Digital privacy for bitcoiners: a starter checklist
Work through these fixes in order: the first ones stop the most common attacks for the least effort.
Protect your accounts first: a password manager, then hardware security keys or passkeys on email and any exchange, then SMS removed as a login method. Next, freeze your credit and pull your home address off Google and people-search sites. After that, move private conversations to Signal and tighten your phone and browser. Every step below links to a full guide.
Why bitcoiners need a different privacy checklist
Most privacy advice is about ads and tracking, but a bitcoiner faces different risks. Coins on an exchange can be stolen through your email or phone number. Nobody can reverse or freeze coins in self-custody, so an attacker goes after the person holding them, and the first thing that attacker needs is where you live.
Exchanges also hold more about you than most companies do. Coinbase's May 2025 SEC filing listed names, addresses, phone numbers, government ID images, and balance snapshots among the customer data stolen from it. You cannot undo a leak like that, but you can make the leaked data less useful.
What to do, in order
- 1Use a password manager with a unique, random password for every account. Bitwarden's free plan covers unlimited passwords and devices, and KeePassXC is free and keeps your vault on your own device, with no cloud service. See my privacy tools page for the options.
- 2Put a hardware security key or passkey on your email, since your email resets every other password. CISA calls FIDO/WebAuthn the only widely available phishing-resistant authentication. My YubiKey setup guide covers which key to buy and how to add it.
- 3Do the same on every exchange account you still use, then move your coins to self-custody so the account matters less. My self-custody guide walks through it.
- 4Lock down your phone number by turning on your carrier's SIM and port-out protection and removing SMS codes wherever a better option exists. See how to protect yourself from a SIM swap.
- 5Freeze your credit at Equifax, Experian, and TransUnion. It is free by federal law and does not affect your score. See how to freeze your credit.
- 6Remove your home address from Google and people-search sites. Google's free Results about you tool and manual broker opt-outs do most of the work. See how to remove your personal information from the internet.
- 7Move private conversations to Signal, which is run by a 501(c)(3) nonprofit and has no ads or trackers. See is Signal safe?
- 8Encrypt the email that needs it, because standard email is readable by your provider. See how to send an encrypted email.
- 9Harden your phone and cut your Google dependence. See the GrapheneOS guide and how to degoogle.
- 10Add the physical layer last, with a privacy screen against shoulder surfing, a Faraday bag for devices you want silent, and a burner phone for when you need a number that is not yours.
Accounts: passwords, security keys, and SMS
Reused passwords and SMS codes are two common ways accounts fall, and a password manager fixes reuse. A hardware key fixes phishing, because a FIDO2 key refuses to sign in on a lookalike domain. CISA's fact sheet ranks SMS and voice codes as the weakest form of multi-factor authentication, exposed to SIM swaps and phone network attacks.
Do your email first, then your password manager, your exchange accounts, and your bank. Register two keys on each, keep the spare away from home, and print the backup codes.
Credit and home address
A credit freeze stops thieves from opening loans and cards in your name with leaked KYC data, and it lasts until you lift it.
Your home address matters more. The FTC says people-search sites build reports from property, voter, and other public records, plus data bought from other brokers. Opt out of the ones that list you, recheck every few months, and use Google's tool to clear the search results. California residents can send one deletion request to every registered broker through the state's free DROP platform.
Stop feeding new data in. Ship hardware wallets to a PO box or mailbox service, use a separate email for anything Bitcoin-related, and keep a second number for sign-ups that demand one.
Communications, browsing, and devices
Signal encrypts every message and call end to end, with no setting to turn on. The standard app still needs a phone number to sign up (an Android beta now offers registration without one for a one-time $2.99 fee), but you can set a username and share that instead of the number. My Signal guide covers the settings worth changing.
To keep trackers and anyone watching your connection from seeing which sites you visit, use Tor Browser. It is free and open source. My Tor guide explains what it hides and what it does not. If you want a VPN for everyday traffic instead, Mullvad costs €5 a month, creates an account number with no email address, and accepts bitcoin and cash.
Your phone holds your email, your authenticator, and often your exchange apps, so it deserves the most attention of any device. GrapheneOS is a privacy- and security-focused mobile operating system that runs Android apps, and its FAQ lists only Google Pixel phones as officially supported. The GrapheneOS guide covers which Pixel to buy and how to install it, and the degoogle guide maps each Google service to a replacement.
A privacy screen narrows the viewing angle so a stranger cannot read your PIN or seed phrase over your shoulder during setup. A Faraday bag blocks radio signals when you want a device unreachable. Neither replaces the account steps above.
Where each threat is handled
| Threat | Fix | Guide |
|---|---|---|
| Phishing page steals your login | Hardware key or passkey | YubiKey setup |
| Carrier moves your number to a thief | Carrier lock, no SMS logins | SIM swap protection |
| Loans opened with your leaked ID | Credit freeze at all three bureaus | Credit freeze |
| Stranger finds your home address | Google removal and broker opt-outs | Remove your information |
| Messages read in transit or on a server | End-to-end encrypted messaging | Is Signal safe? |
| Email read by your provider | End-to-end encrypted email | Encrypted email |
| Trackers and network watchers see what you browse | Tor Browser | Is Tor Browser safe? |
| Phone OS collects data | GrapheneOS, fewer Google services | GrapheneOS, Degoogle |
| Your real number on every sign-up | Separate number or device | Burner phones |
| Shoulder surfing your screen | Privacy screen filter | Privacy screens |
| Device reachable when you want it silent | Faraday bag | Faraday bags |
Privacy for the coins themselves
The steps above protect you and your accounts. Protecting the trail your coins leave on the blockchain takes new addresses, coin control, your own node, and buying without KYC where you can. Start with my Bitcoin privacy basics guide, then run your own node so your wallet stops reporting your balance to someone else's server.
Frequently asked questions
How do I protect my digital privacy?
Start with your accounts: a password manager, a hardware security key or passkey on your email, and no SMS login codes. Then freeze your credit, remove your address from Google and people-search sites, and move private conversations to an end-to-end encrypted app like Signal.
What are the best digital privacy tools in 2026?
A password manager such as Bitwarden or KeePassXC, a FIDO2 security key such as a YubiKey, Signal for messaging, Tor Browser for anonymous browsing, and Google's Results about you tool for search results. My privacy tools page rates the options, including VPNs and email.
What is the difference between digital privacy and digital security?
Security keeps attackers out of your accounts and devices. Privacy limits what anyone can learn about you, including companies you use. For a bitcoiner they overlap: a leaked home address is a privacy failure that becomes a physical security problem.
Where should a bitcoiner start with privacy?
Start with the email account tied to your exchanges. Put a hardware key on it, remove SMS as a recovery and login method, and then move your coins into self-custody so an exchange account is no longer worth attacking.
Do I need a VPN for privacy?
A VPN hides your traffic from your internet provider and your IP address from websites, but the VPN company sees that traffic instead. It ranks below every account step on this checklist. If you want one, pick a provider that needs no email and takes bitcoin, such as Mullvad.