The research

Who this is for

Anyone who uses a web browser can benefit from customizing it with extensions. Sometimes called “add-ons,” extensions are like little apps that add capabilities to your browser. Some extensions make it easier for your browser to work with other services; password-manager extensions, for example, can capture and reenter your passwords.

Because extensions live in your browser, they differ slightly depending on which browser you have. Safari extensions don’t work in Firefox, for instance, and Firefox extensions don’t work in Chrome. Most popular extensions have a version for different browsers, so usually you can find what you need. Note that some Chrome-based browsers such as Microsoft Edge and Brave can use Chrome extensions as well, but I haven’t tested compatibility.

Browser extensions are software, and as such some can be malicious or even endanger your online privacy. It doesn’t help that many browser extensions have suspiciously similar names or can hang around long after their creator stops updating them. User reviews on extension webstores are as suspect as anywhere else, but I tend to trust extensions that have lots of confirmed installations. Firefox has helpful badges to indicate extensions made or recommended by Mozilla, the company that manages Firefox. Chrome also has a badge to verify that the extension’s creator is in good standing and another for extensions that conform with Google’s best practices.

Password manager: Bitwarden


Bitwarden

The best free password manager

Bitwarden

The free version of Bitwarden covers all the basics of a good password manager. Features such as advanced security reports and encrypted file storage cost extra.

The best password manager

1Password

1Password offers attractive and straightforward apps. Newbies will like its plain-language security recommendations and colorful interface, while the technically inclined will appreciate its advanced features and security.

A password manager generates and automatically fills unique, complex passwords for every site you visit. Using a password manager ensures that your passwords are harder for criminals to guess and prevents attackers from accessing multiple accounts if one of your passwords leaks. Most such services have a badge that appears on the extension icon in your browser toolbar or an icon in the password field when you visit a site where you’ve saved a password previously; this makes it easy to fill saved passwords but also helps you avoid phishing sites, because the autofill tools don’t appear on a bogus website. Password managers can also store passkeys, the more secure successor to passwords.

I use Wirecutter’s budget pick, Bitwarden, because I’m cheap and prefer to use open-source software. Both Bitwarden and our top pick, 1Password, are great options, depending on your needs. If you don’t want to use a separate password manager, some device operating systems and web browsers have built-in password managers. If that’s the case for you, no need to install an extension — just make it a habit to use your password manager.

Ad or tracker blocker: Privacy Badger


A good tracker blocker

Privacy Badger

Privacy Badger blocks the tools advertisers use to track your movements across the web and, as a result, most ads on the web. A free tool from the advocacy group the Electronic Frontier Foundation, it offers a trustworthy and easy way to improve your online privacy.

Online ads are annoying, sure, but they’re also a security risk. We’ve seen numerous examples of malvertising, in which a legitimate-looking ad actually guides people to phishing sites or even malware. I’ve fallen victim to it, too: Because of a nefarious ad on Google, I installed what I thought was Spotify but was actually malware. Blocking ads or trackers — or, ideally, both — makes your web experience cleaner and safer.

Privacy Badger, from the Electronic Frontier Foundation, blocks trackers, which companies use to track you from site to site. But since many ads contain trackers, it ends up blocking most ads that you encounter, too. Like the best ad and tracker blockers, Privacy Badger lets you toggle blocked page elements on or off, or even disable blocking for an entire page. The latter feature is handy because ad and tracker blockers can sometimes break websites in interesting and frustrating ways.

uBlock Origin is an ad blocker with more advanced features than Privacy Badger offers. Unlike Adblock Plus or the confusingly named uBlock, uBlock Origin does not use the Acceptable Ads framework, which allows some ads to appear. uBlock Origin Lite is built to conform with restrictions in the newest version of Google Chrome that affect how ad blockers work; uBlock Origin users in Chrome should probably make the switch.

Online-identity separator: Firefox Multi-Account Containers


Long ago, I had two browsers: Chrome for work and Firefox for personal browsing, shopping, banking, and so on. Thanks to Firefox Multi-Account Containers, I’ve been able to ditch Chrome and instead separate my browsing activities into color-coded tabs labeled Work and Personal. Each container manages its own collection of site cookies, so it improves privacy by making it harder for sites to track all my online activities. It also makes managing multiple online accounts easier: I write articles for Wirecutter in Google Docs in my Work container and switch to my Personal container to check my personal Gmail inbox. I’ve also set up rules so that some sites open only in specific containers.

In Safari on macOS, the Profiles feature lets you have separate browsing experiences for different activities. You can also have Safari open specific websites with a particular Profile. It’s a little different from Firefox’s Containers because it presents individual windows for each profile you’re using, each with a separate web history, extensions, and other settings. Firefox is slowly rolling out a new Profile management feature that works similarly, but you can still use Containers and even have separate containers in each profile.

Google Chrome supports multiple profiles that separate browsing history, passwords, bookmarks, and so on, but it requires a separate Google account for each.

Email-masking tool: Firefox Relay


Mask your email address

Firefox Relay

Using the same email address as a login for multiple sites and services can make you easier to track and invite spam. Firefox Relay generates new addresses that forward mail to your true address and can be discarded when they’re no longer useful.

I loathe email, and I try to spend as little time engaging with it as possible. One way I do that is by rarely giving out my actual email address. Instead, I use masked email addresses generated by Firefox Relay, which forwards messages to my email inbox. That makes it harder for other parties to connect me to my online activities, and best of all, I can easily delete a masked email address if I start getting too much spam. Anyone with a Firefox account can get five masked email addresses for free, and unlimited masked emails from Firefox Relay cost $12 a year.

Several other services also provide email masking. DuckDuckGo offers email masking for free but requires that you use its browser extension. DeleteMe, our top data removal service pick, also lets subscribers generate masked emails. 1Password, our top-pick password manager, integrates with Fastmail, and our budget pick, Bitwarden, works with half a dozen email-alias providers. We haven’t tested those services yet, but PCMag has an extensive listing.

How to find and install extensions

Firefox has a large and robust collection of extensions (called “add-ons”), and so does Google’s Chrome Web Store. Firefox extensions don’t work with Chrome, but many Chrome-based browsers, such as Brave, Edge, Opera, and Vivaldi, can install Chrome extensions.

Safari is a little different. Instead of using an online web store to find extensions, you add them by downloading a dedicated app for each extension from the Mac App Store. These extensions are sometimes standalone apps or bundled with other apps; the Mac App Store indicates when an app comes bundled with a Safari extension.

Most extensions start working immediately after you install them, but others may require a bit of setup — you have to log in to your password-manager extension, for example. Many modern browsers give you the option to hide your extensions even if they’re working, deactivate (but not delete) them, and more. I personally like to keep my extensions visible in the browser toolbar, but that’s just me. You should also make sure that your privacy-related extensions are set to work in Incognito windows. Check your browser settings for these options.

Browser settings to consider changing

Your browser may already have built-in tools that you can use to improve your privacy. Here are a few we recommend.

Change your default search engine. If you’re frustrated with Google results or just not interested in seeing AI-generated answers to every query, take a look at alternative search engines. DuckDuckGo emphasizes privacy, and although it has experimented with AI, you can easily turn that feature off.

**Tweak how Chrome handles some advertising. **Click the three-dot icon and then go to **Settings > Privacy and security > Ad privacy. The three ad-privacy settings give you some control over how ads are presented to you and what information is used to target ads. I keep all three off. Keep in mind that these settings don’t replace an ad or tracker blocker.

Limit what AI search data Chrome shares with Google. In Chrome’s Settings > AI Innovations page, you have the option to search through your browsing history with AI. Chrome notes that doing so sends Google information about your search as well as the content of the best matches it finds. I keep these off.

**Adjust Firefox’s tracking protection. **Click the three-line icon and then open Settings > Privacy & Security > Browser Privacy. The three levels here allow you to change what Firefox automatically blocks on the web. I keep mine set to Strict. If you have an issue with how a site behaves, click the shield icon in the URL bar and toggle off enhanced tracking protection. I still use a tracker blocker in addition to Firefox’s built-in protections.

**Enhance Safari’s tracker protection. **Click Safari in the menu bar, select Settings, and then click the Advanced tab. Where it says “Use advanced tracking and fingerprint protection,” use the drop-down to select in all browsing. Fingerprinting is a method in which advertisers and other parties attempt to identify you by recording specific characteristics of your computer, such as its screen size, language, and other settings.

Go HTTPS only. HTTPS encrypts your browser traffic to prevent your internet service provider and other parties from seeing the bulk of your web traffic. Most browsers offer an option to browse the web using only HTTPS. Since most sites use HTTPS, you shouldn’t run into any problems in doing so, but keep it in mind if something breaks when you’re browsing.

• Chrome: Click the three-dot icon, go to Settings > Privacy and security, and click Security. Then scroll down to Secure connections and enable Always use secure connections.
• Firefox: Click the three-line icon and then open ***Settings > Privacy & Security ***and scroll down to HTTPS-Only Mode and select the toggle next to Enable HTTPS-Only Mode in all windows.
• Safari: This browser doesn’t offer an option to block sites that don’t use HTTPS. But you can have Safari warn you before you visit a site without HTTPS by clicking the checkbox in Settings > Security > Non-secure site connections.

What about a VPN?

Most people don’t need a VPN, and that’s especially true for VPN browser extensions. That’s because most browser extensions offered by VPNs aren’t VPNs at all, but encrypted proxies. They offer some of the features of a VPN — encrypting your traffic, spoofing your location — but only for your browser. A standalone VPN app, on the other hand, encrypts all the traffic on your device and gives you far more options than a browser extension. If you need a VPN, we suggest installing the app instead.

If you use Safari and pay for iCloud+, you have another option: Apple Private Relay. This isn’t really a VPN, but it does hide your IP address and encrypt your browser traffic. What’s unique is that it employs a special routing system so that neither your ISP nor Apple can see your online activities. It encrypts your web traffic only in Safari but also encrypts any online activity sent over HTTP instead of the more-secure HTTPS, regardless of the app.

It starts with the browser

There is no perfect web browser, especially when it comes to privacy. I’ve been using Firefox for years because of its privacy pedigree and long history promoting an open internet, but it has been criticized for not living up to its privacy promises. If you’re reading this, there’s a good chance that you’re doing so in Google Chrome — far and beyond the most popular web browser. Chrome has also been criticized for privacy shortcomings, as well as for its connection with Google, a company eager to serve you targeted ads. Apple’s Safari has a good reputation for privacy but is deeply ingrained in Apple’s ecosystem, making it tricky for people who own non-Apple devices to get the full benefit of its features.

Microsoft and Samsung have their own default browsers, while upstarts like Opera aim to provide a comprehensive experience that goes beyond just visiting websites. Brave, Vivaldi, and newcomers like Arc all put their own spin on presenting the web. The venerable Tor Browser is designed to make your online activities more anonymous and can let you access hidden websites, at the cost of speed.

Whichever browser you use, make it a choice, not just a function of habit. Try out a new browser if only to see the web in a different way. Explore some of the privacy tools that browsers offer, and maybe you’ll discover they’re not as onerous as you might expect. And, of course, be sure to customize your browser with privacy-protecting extensions.

This article was edited by Caitlin McGarry and Signe Brewster.