Privacy
Stored in your Google Account. Passkey data is encrypted with a PIN or screen lock that Google says it can't access.15
Alternatives
Apple Passwords: The iPhone and Mac equivalent; see its entry.
Bitwarden or 1Password: Better if your household mixes Apple, Android and Windows.
HomeBusinessWorks on: iOS, Android, Windows, macOS, Linux, Web
Generating the rotating sign-in codes many sites still use, with an encrypted backup so a lost phone doesn't lock you out.
Why we like it
It's free, open source and runs on phones, computers and the web, with your codes synced under end-to-end encryption or kept offline with no account at all.16 In 2025 Cure53 audited the server code and infrastructure Ente Auth shares with Ente's photo app, and Ente fixed 12 of the 15 issues during the audit itself.17
Watch out for
A code typed into a convincing fake site can still be stolen; passkeys and hardware keys can't be phished that way.18
The 2025 Cure53 review focused on servers and infrastructure; for the app's cryptography, Ente points to an earlier external audit.1716
End-to-end encrypted sync, or an offline mode with no account. Open source under AGPL-3.0.16
Alternatives
Your password manager's code generator: Apple Passwords and Bitwarden Premium can store these codes, which is convenient but puts both sign-in factors in one place.122
Google Authenticator or Microsoft Authenticator: Fine if you already use them; check that backup is on before you change phones.
A physical key you tap to sign in is phishing-resistant, which makes it a strong lock for the few accounts that control all the others.
YubiKey (Yubico Security Key Series)
Cost: Paid
HomeBusinessWorks on: USB, NFC
A physical key you tap or plug in to sign in to the accounts that control everything else: email, banking, your password manager and admin accounts.
Why we like it
CISA's small-business guidance lists phishing-resistant FIDO sign-in as part of the highest security posture, and a security key is the most direct way to get it.18 The FIDO-only Security Key Series starts at $29, works by USB or NFC tap, and needs no software or battery.1920 When a flaw turned up in 2024, Yubico published a clear advisory with plain advice.21
Watch out for
Buy two and register both, so a lost key doesn't lock you out. Yubico itself recommends keeping a backup key.21
YubiKey firmware can't be updated. Keys with firmware older than 5.7 carry a side-channel flaw, but exploiting it takes the physical key, specialized equipment and knowledge of your account.21
Not every site accepts security keys, so you'll still need a password manager for the rest.
What it costs
Security Key Series from $29; YubiKey 5 Series, which adds non-FIDO sign-in standards some workplaces use, from $58 (Yubico store, USD).19Price checked
Privacy
Needs no extra software or battery.20 The key itself is what proves it's you, so keep it physically safe.21
Alternatives
Google Titan Security Key: Similar price; see its entry.
Your phone's passkeys: Also phishing-resistant and free. A hardware key adds a backup that doesn't depend on your phone.
A recent, tested backup turns ransomware, a dead laptop or a deleted folder from a disaster into an inconvenient afternoon.
Backblaze Computer Backup
Cost: Paid
HomeBusinessWorks on: Windows, macOS
Automatic, continuous cloud backup of a whole Mac or Windows computer, including drives plugged into it.
Why we like it
It backs up everything by default with no data cap, and you can restore by download or have an encrypted drive mailed to you.24 You can stretch version history from 30 days to one year at no extra storage cost, which matters when ransomware or a bad edit goes unnoticed for weeks.25 Pricing is simple: $99 a year per computer.24
Watch out for
Backblaze manages the encryption by default. Add your own private encryption key if you want the backup readable only by you, and store that key in your password manager.24
In 2021 a Facebook ad pixel was mistakenly left on some signed-in pages of Backblaze's separate cloud-storage product, exposing file names but not contents for 9,245 users.26 Backblaze disclosed it, removed it and notified those users.26
Large restores by download take time, so test a small restore now while nothing is on fire.
What it costs
$99 a year or $9 a month per computer, for Personal or Business Backup.24Price checked
Privacy
Data is encrypted by default, and you can add a private encryption key of your own.24
Alternatives
iCloud Backup or Android backup: Built into phones; turn these on as well. Our home guide shows where.2728
An external drive you own: Apple's Time Machine and Windows' built-in backup can copy to a drive; unplug it between backups so ransomware can't reach it.
End-to-end encryption means only the people in a conversation can read it, not the company that runs the service.
Signal
Cost: Free
HomeBusinessWorks on: iOS, Android, Windows, macOS, Linux
Private texts, voice calls and video calls with family, friends and colleagues.
Why we like it
Signal is run by an independent nonprofit, its encryption protocol is open source, and conversations are end-to-end encrypted.29 It keeps so little about you that its published subpoena responses show it could only hand over when an account was created and last connected.30 It has added protection against future quantum computers, automatically.31
Watch out for
You still need a phone number to sign up, though you can hide it from others behind a username.32
It only protects conversations with other Signal users, so it won't replace texting with everyone.
If your business must keep records (finance, healthcare, legal holds), disappearing messages and personal accounts can clash with those rules. Check before moving work conversations there.
What it costs
Free; funded by grants and donations.29Price checked
Privacy
Nonprofit, end-to-end encrypted, and designed to collect as little as possible.2930
Alternatives
WhatsApp: Owned by Meta. WhatsApp says no one can read your personal messages by default, so it beats plain texting if your family won't switch.33
Filtering DNS, the internet's address book, blocks known scam and malware sites for every device on your network before a page loads.
Quad9
Cost: Free
HomeBusinessWorks on: iOS, Android, Windows, macOS, Linux
A free, set-it-once DNS service that blocks known malware and phishing sites for every device on your home or office network.
Why we like it
It's run by a Swiss not-for-profit foundation, needs no account, and builds its block list from more than a dozen security companies.34 Quad9 says it doesn't log your IP address in normal use.34 Setup is one change on your router: 9.9.9.9 and 149.112.112.112.35
Watch out for
It's built to block known malicious domains, not to filter categories like adult content; for that, look at NextDNS or Cloudflare's family service.34
A brand-new scam site won't be on any block list yet, so treat this as a safety net, not a substitute for the callback rule.
Some browsers and apps use their own DNS settings and can bypass your router, so test from each device.
What it costs
Free; funded by grants, partnerships and donations.34Price checked
Privacy
Swiss jurisdiction; says it collects no personal data and logs no IP addresses in normal use.34
Alternatives
Cloudflare 1.1.1.1 for Families: Free. Use 1.1.1.2 to block malware, or 1.1.1.3 to also block adult content.36
Cloudflare Zero Trust: For a business that wants DNS filtering with its own policies; free for up to 50 users, then $7 per user a month billed annually.37
HomeBusinessWorks on: iOS, Android, Windows, macOS, Linux
Customizable DNS filtering for families: block malware, trackers and whole categories of sites, at home and on phones away from home.
Why we like it
Beyond threat blocking, it adds parental controls such as SafeSearch, YouTube Restricted Mode, blocking specific apps and games, and 'recreation time' schedules.38 It works on cellular data and public Wi-Fi too, not only on your router.38 Nothing is logged unless you ask, and you choose where logs are kept and for how long.39
Watch out for
The free plan stops filtering after 300,000 queries a month; after that it still answers, just without blocking.40
A determined teenager with a VPN can get around DNS filtering, so pair it with your phone's own parental controls.
It's a small, founder-owned company, and its privacy page doesn't say where it's incorporated.39
What it costs
Free up to 300,000 queries a month; Pro $1.99 a month or $19.90 a year; Business $199 a year per 50 employees.40Price checked
Privacy
Logs only if you opt in, in the region you choose; says it never sells or shares data.39
Alternatives
Quad9: Simpler and free, without parental controls; see its entry.
A separate forwarding address for every sign-up keeps your real inbox out of breach dumps and makes a phishing email easier to spot.
SimpleLogin
Cost: Free tier + paid
HomeBusinessWorks on: iOS, Android, Web
Creating a separate forwarding email address for every account, store and newsletter, all landing in your normal inbox.
Why we like it
It's open source, owned by Proton, and lets you reply from an alias so your real address stays private.41 The free plan gives you 10 aliases; Premium is $36 a year for unlimited aliases and your own domains.41
Watch out for
We didn't find a published independent audit of SimpleLogin itself.42
If the service ever disappeared, your aliases would stop forwarding. Using your own domain makes it easier to move.
What it costs
Free for 10 aliases; Premium $36 a year or $4 a month.41Price checked
Privacy
A product of Proton AG, a Swiss company; open source and self-hostable.4143
Alternatives
DuckDuckGo Email Protection: Free forwarding addresses that also strip many hidden email trackers.44
Firefox Relay: Five free email masks from Mozilla.45
Random forwarding addresses built into iPhone, iPad and Mac for anyone who already pays for iCloud storage.
Why we like it
Every iCloud+ plan includes it, starting at $0.99 a month for 50 GB, and you can share the plan with up to five family members.46 It's built into Safari, Mail and Settings on Apple devices, so there's nothing new to install.47
Watch out for
Manage addresses on Apple devices or at iCloud.com; it requires iCloud+.47 Households that live mostly on Android or Windows may be better served by a cross-platform service.
It ties more of your sign-ups to your Apple Account, which makes that account even more important to protect.
What it costs
Included with iCloud+, from $0.99 a month in the US.46Price checked
Privacy
Forwards mail to your real address without revealing it. iCloud+ also includes Private Relay.46
Alternatives
SimpleLogin: Cross-platform and open source; see its entry.
Screening unknown callers puts a pause between a convincing voice and your decision, and that pause is what phone scams work hardest to remove.
iPhone Screen Unknown Callers
Cost: Free
HomeWorks on: iOS
Making unknown callers say who they are and why they're calling before your iPhone rings.
Why we like it
It's built in: set Screen Unknown Callers to Ask Reason for Calling, and saved contacts still ring straight through.48 That pause is exactly what voice-clone and 'family emergency' scams try to rush you past.
Watch out for
Calls aren't screened while you're roaming, and screening pauses for 24 hours after you call emergency services.48
Caller ID can be faked, so a familiar name on screen isn't proof. The callback rule still applies.
Add numbers you expect calls from, like your doctor's office or pharmacy, to your contacts so they aren't held up.
What it costs
Built into the iPhone Phone app; no cost.Price checked
Privacy
Part of the Phone app, so no third-party app needs access to your calls.
Alternatives
Your carrier's scam blocking: T-Mobile ScamShield, Verizon Call Filter and AT&T ActiveArmor each include free spam and scam call blocking for their customers.495051
Screen Unknown Callers: Silence: The stricter setting sends every unknown number straight to voicemail.48
On Google Pixel phones, screening unknown callers automatically and warning you during a call that sounds like a scam.
Why we like it
Call Screen hangs up on known spam and asks unknown callers why they're calling before your phone rings, and it runs on the phone itself.52 Scam Detection listens for scam patterns during calls with on-device AI, and Google says no call audio or transcript leaves the phone.53
Watch out for
Pixel only. Scam Detection is off until you turn it on, and in the US it needs a Pixel 6 or newer.53
Automatic screening is offered in a handful of countries and may not run while roaming.52
What it costs
Built into Pixel phones; no cost.Price checked
Privacy
Screening and scam detection run on the device, and screened calls aren't saved to your Google Account.5253
Alternatives
Your carrier's scam blocking: T-Mobile ScamShield, Verizon Call Filter and AT&T ActiveArmor each include free spam and scam call blocking for their customers.495051
Other Android phones: Check the Phone app's spam and caller ID settings; features vary by maker.
Knowing when your details leak tells you what to change, and a credit freeze stops anyone opening new credit in your name.
Have I Been Pwned
Cost: Free tier + paid
HomeBusinessWorks on: Web
Finding out when your email address, or any address at your business's domain, turns up in a data breach.
Why we like it
Breach alerts for your own email are free once you verify the address.54 A small business can watch its whole domain free if 10 or fewer of its addresses have been breached; bigger domains start at $52.68 a year.55
Watch out for
An alert means an address was in a breach, not that your account was taken over. The fix is still a unique password and a passkey.
You have to prove you control a domain before you can search it.55
What it costs
Free for personal alerts and small domains; paid domain plans from $4.39 a month, billed annually.55Price checked
Privacy
You verify your email before alerts start, and the service says it won't share your address.54
Alternatives
Your password manager's breach alerts: Bitwarden, 1Password, Apple Passwords and Google Password Manager all flag saved passwords that have leaked.2101214
Stopping anyone, including you, from opening new credit in your name until you lift the freeze.
Why we like it
It's free to place and lift, lasts until you remove it, and you can freeze a child's credit too if they're under 16.56 Alerts tell you something happened; a freeze stops new credit being opened in your name.
Watch out for
You set it up separately at each of the three bureaus.56
Lift it temporarily before applying for a loan, card or apartment, then put it back.
It doesn't protect accounts you already have, so keep reading your statements.
The AI plan you choose decides who can read, keep and train on what you type, so pick it before anyone pastes in something sensitive.
Microsoft Copilot Chat (work account)
Cost: Paid
BusinessWorks on: Web, Windows, iOS, Android
A general AI assistant for staff that's covered by your Microsoft 365 business contract instead of consumer terms.
Why we like it
If you already pay for Microsoft 365 for business, Copilot Chat is included, from Business Basic at $7 per user a month.57 Signed in with a work account, prompts and responses fall under Microsoft's Data Protection Addendum and aren't used to train the core models behind its AI.58 Admins can block personal-account sign-ins, switch off web search and link staff to your AI rule.59
Watch out for
The protections apply only when people sign in with their work account. The same app also accepts personal accounts, which don't get them.59
Web searches it runs go to Bing under Microsoft's general services agreement, outside your business data terms and outside the HIPAA agreement.58
Answers grounded in your company email and files need the paid Copilot add-on.57
Some features can use Anthropic models, which Microsoft excludes from its EU Data Boundary.58
What it costs
Included in Microsoft 365 business plans: Business Basic $7.00 and Business Premium $22.00 per user a month, paid yearly.57Price checked
Privacy
Microsoft acts as your data processor under its Data Protection Addendum; prompts aren't used to train the core models behind its AI, and your retention and audit settings apply.58
Alternatives
Gemini in Google Workspace: For Google Workspace businesses: governed by your Workspace agreement, and your data isn't used to train models outside your domain without permission.60
A standalone AI workspace for a small team that wants a mainstream assistant without consumer data terms.
Why we like it
OpenAI's business terms say it doesn't train on business data by default and that you own your inputs and outputs where the law allows.61 It adds single sign-on (SSO), multi-factor authentication (MFA) and central billing for teams of 2 to 200, at $20 per standard seat a month billed annually.62 Nonprofits can get up to 75% off.62
Watch out for
You can't set your own data-retention period on Business; that control is limited to OpenAI's Enterprise, Edu and Healthcare plans.61
Staff can still use personal ChatGPT accounts, where content is used for training unless they opt out, so your AI rule has to say which account to use.62
Connecting it to Google Workspace, Microsoft 365 or Slack widens what it can read. Turn on only the connectors you need.62
What it costs
$20 per user a month billed annually, or $25 month to month, for a standard seat; premium seats cost more.62Price checked
Privacy
No training on business data by default; SOC 2 audited; encrypted at rest and in transit.61
Alternatives
Claude Team (Anthropic): Same price point, $20 per seat a month billed annually for teams of 2 to 150, with no model training on your content by default; retention controls are Enterprise-only.6364
Gemini app with Google Workspace: Included with Workspace business plans and governed by your Workspace agreement.6560
Running open AI models entirely on your own computer, so prompts never leave the machine.
Why we like it
It's free, open source under the MIT license, and runs on macOS, Windows and Linux.66 Local use is unlimited and costs nothing beyond your hardware.67 For drafting with sensitive client details, a local model takes the question of who keeps your data off the table.
Watch out for
Expect smaller models than the big cloud assistants; how well they run depends on your computer's memory and chip.
Ollama also sells cloud models. Anything you send to those leaves your machine, so choose a local model when privacy is the point.67
It's more technical than a chat website. Budget an afternoon, and check each model's license before using it for work.
What it costs
Free for local use; optional cloud plans from $20 a month.67Price checked
Privacy
Local models run on your hardware, so prompts stay on the device. Cloud models are hosted mainly in the US, and Ollama says it doesn't log or train on cloud prompts.67
Alternatives
LM Studio: A free desktop app for running local models, free for work use since July 2025.68
Apple Intelligence: Apple sends some AI requests to its Private Cloud Compute servers and has opened them to outside security researchers, with bounties up to $1 million.69
Sending tax returns, IDs and contracts through end-to-end encrypted links keeps them out of email inboxes that get breached.
Proton Drive
Cost: Free tier + paid
HomeBusinessWorks on: iOS, Android, Windows, macOS, Web
Storing and sharing sensitive files such as tax returns, IDs, contracts and client documents, with end-to-end encryption and expiring, password-protected links.
Why we like it
Files and even file names are end-to-end encrypted, and share links can carry a password and an expiry date.43 Its apps are open source and audited by Securitum, and Proton is based in Switzerland.43 The free plan includes 5 GB; Drive Plus is $47.88 a year for 200 GB.70
Watch out for
Proton says it can't access your files, so set up your account recovery options before you need them.70
The security page links Proton's latest Securitum report but doesn't date it, so check the report's date yourself.43
What it costs
Free 5 GB; Drive Plus $3.99 a month billed yearly ($47.88); Drive Professional for businesses $7.99 per user a month billed yearly.70Price checked
Privacy
Swiss jurisdiction; end-to-end encrypted with OpenPGP, including file and folder names.43
Alternatives
Tresorit: End-to-end encrypted file sharing aimed at businesses; Business plans start at 3 users.71
iCloud Drive with Advanced Data Protection: Turning on Advanced Data Protection makes iCloud Drive end-to-end encrypted for Apple households.13
Managing work laptops and phones from one place lets you enforce updates, screen locks and encryption, and remove company data when someone leaves.
Microsoft 365 Business Premium
Cost: Paid
BusinessWorks on: Windows, macOS, iOS, Android
One subscription that adds device management, endpoint protection and stronger email security to Microsoft 365, for businesses of up to 300 people.72
Why we like it
At $22 per user a month paid yearly, it bundles the Office apps with Microsoft Defender for Business and tools to manage and secure Windows, Mac, iOS and Android devices.5772 It helps keep devices updated and protected against phishing, ransomware and data loss from one admin center.72
Watch out for
The tools only help once someone configures them, so budget time or an outside IT provider for setup.
It's priced per user, so a 10-person team pays about $2,640 a year.57
If you only need endpoint protection, Defender for Business is sold on its own for $3 per user a month.57
What it costs
$22.00 per user a month, paid yearly, for up to 300 users.57Price checked
Privacy
Covered by Microsoft's business Data Protection Addendum, the same terms that apply to Exchange email and SharePoint files.58
Alternatives
Google Workspace Business Plus: For Google shops: adds advanced endpoint management and Vault at $22 per user a month with a one-year commitment.65
Apple Screen Time and Google Family Link: The household version of device management, for kids' phones and tablets.7374
Every figure on this page links to where it came from. We favor government, standards, and methodology-backed sources, and we take no money from anyone we cite.