Which online privacy habits are actually worth the bother?

Eight pages in this library are about privacy and safety online, and none of them is a lecture or a product. Each is one habit, built from people comparing what actually happened to them, and each carries its own limits, including the cases where the habit does nothing. Read together the first five share a shape: the trick is small, the rule about when not to use it is the valuable part, and none of the five asks you to buy anything.

Tag your email address, but only for the people that do not matter. Give each website its own email tag says that when you sign up for something, adding a plus sign and a tag before the @ still delivers the mail to your inbox, labelled with who you gave it to, on most major providers. That page will not tell you which providers support it, because that advice goes stale; it gives a one-minute test instead, sending yourself mail at your own address with a tag added. The two honest uses on that page are tracing, so that junk mail addressed to a tag names who leaked it, and sorting, so a filter can sweep a tag into a folder or to trash. Whether the tracing survives professional spammers is genuinely contested there: one camp has caught specific companies this way, the other reports that the list trade routinely strips the suffix, and what decides it, the page says, is the opponent, careless leakers ship the tag and industrial ones scrub it. The rule the page calls its one hard rule, straight from the people it bit: tags are for the low-stakes tier, newsletters, shops, forums, and never for an account you might need to recover, reply from, or argue with on the phone, because people there report registrations that worked but logins that did not, unsubscribe pages that choke on the plus, and services that require replies from the exact registered address. A tag is a tracer, not a shield, and one person notes tagged signups get no more spam than bare ones. The page also draws a boundary on purpose: these tricks get used to re-register for free trials and dodge one-account limits, and nothing on it is written to help with that.

Put a Wi-Fi code on the fridge, for the guest network only, made on your phone. Put the guest network on the fridge comes from what many people shared. Some people say a Wi-Fi code is the password itself in plain text, readable by whoever scans it, so the only question that matters is which password it is; some people say the code that hangs in your kitchen should be for a guest network, the second network most routers can run, and never the main one, and the discussion that page began from is its own correction, because the original advice was to print the main network and the poster changed it after being told so. The page warns: do not print the main network’s code if you have devices you do not patch or visitors you do not fully trust. Some people say the phone that is already connected makes the code itself, from the network’s settings or the saved-passwords screen, and the page warns: never type your network name and password into a website that offers to make the code, because you have just given them to the website. Taking it back is the easy part, some people say: change the guest network’s password and every code ever scanned stops working that moment. Some people name the homes this is not for, a house that strangers pass through often, and a small town where the network’s name tells everyone whose it is, and if your router has no guest network the page is not telling you to put the main password on paper.

Before you press play on anything private, look at what your phone is connected to. Check the speaker before you press play is built from what many people shared about a phone sending private audio to the wrong speaker. Many people say the one line most worth keeping: when you press play and hear nothing from the phone in your hand, the usual cause is not that the volume is low; the sound is being sent to a speaker, earbuds or a car the phone is paired with, and it is already playing there, so turning the volume up to check is the exact wrong move, and some people describe doing it and making the leak suddenly loud. Many people say the reliable prevention is to turn Bluetooth off before you play anything private, and one correction catches people who think they are safe: on many phones the quick tap in the control panel only pauses Bluetooth until the next day or the next known speaker, and the full off is in the settings menu. Some people say it is not only Bluetooth, because a phone can cast or mirror to a television or a networked speaker over Wi-Fi, and the casting button is easy to tap by accident. If you keep Bluetooth on for earbuds or a watch, the page’s rule for you is not off but verify, every time, and one caution names the failure for earbuds specifically: when their battery dies mid-play, the audio jumps back to the phone’s own loudspeaker, or to the next paired device, out loud.

Upload a slightly cropped version, and keep the whole picture where the internet is not. Upload the crop, keep the whole picture draws on what many people shared. Many people crop a small piece off an image before uploading it and keep the uncropped file, so that if the picture is stolen the thief’s copy is missing the edge only you can produce. Some people settle what that is worth: enough in most ordinary disputes, and not security, because a thief can crop further, and sharing your proof image to win the argument hands them a fuller copy. Some people keep the file no repost can fake, the camera’s raw data or the layered project file with every stroke on its own layer. The page carries two lines from public guidance, checked against the US Copyright Office and the UK position: in the US and the UK your copyright exists the moment you make the work, without registering anything, and mailing a sealed copy to yourself provides no legal protection whatsoever, whatever you were told. Its safety line is about what the tricks are not: nothing on it is legal advice, the law differs by country, and the crop, the watermark and the original file are proof for an online argument and a takedown request, which one person says have never been tested in court. For the other direction, many people run a stranger’s profile picture through a reverse image search before they reply, some people then ask for a new photo doing something specific that a catfish working from a stolen set cannot supply, and some people say not to use the same picture on a dating app as on your other accounts, because the search then leads a stranger straight to your name, your workplace and your friends. One last line from some people there, for anyone sending a photo of a document: blurring is not enough, because software can reconstruct what is blurred, so crop or black out instead.

Photograph the serial numbers, not just the things, and keep the photos outside the house. Photograph the serial numbers says a photo of your TV proves a TV was once in a room, and the serial proves which TV and that it was yours, and that difference is where insurance claims and police recoveries live. People on that page met it from both directions: an insurer that refused to take photos by themselves as ownership proof when receipts were gone, and a police department that returned a stolen bike because the frame number was on file, with the officer admitting that stolen bikes almost never make it home, since owners almost never have the number. The people who had this ready built it in one unhurried pass, a slow video through every room with drawers and cabinets open, plus still shots of the serial labels on the expensive things, then copies somewhere the disaster cannot reach, cloud storage or an email to yourself, with someone you trust able to get at it if you cannot. The privacy line is the page’s own: keep the inventory private, because it is, functionally, a shopping list of your home, so store it off-site but never post it, and skip location tags.

Assume a work or school computer can be watched, and keep private things on your own device. Keep your private life off the work computer says to assume your employer or school can see what you do on its computers and network, and to keep anything private on your own device. Many people say to assume there is no privacy on company hardware or networks. Some people say work machines often carry monitoring software and the network keeps logs that can show your screen and the sites you look up. How closely anyone looks is an open argument, one side saying IT is actively watching and the other that IT only looks when something trips, and the page says the advice does not depend on who wins it, because both sides say the logs exist. In the UK, the Information Commissioner’s Office says employers must make sure workers know how and what personal information they collect when they monitor, and must do it lawfully and fairly; in the US the rules differ from state to state, and the page does not cover them. One person says to browse privately on a personal phone using its own mobile data, not the company Wi-Fi, because the company network cannot see traffic that never passes through it, and some people say a personal phone on the company Wi-Fi is not hidden. A private window is not enough: a browser maker’s own help page says websites and organisations that manage your network, such as a school, an employer or an internet provider, may still be able to see your activity in it. Before you share your screen in a meeting, close every window and tab you do not need and switch off notifications; some people warn that mail programs can keep showing notifications during a presentation, so a private email can pop up. If the person watching your devices is someone at home, such as a partner who controls your phone and computer and you are afraid of them, the tricks on that page are not the answer. In the US, the National Domestic Violence Hotline is 1-800-799-7233, any hour, or text START to 88788. In the UK, the National Domestic Abuse Helpline, run by Refuge, is 0808 2000 247, free and open around the clock. The page does not cover the law, which differs by country, or what an employer may do on a computer you own.

Get free software from its maker’s own page, and look at the end of a file’s name. Get the program from its maker’s own page says to get free software from its maker’s own website, which you find yourself, and not from a big Download button on a page full of ads. The FTC says scammers place bogus ads for software on search engines and social media, and that you should not click an ad to download software but go to the website by typing the address. The FBI says the same: type the company’s web address into the address bar rather than click through. If you do search, the FTC says to scroll past results marked Ad or Sponsored, and the FBI says to check the address before you click an advert. Some people say that hovering over a Download button, or dragging it, shows the real web address, so you can see whether it is the maker’s. Before you open what you downloaded, some people say to check the real end of a file’s name, because malware can be disguised with a double extension such as .pdf.exe. The Windows maker’s support pages say an .exe file is an executable program file, and on a Windows computer File Explorer can hide the ends of file names: choose View, then Show, then File name extensions. A document or a song should not end in .exe. Some people set their browser to ask where to save each file, because it makes a pause in which an automatic or malicious download can be cancelled; one person says it slows down people who download known-safe files all day. If you have already opened something you do not trust, the FTC says to stop using accounts that hold sensitive information, such as banking, on that computer; install or update security software and run a scan; and change your passwords and turn on two-factor authentication. One person adds that you should change the passwords for every site where you used the same password, from a different, clean computer, straight away. The FTC says to contact the device’s manufacturer or a trusted tech support service if you need help. You can report a suspicious ad, site or download to the FTC at ReportFraud.ftc.gov in the US, or to Report Fraud in the UK. The page is about computers, not phones or tablets, and it cannot tell you how to make an older version of a program safe to download.

Before you send an intimate picture, know where to get it taken down, because once it is sent you cannot control it. Know how to get an intimate picture taken down is for adults deciding about an intimate picture, and for anyone whose picture has been shared or used to threaten them. Its safety box comes first, carried whole. If you are being blackmailed or threatened right now, you are not at fault. The US National Center for Missing & Exploited Children says the blackmailer is to blame and that what they are doing is a crime; it says that cooperating or paying rarely stops it, to block the person but not delete your profile or messages, and to report the account through the platform’s safety feature. Citizens Advice says to save the messages, images and screenshots of websites, with the address visible, somewhere secure. In the US, report to your local police and to the FBI at tips.fbi.gov, and if the picture shows someone under 18, to the Center’s CyberTipline at report.cybertip.org or on 1-800-843-5678 (1-800-THE-LOST); in the UK call the police on 101, or 999 if someone is in immediate danger. To get a picture taken down: if you were 18 or over when it was taken, StopNCII.org makes a digital fingerprint on your own device, so the picture itself is not uploaded, and passes it to the platforms that take part; it says it cannot remove anything from the whole internet, only from those platforms. If the picture was taken when you were under 18, Take It Down, a free service from the US National Center, works the same way and can be used anonymously. In the UK, the Revenge Porn Helpline supports adults on 0345 6000 459, 10am to 4pm Monday to Friday, free and confidential, and helps with reporting and removal; it cannot help anyone under 18, who can call Childline on 0800 1111 or report to the Internet Watch Foundation. If this is making you think about harming yourself, call or text 988 in the US or call Samaritans on 116 123 in the UK, and if you or anyone is in immediate danger call 911 in the US or 999 in the UK. A leak is the leaker’s act: the page says practical advice about sending pictures should never turn into blaming the sender, and that sharing, or threatening to share, an intimate picture without consent is a crime in the UK, and in the US the federal TAKE IT DOWN Act prohibits publishing one without consent. Many people say the way to avoid the risk entirely is not to send or keep intimate pictures at all, since no digital method guarantees safety, and some people say disappearing messages and deleting do not fix it, because a picture can be captured by screen recording before it vanishes. The page does not tell you whether to send; it is your decision. For people who do, some people say to leave out your face and anything that could identify you, and to turn off automatic cloud backup for devices that hold intimate pictures. People disagree about how much leaving the face out buys: one person says it makes identifying you significantly harder, one says modern face recognition defeats it, and the people who weigh it say it lowers the odds and does not make a picture safe. People also disagree about putting a mark naming the recipient on the picture: some say it helps trace a leak, and others that a mark can be removed, and that needing one means you should not send the picture at all. The page does not choose. If it happens, its order is: keep the evidence, and do not pay; report it to the platform using its safety feature (in the US, a platform that receives a valid request must remove the picture and known identical copies within 48 hours under the TAKE IT DOWN Act, which the Federal Trade Commission has enforced since 19 May 2026); use the removal service that fits your age at the time (StopNCII.org for pictures taken when you were an adult, Take It Down for pictures taken when you were under 18; both keep the picture on your device and send only a fingerprint to the platforms that take part, and they cannot reach platforms that do not); report it to the police (people disagree about whether the police can do much); and talk to someone: in the UK the Revenge Porn Helpline, for adults, and in the US VictimConnect, which can talk with you about any crime and your options. If you are under 18, or the picture was taken when you were, the removal service is Take It Down, and in the UK Childline on 0800 1111 or the Internet Watch Foundation; the Revenge Porn Helpline cannot help anyone under 18, and the National Center says the blackmailer is to blame, not you, even if you made a choice you regret. If a picture is already out, the sending suggestions are not for you, and the steps above are.

Who this is not for, and what these pages leave open. If your worry is whether an employer or a network can see your screen or your traffic, the speaker page says that is a different question about monitoring and does not answer it; the section above on work and school computers does. If your question is whether you are legally answerable for what a guest does on your Wi-Fi, the fridge page names that as a gap that differs by country. If someone has already reposted your work and you want to sue, people on the crop page say court is prohibitively expensive and rarely worth pursuing against an individual, and the practical remedy they name is a takedown request to the platform. And none of the first five pages names a provider, a router, a phone maker or a service; each says so in its own caveats.